]> git.wh0rd.org - tt-rss.git/blobdiff - classes/rssutils.php
remove cache/simplepie
[tt-rss.git] / classes / rssutils.php
old mode 100644 (file)
new mode 100755 (executable)
index 84d6941..e76dd3e
@@ -1,9 +1,4 @@
 <?php
-define_default('DAEMON_UPDATE_LOGIN_LIMIT', 30);
-define_default('DAEMON_FEED_LIMIT', 500);
-define_default('DAEMON_SLEEP_INTERVAL', 120);
-define_default('_MIN_CACHE_FILE_SIZE', 1024);
-
 class RSSUtils {
        static function calculate_article_hash($article, $pluginhost) {
                $tmp = "";
@@ -21,33 +16,45 @@ class RSSUtils {
                return sha1(implode(",", $pluginhost->get_plugin_names()) . $tmp);
        }
 
+       // Strips utf8mb4 characters (i.e. emoji) for mysql
+       static function strip_utf8mb4($str) {
+               return preg_replace('/[\x{10000}-\x{10FFFF}]/u', "\xEF\xBF\xBD", $str);
+       }
+
        static function update_feedbrowser_cache() {
 
-               $result = db_query("SELECT feed_url, site_url, title, COUNT(id) AS subscribers
+               $pdo = Db::pdo();
+
+               $sth = $pdo->query("SELECT feed_url, site_url, title, COUNT(id) AS subscribers
                        FROM ttrss_feeds WHERE feed_url NOT IN (SELECT feed_url FROM ttrss_feeds
                                WHERE private IS true OR auth_login != '' OR auth_pass != '' OR feed_url LIKE '%:%@%/%')
                                GROUP BY feed_url, site_url, title ORDER BY subscribers DESC LIMIT 1000");
 
-               db_query("BEGIN");
+               $pdo->beginTransaction();
 
-               db_query("DELETE FROM ttrss_feedbrowser_cache");
+               $pdo->query("DELETE FROM ttrss_feedbrowser_cache");
 
                $count = 0;
 
-               while ($line = db_fetch_assoc($result)) {
-                       $subscribers = db_escape_string($line["subscribers"]);
-                       $feed_url = db_escape_string($line["feed_url"]);
-                       $title = db_escape_string($line["title"]);
-                       $site_url = db_escape_string($line["site_url"]);
+               while ($line = $sth->fetch()) {
+
+                       $subscribers = $line["subscribers"];
+                       $feed_url = $line["feed_url"];
+                       $title = $line["title"];
+                       $site_url = $line["site_url"];
 
-                       $tmp_result = db_query("SELECT subscribers FROM
-                               ttrss_feedbrowser_cache WHERE feed_url = '$feed_url'");
+                       $tmph = $pdo->prepare("SELECT subscribers FROM
+                               ttrss_feedbrowser_cache WHERE feed_url = ?");
+                       $tmph->execute([$feed_url]);
 
-                       if (db_num_rows($tmp_result) == 0) {
+                       if (!$tmph->fetch()) {
 
-                               db_query("INSERT INTO ttrss_feedbrowser_cache
-                                       (feed_url, site_url, title, subscribers) VALUES ('$feed_url',
-                                               '$site_url', '$title', '$subscribers')");
+                               $tmph = $pdo->prepare("INSERT INTO ttrss_feedbrowser_cache
+                                       (feed_url, site_url, title, subscribers)
+                                       VALUES
+                                       (?, ?, ?, ?)");
+
+                               $tmph->execute([$feed_url, $site_url, $title, $subscribers]);
 
                                ++$count;
 
@@ -55,24 +62,21 @@ class RSSUtils {
 
                }
 
-               db_query("COMMIT");
+               $pdo->commit();
 
                return $count;
 
        }
 
        static function update_daemon_common($limit = DAEMON_FEED_LIMIT, $debug = true) {
-               // Process all other feeds using last_updated and interval parameters
-
                $schema_version = get_schema_version();
 
                if ($schema_version != SCHEMA_VERSION) {
                        die("Schema version is wrong, please upgrade the database.\n");
                }
 
-               define('PREFS_NO_CACHE', true);
+               $pdo = Db::pdo();
 
-               // Test if the user has loggued in recently. If not, it does not update its feeds.
                if (!SINGLE_USER_MODE && DAEMON_UPDATE_LOGIN_LIMIT > 0) {
                        if (DB_TYPE == "pgsql") {
                                $login_thresh_qpart = "AND ttrss_users.last_login >= NOW() - INTERVAL '".DAEMON_UPDATE_LOGIN_LIMIT." days'";
@@ -83,7 +87,6 @@ class RSSUtils {
                        $login_thresh_qpart = "";
                }
 
