X-Git-Url: https://git.wh0rd.org/?a=blobdiff_plain;f=classes%2Farticle.php;h=075da19409d986fb5f58bd0d7de21c216eae7387;hb=ed1262d55a01a6ffbefe01eb3b5fc22d33dfad24;hp=1d5f06e70ed15f6afde0a70b9a4998af2cef2a8f;hpb=c463a95dca0a5f2fbcdc1b67fd97f8c1159523f5;p=tt-rss.git
diff --git a/classes/article.php b/classes/article.php
old mode 100644
new mode 100755
index 1d5f06e7..075da194
--- a/classes/article.php
+++ b/classes/article.php
@@ -8,14 +8,15 @@ class Article extends Handler_Protected {
}
function redirect() {
- $id = $this->dbh->escape_string($_REQUEST['id']);
+ $id = clean($_REQUEST['id']);
- $result = $this->dbh->query("SELECT link FROM ttrss_entries, ttrss_user_entries
- WHERE id = '$id' AND id = ref_id AND owner_uid = '".$_SESSION['uid']."'
+ $sth = $this->pdo->prepare("SELECT link FROM ttrss_entries, ttrss_user_entries
+ WHERE id = ? AND id = ref_id AND owner_uid = ?
LIMIT 1");
+ $sth->execute([$id, $_SESSION['uid']]);
- if ($this->dbh->num_rows($result) == 1) {
- $article_url = $this->dbh->fetch_result($result, 0, 'link');
+ if ($row = $sth->fetch()) {
+ $article_url = $row['link'];
$article_url = str_replace("\n", "", $article_url);
header("Location: $article_url");
@@ -27,9 +28,9 @@ class Article extends Handler_Protected {
}
function view() {
- $id = $this->dbh->escape_string($_REQUEST["id"]);
- $cids = explode(",", $this->dbh->escape_string($_REQUEST["cids"]));
- $mode = $this->dbh->escape_string($_REQUEST["mode"]);
+ $id = clean($_REQUEST["id"]);
+ $cids = explode(",", clean($_REQUEST["cids"]));
+ $mode = clean($_REQUEST["mode"]);
// in prefetch mode we only output requested cids, main article
// just gets marked as read (it already exists in client cache)
@@ -67,19 +68,21 @@ class Article extends Handler_Protected {
private function catchupArticleById($id, $cmode) {
if ($cmode == 0) {
- $this->dbh->query("UPDATE ttrss_user_entries SET
+ $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET
unread = false,last_read = NOW()
- WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
+ WHERE ref_id = ? AND owner_uid = ?");
} else if ($cmode == 1) {
- $this->dbh->query("UPDATE ttrss_user_entries SET
+ $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET
unread = true
- WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
+ WHERE ref_id = ? AND owner_uid = ?");
} else {
- $this->dbh->query("UPDATE ttrss_user_entries SET
+ $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET
unread = NOT unread,last_read = NOW()
- WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
+ WHERE ref_id = ? AND owner_uid = ?");
}
+ $sth->execute([$id, $_SESSION['uid']]);
+
$feed_id = $this->getArticleFeed($id);
CCache::update($feed_id, $_SESSION["uid"]);
}
@@ -102,7 +105,7 @@ class Article extends Handler_Protected {
if ($enable_share_anything) {
$extracted_content = $af_readability->extract_content($url);
- if ($extracted_content) $content = db_escape_string($extracted_content);
+ if ($extracted_content) $content = $extracted_content;
}
}
}
@@ -122,34 +125,42 @@ class Article extends Handler_Protected {
if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) return false;
- db_query("BEGIN");
+ $pdo = Db::pdo();
+
+ $pdo->beginTransaction();
// only check for our user data here, others might have shared this with different content etc
- $result = db_query("SELECT id FROM ttrss_entries, ttrss_user_entries WHERE
