From c9d5c26041087cc3cf23ee4deda74055d5013ba4 Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Fri, 1 Dec 2017 17:40:53 +0300
Subject: [PATCH] auth/base: PDO functions: fix small pdo-related bug

---
 classes/auth/base.php | 21 ++++++++++-----------
 include/functions.php |  4 ++--
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/classes/auth/base.php b/classes/auth/base.php
index 30443121..652b66e6 100644
--- a/classes/auth/base.php
+++ b/classes/auth/base.php
@@ -1,9 +1,11 @@
 <?php
 class Auth_Base {
 	private $dbh;
+	private $pdo;
 
 	function __construct() {
 		$this->dbh = Db::get();
+		$this->pdo = Db::pdo();
 	}
 
 	/**
@@ -29,15 +31,13 @@ class Auth_Base {
 			if (!$password) $password = make_password();
 
 			if (!$user_id) {
-				$login = $this->dbh->escape_string($login);
 				$salt = substr(bin2hex(get_random_bytes(125)), 0, 250);
 				$pwd_hash = encrypt_password($password, $salt, true);
 
-				$query = "INSERT INTO ttrss_users
+				$sth = $this->pdo->prepare("INSERT INTO ttrss_users
 						(login,access_level,last_login,created,pwd_hash,salt)
-						VALUES ('$login', 0, null, NOW(), '$pwd_hash','$salt')";
-
-				$this->dbh->query($query);
+						VALUES (?, 0, null, NOW(), ?,?)");
+				$sth->execute([$login, $pwd_hash, $salt]);
 
 				return $this->find_user_by_login($login);
 
@@ -50,13 +50,12 @@ class Auth_Base {
 	}
 
 	function find_user_by_login($login) {
-		$login = $this->dbh->escape_string($login);
-
-		$result = $this->dbh->query("SELECT id FROM ttrss_users WHERE
-			login = '$login'");
+		$sth = $this->pdo->prepare("SELECT id FROM ttrss_users WHERE
+			login = ?");
+		$sth->execute([$login]);
 
-		if ($this->dbh->num_rows($result) > 0) {
-			return $this->dbh->fetch_result($result, 0, "id");
+		if ($row = $sth->fetch()) {
+			return $row["id"];
 		} else {
 			return false;
 		}
diff --git a/include/functions.php b/include/functions.php
index 377d4964..e7d74df0 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -266,8 +266,8 @@
 				marked = false AND
 				feed_id = ? AND
 				$query_limit
-				ttrss_entries.date_updated < NOW() - INTERVAL ?");
-			$sth->execute([$feed_id, "$purge_interval days"]);
+				ttrss_entries.date_updated < NOW() - INTERVAL ? days");
+			$sth->execute([$feed_id, $purge_interval]);
 
 		} else {
             $sth  = $pdo->prepare("DELETE FROM ttrss_user_entries
-- 
2.39.5