-               // Test if the feed need a update (update interval exceeded).
                if (DB_TYPE == "pgsql") {
                        $update_limit_qpart = "AND ((
                                        ttrss_feeds.update_interval = 0
@@ -117,9 +120,7 @@ class RSSUtils {
                        $updstart_thresh_qpart = "AND (ttrss_feeds.last_update_started IS NULL OR ttrss_feeds.last_update_started < DATE_SUB(NOW(), INTERVAL 10 MINUTE))";
                }
 
-               // Test if there is a limit to number of updated feeds
-               $query_limit = "";
-               if($limit) $query_limit = sprintf("LIMIT %d", $limit);
+               $query_limit = $limit ? sprintf("LIMIT %d", $limit) : "";
 
                // Update the least recently updated feeds first
                $query_order = "ORDER BY last_updated";
@@ -137,30 +138,23 @@ class RSSUtils {
                                $updstart_thresh_qpart
                                $query_order $query_limit";
 
-               // We search for feed needing update.
-               $result = db_query($query);
-
-               if($debug) _debug(sprintf("Scheduled %d feeds to update...", db_num_rows($result)));
+               $res = $pdo->query($query);
 
-               // Here is a little cache magic in order to minimize risk of double feed updates.
                $feeds_to_update = array();
-               while ($line = db_fetch_assoc($result)) {
-                       array_push($feeds_to_update, db_escape_string($line['feed_url']));
+               while ($line = $res->fetch()) {
+                       array_push($feeds_to_update, $line['feed_url']);
                }
 
-               // We update the feed last update started date before anything else.
-               // There is no lag due to feed contents downloads
-               // It prevent an other process to update the same feed.
+               if ($debug) _debug(sprintf("Scheduled %d feeds to update...", count($feeds_to_update)));
 
-               if(count($feeds_to_update) > 0) {
-                       $feeds_quoted = array();
-
-                       foreach ($feeds_to_update as $feed) {
-                               array_push($feeds_quoted, "'" . db_escape_string($feed) . "'");
-                       }
+               // Update last_update_started before actually starting the batch
+               // in order to minimize collision risk for parallel daemon tasks
+               if (count($feeds_to_update) > 0) {
+                       $feeds_qmarks = arr_qmarks($feeds_to_update);
 
-                       db_query(sprintf("UPDATE ttrss_feeds SET last_update_started = NOW()
-                               WHERE feed_url IN (%s)", implode(',', $feeds_quoted)));
+                       $tmph = $pdo->prepare("UPDATE ttrss_feeds SET last_update_started = NOW()
+                               WHERE feed_url IN ($feeds_qmarks)");
+                       $tmph->execute($feeds_to_update);
                }
 
                $nf = 0;
@@ -168,40 +162,49 @@ class RSSUtils {
 
                $batch_owners = array();
 
-               // For each feed, we call the feed update function.
-               foreach ($feeds_to_update as $feed) {
-                       if($debug) _debug("Base feed: $feed");
-
-                       //update_rss_feed($line["id"], true);
-
-                       // since we have the data cached, we can deal with other feeds with the same url
-
-                       $tmp_result = db_query("SELECT DISTINCT ttrss_feeds.id,last_updated,ttrss_feeds.owner_uid
+               // since we have the data cached, we can deal with other feeds with the same url
+               $usth = $pdo->prepare("SELECT DISTINCT ttrss_feeds.id,last_updated,ttrss_feeds.owner_uid
                        FROM ttrss_feeds, ttrss_users, ttrss_user_prefs WHERE
                                ttrss_user_prefs.owner_uid = ttrss_feeds.owner_uid AND
                                ttrss_users.id = ttrss_user_prefs.owner_uid AND
                                ttrss_user_prefs.pref_name = 'DEFAULT_UPDATE_INTERVAL' AND
                                ttrss_user_prefs.profile IS NULL AND
-                               feed_url = '".db_escape_string($feed)."'
+                               feed_url = ?
                                $update_limit_qpart
                                $login_thresh_qpart
                        ORDER BY ttrss_feeds.id $query_limit");
 
-                       if (db_num_rows($tmp_result) > 0) {
-                               while ($tline = db_fetch_assoc($tmp_result)) {
-                                       if($debug) _debug(" => " . $tline["last_updated"] . ", " . $tline["id"] . " " . $tline["owner_uid"]);
+               foreach ($feeds_to_update as $feed) {
+                       if($debug) _debug("Base feed: $feed");
+
+                       $usth->execute([$feed]);
+                       //update_rss_feed($line["id"], true);
 