- guid = '$guid' AND ref_id = id AND owner_uid = '$owner_uid' LIMIT 1");
+ $sth = $pdo->prepare("SELECT id FROM ttrss_entries, ttrss_user_entries WHERE
+ guid = ? AND ref_id = id AND owner_uid = ? LIMIT 1");
+ $sth->execute([$guid, $owner_uid]);
- if (db_num_rows($result) != 0) {
- $ref_id = db_fetch_result($result, 0, "id");
+ if ($row = $sth->fetch()) {
+ $ref_id = $row['id'];
- $result = db_query("SELECT int_id FROM ttrss_user_entries WHERE
- ref_id = '$ref_id' AND owner_uid = '$owner_uid' LIMIT 1");
+ $sth = $pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE
+ ref_id = ? AND owner_uid = ? LIMIT 1");
+ $sth->execute([$ref_id, $owner_uid]);
- if (db_num_rows($result) != 0) {
- $int_id = db_fetch_result($result, 0, "int_id");
+ if ($row = $sth->fetch()) {
+ $int_id = $row['int_id'];
- db_query("UPDATE ttrss_entries SET
- content = '$content', content_hash = '$content_hash' WHERE id = '$ref_id'");
+ $sth = $pdo->prepare("UPDATE ttrss_entries SET
+ content = ?, content_hash = ? WHERE id = ?");
+ $sth->execute([$content, $content_hash, $ref_id]);
- db_query("UPDATE ttrss_user_entries SET published = true,
+ $sth = $pdo->prepare("UPDATE ttrss_user_entries SET published = true,
last_published = NOW() WHERE
- int_id = '$int_id' AND owner_uid = '$owner_uid'");
+ int_id = ? AND owner_uid = ?");
+ $sth->execute([$int_id, $owner_uid]);
+
} else {
- db_query("INSERT INTO ttrss_user_entries
+ $sth = $pdo->prepare("INSERT INTO ttrss_user_entries
(ref_id, uuid, feed_id, orig_feed_id, owner_uid, published, tag_cache, label_cache,
last_read, note, unread, last_published)
VALUES
- ('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false, NOW())");
+ (?, '', NULL, NULL, ?, true, '', '', NOW(), '', false, NOW())");
+ $sth->execute([$ref_id, $owner_uid]);
}
if (count($labels) != 0) {
@@ -161,21 +172,24 @@ class Article extends Handler_Protected {
$rc = true;
} else {
- $result = db_query("INSERT INTO ttrss_entries
+ $sth = $pdo->prepare("INSERT INTO ttrss_entries
(title, guid, link, updated, content, content_hash, date_entered, date_updated)
VALUES
- ('$title', '$guid', '$url', NOW(), '$content', '$content_hash', NOW(), NOW())");
+ (?, ?, ?, NOW(), ?, ?, NOW(), NOW())");
+ $sth->execute([$title, $guid, $url, $content, $content_hash]);
- $result = db_query("SELECT id FROM ttrss_entries WHERE guid = '$guid'");
+ $sth = $pdo->prepare("SELECT id FROM ttrss_entries WHERE guid = ?");
+ $sth->execute([$guid]);
- if (db_num_rows($result) != 0) {
- $ref_id = db_fetch_result($result, 0, "id");
+ if ($row = $sth->fetch()) {
+ $ref_id = $row["id"];
- db_query("INSERT INTO ttrss_user_entries
+ $sth = $pdo->prepare("INSERT INTO ttrss_user_entries
(ref_id, uuid, feed_id, orig_feed_id, owner_uid, published, tag_cache, label_cache,
last_read, note, unread, last_published)
VALUES
- ('$ref_id', '', NULL, NULL, $owner_uid, true, '', '', NOW(), '', false, NOW())");
+ (?, '', NULL, NULL, ?, true, '', '', NOW(), '', false, NOW())");
+ $sth->execute([$ref_id, $owner_uid]);
if (count($labels) != 0) {
foreach ($labels as $label) {
@@ -187,7 +201,7 @@ class Article extends Handler_Protected {
}
}
- db_query("COMMIT");
+ $pdo->commit();
return $rc;
}
@@ -196,9 +210,9 @@ class Article extends Handler_Protected {
print __("Tags for this article (separated by commas):")."
";
- $param = $this->dbh->escape_string($_REQUEST['param']);
+ $param = clean($_REQUEST['param']);
- $tags = Article::get_article_tags($this->dbh->escape_string($param));
+ $tags = Article::get_article_tags($param);
$tags_str = join(", ", $tags);
@@ -227,11 +241,15 @@ class Article extends Handler_Protected {
}
function setScore() {
- $ids = $this->dbh->escape_string($_REQUEST['id']);
- $score = (int)$this->dbh->escape_string($_REQUEST['score']);
+ $ids = explode(",", clean($_REQUEST['id']));
+ $score = (int)clean($_REQUEST['score']);
- $this->dbh->query("UPDATE ttrss_user_entries SET
- score = '$score' WHERE ref_id IN ($ids) AND owner_uid = " . $_SESSION["uid"]);
+ $ids_qmarks = arr_qmarks($ids);
+
+ $sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET
+ score = ? WHERE ref_id IN ($ids_qmarks) AND owner_uid = ?");
+
+ $sth->execute(array_merge([$score], $ids, [$_SESSION['uid']]));
print json_encode(array("id" => $ids,
"score" => (int)$score,
@@ -239,10 +257,13 @@ class Article extends Handler_Protected {
}
function getScore() {
- $id = $this->dbh->escape_string($_REQUEST['id']);
+ $id = clean($_REQUEST['id']);
+
+ $sth = $this->pdo->prepare("SELECT score FROM ttrss_user_entries WHERE ref_id = ? AND owner_uid = ?");
+ $sth->execute([$id, $_SESSION['uid']]);
+ $row = $sth->fetch();
- $result = $this->dbh->query("SELECT score FROM ttrss_user_entries WHERE ref_id = $id AND owner_uid = " . $_SESSION["uid"]);
- $score = $this->dbh->fetch_result($result, 0, "score");
+ $score = $row['score'];
print json_encode(array("id" => $id,
"score" => (int)$score,
@@ -252,24 +273,26 @@ class Article extends Handler_Protected {
function setArticleTags() {
- $id = $this->dbh->escape_string($_REQUEST["id"]);
+ $id = clean($_REQUEST["id"]);
- $tags_str = $this->dbh->escape_string($_REQUEST["tags_str"]);
+ $tags_str = clean($_REQUEST["tags_str"]);
$tags = array_unique(trim_array(explode(",", $tags_str)));
- $this->dbh->query("BEGIN");
+ $this->pdo->beginTransaction();
- $result = $this->dbh->query("SELECT int_id FROM ttrss_user_entries WHERE
- ref_id = '$id' AND owner_uid = '".$_SESSION["uid"]."' LIMIT 1");
+ $sth = $this->pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE
+ ref_id = ? AND owner_uid = ? LIMIT 1");
+ $sth->execute([$id, $_SESSION['uid']]);
- if ($this->dbh->num_rows($result) == 1) {
+ if ($row = $sth->fetch()) {
$tags_to_cache = array();
- $int_id = $this->dbh->fetch_result($result, 0, "int_id");
+ $int_id = $row['int_id'];
- $this->dbh->query("DELETE FROM ttrss_tags WHERE
- post_int_id = $int_id AND owner_uid = '".$_SESSION["uid"]."'");
+ $sth = $this->pdo->prepare("DELETE FROM ttrss_tags WHERE
+ post_int_id = ? AND owner_uid = ?");
+ $sth->execute([$int_id, $_SESSION['uid']]);
foreach ($tags as $tag) {
$tag = sanitize_tag($tag);
@@ -285,8 +308,11 @@ class Article extends Handler_Protected {
// print "";
if ($tag != '') {
- $this->dbh->query("INSERT INTO ttrss_tags
- (post_int_id, owner_uid, tag_name) VALUES ('$int_id', '".$_SESSION["uid"]."', '$tag')");
+ $sth = $this->pdo->prepare("INSERT INTO ttrss_tags
+ (post_int_id, owner_uid, tag_name)
+ VALUES (?, ?, ?)");
+
+ $sth->execute([$int_id, $_SESSION['uid'], $tag]);
}
array_push($tags_to_cache, $tag);
@@ -297,12 +323,12 @@ class Article extends Handler_Protected {
sort($tags_to_cache);
$tags_str = join(",", $tags_to_cache);
- $this->dbh->query("UPDATE ttrss_user_entries
- SET tag_cache = '$tags_str' WHERE ref_id = '$id'
- AND owner_uid = " . $_SESSION["uid"]);
+ $sth = $this->pdo->prepare("UPDATE ttrss_user_entries
+ SET tag_cache = ? WHERE ref_id = ? AND owner_uid = ?");
+ $sth->execute([$tags_str, $id, $_SESSION['uid']]);
}
- $this->dbh->query("COMMIT");
+ $this->pdo->commit();
$tags = Article::get_article_tags($id);
$tags_str = $this->format_tags_string($tags, $id);
@@ -316,15 +342,17 @@ class Article extends Handler_Protected {
function completeTags() {
- $search = $this->dbh->escape_string($_REQUEST["search"]);
+ $search = clean($_REQUEST["search"]);
- $result = $this->dbh->query("SELECT DISTINCT tag_name FROM ttrss_tags
- WHERE owner_uid = '".$_SESSION["uid"]."' AND
- tag_name LIKE '$search%' ORDER BY tag_name
+ $sth = $this->pdo->prepare("SELECT DISTINCT tag_name FROM ttrss_tags
+ WHERE owner_uid = ? AND
+ tag_name LIKE ? ORDER BY tag_name
LIMIT 10");
+ $sth->execute([$_SESSION['uid'], "$search%"]);
+
print "