-                                       if (array_search($tline["owner_uid"], $batch_owners) === FALSE)
-                                               array_push($batch_owners, $tline["owner_uid"]);
+                       if ($tline = $usth->fetch()) {
+                               if ($debug) _debug(" => " . $tline["last_updated"] . ", " . $tline["id"] . " " . $tline["owner_uid"]);
 
-                                       $fstarted = microtime(true);
-                                       RSSUtils::update_rss_feed($tline["id"], true, false);
-                                       _debug_suppress(false);
+                               if (array_search($tline["owner_uid"], $batch_owners) === FALSE)
+                                       array_push($batch_owners, $tline["owner_uid"]);
 
-                                       _debug(sprintf("    %.4f (sec)", microtime(true) - $fstarted));
+                               $fstarted = microtime(true);
 
-                                       ++$nf;
+                               try {
+                                       RSSUtils::update_rss_feed($tline["id"], true, false);
+                               } catch (PDOException $e) {
+                                       Logger::get()->log_error(E_USER_NOTICE, $e->getMessage(), $e->getFile(), $e->getLine(), $e->getTraceAsString());
+
+                                       try {
+                                               $pdo->rollback();
+                                       } catch (PDOException $e) {
+                                               // it doesn't matter if there wasn't actually anything to rollback, PDO Exception can be
+                                               // thrown outside of an active transaction during feed update
+                                       }
                                }
+                               _debug_suppress(false);
+
+                               _debug(sprintf("    %.4f (sec)", microtime(true) - $fstarted));
+
+                               ++$nf;
                        }
                }
 
@@ -220,66 +223,86 @@ class RSSUtils {
                Digest::send_headlines_digests($debug);
 
                return $nf;
-
        }
 
        // this is used when subscribing
        static function set_basic_feed_info($feed) {
 
-               $feed = db_escape_string($feed);
+               $pdo = Db::pdo();
 
-               $result = db_query("SELECT feed_url,auth_pass,auth_login,auth_pass_encrypted
-                                       FROM ttrss_feeds WHERE id = '$feed'");
+               $sth = $pdo->prepare("SELECT owner_uid,feed_url,auth_pass,auth_login
+                               FROM ttrss_feeds WHERE id = ?");
+               $sth->execute([$feed]);
 
-               $auth_pass_encrypted = sql_bool_to_bool(db_fetch_result($result,
-                       0, "auth_pass_encrypted"));
+               if ($row = $sth->fetch()) {
 
-               $auth_login = db_fetch_result($result, 0, "auth_login");
-               $auth_pass = db_fetch_result($result, 0, "auth_pass");
+                       $owner_uid = $row["owner_uid"];
+                       $auth_login = $row["auth_login"];
+                       $auth_pass = $row["auth_pass"];
+                       $fetch_url = $row["feed_url"];
 
-               if ($auth_pass_encrypted && function_exists("mcrypt_decrypt")) {
-                       require_once "crypt.php";
-                       $auth_pass = decrypt_string($auth_pass);
-               }
+                       $pluginhost = new PluginHost();
+                       $user_plugins = get_pref("_ENABLED_PLUGINS", $owner_uid);
 
-               $fetch_url = db_fetch_result($result, 0, "feed_url");
+                       $pluginhost->load(PLUGINS, PluginHost::KIND_ALL);
+                       $pluginhost->load($user_plugins, PluginHost::KIND_USER, $owner_uid);
+                       $pluginhost->load_data();
 
-               $feed_data = fetch_file_contents($fetch_url, false,
-                       $auth_login, $auth_pass, false,
-                       FEED_FETCH_TIMEOUT,
-                       0);
+                       $basic_info = array();
+                       foreach ($pluginhost->get_hooks(PluginHost::HOOK_FEED_BASIC_INFO) as $plugin) {
+                               $basic_info = $plugin->hook_feed_basic_info($basic_info, $fetch_url, $owner_uid, $feed, $auth_login, $auth_pass);
+                       }
 
-               global $fetch_curl_used;
+                       if (!$basic_info) {
+                               $feed_data = fetch_file_contents($fetch_url, false,
+                                       $auth_login, $auth_pass, false,
+                                       FEED_FETCH_TIMEOUT,
+                                       0);
 
-               if (!$fetch_curl_used) {
-                       $tmp = @gzdecode($feed_data);
+                               global $fetch_curl_used;
 
-                       if ($tmp) $feed_data = $tmp;
-               }
+                               if (!$fetch_curl_used) {
+                                       $tmp = @gzdecode($feed_data);
 
-               $feed_data = trim($feed_data);
+                                       if ($tmp) $feed_data = $tmp;
+                               }
 
-               $rss = new FeedParser($feed_data);
-               $rss->init();
+                               $feed_data = trim($feed_data);
 
-               if (!$rss->error()) {
+                               $rss = new FeedParser($feed_data);
+                               $rss->init();
 
-                       $result = db_query("SELECT title, site_url FROM ttrss_feeds WHERE id = '$feed'");
+                               if (!$rss->error()) {
+                                       $basic_info = array(
+                                               'title' => mb_substr($rss->get_title(), 0, 199),
+                                               'site_url' => mb_substr(rewrite_relative_url($fetch_url, $rss->get_link()), 0, 245)
+                                       );
+                               }
+                       }
 
-                       $registered_title = db_fetch_result($result, 0, "title");
-                       $orig_site_url = db_fetch_result($result, 0, "site_url");
+                       if ($basic_info && is_array($basic_info)) {
+                               $sth = $pdo->prepare("SELECT title, site_url FROM ttrss_feeds WHERE id = ?");
+                               $sth->execute([$feed]);
 
-                       $site_url = db_escape_string(mb_substr(rewrite_relative_url($fetch_url, $rss->get_link()), 0, 245));
-                       $feed_title = db_escape_string(mb_substr($rss->get_title(), 0, 199));
+                               if ($row = $sth->fetch()) {
 
-                       if ($feed_title && (!$registered_title || $registered_title == "[Unknown]")) {
-                               db_query("UPDATE ttrss_feeds SET
-                                       title = '$feed_title' WHERE id = '$feed'");
-                       }
+                                       $registered_title = $row["title"];
+                                       $orig_site_url = $row["site_url"];
+
+                                       if ($basic_info['title'] && (!$registered_title || $registered_title == "[Unknown]")) {
+
+                                               $sth = $pdo->prepare("UPDATE ttrss_feeds SET
+                                                       title = ? WHERE id = ?");
+                                               $sth->execute([$basic_info['title'], $feed]);
+                                       }
+
+                                       if ($basic_info['site_url'] && $orig_site_url != $basic_info['site_url']) {
+                                               $sth = $pdo->prepare("UPDATE ttrss_feeds SET
+                                                       site_url = ? WHERE id = ?");
+                                               $sth->execute([$basic_info['site_url'], $feed]);
+                                       }
 
-                       if ($site_url && $orig_site_url != $site_url) {
-                               db_query("UPDATE ttrss_feeds SET
-                                                       site_url = '$site_url' WHERE id = '$feed'");
+                               }
                        }
                }
        }
@@ -289,21 +312,23 @@ class RSSUtils {
         */
        static function update_rss_feed($feed, $no_cache = false) {
 
-               $debug_enabled = defined('DAEMON_EXTENDED_DEBUG') || $_REQUEST['xdebug'];
+               $debug_enabled = defined('DAEMON_EXTENDED_DEBUG') || clean($_REQUEST['xdebug']);
 
                _debug_suppress(!$debug_enabled);
                _debug("start", $debug_enabled);
 
-               $result = db_query("SELECT title FROM ttrss_feeds
-                       WHERE id = '$feed'");
+               $pdo = Db::pdo();
+
+               $sth = $pdo->prepare("SELECT title FROM ttrss_feeds WHERE id = ?");
+               $sth->execute([$feed]);
 
-               if (db_num_rows($result) == 0) {
+               if (!$row = $sth->fetch()) {
                        _debug("feed $feed NOT FOUND/SKIPPED", $debug_enabled);
                        user_error("Attempt to update unknown/invalid feed $feed", E_USER_WARNING);
                        return false;
                }
 
-               $title = db_fetch_result($result, 0, "title");
+               $title = $row["title"];
 
                // feed was batch-subscribed or something, we need to get basic info
                // this is not optimal currently as it fetches stuff separately TODO: optimize
@@ -312,41 +337,41 @@ class RSSUtils {
                        RSSUtils::set_basic_feed_info($feed);
                }
 
-               $result = db_query("SELECT id,update_interval,auth_login,
+               $sth = $pdo->prepare("SELECT id,update_interval,auth_login,
                        feed_url,auth_pass,cache_images,
                        mark_unread_on_update, owner_uid,
-                       pubsub_state, auth_pass_encrypted,
-                       feed_language
-                       FROM ttrss_feeds WHERE id = '$feed'");
-
-               $owner_uid = db_fetch_result($result, 0, "owner_uid");
-               $mark_unread_on_update = sql_bool_to_bool(db_fetch_result($result,
-                       0, "mark_unread_on_update"));
-               $pubsub_state = db_fetch_result($result, 0, "pubsub_state");
-               $auth_pass_encrypted = sql_bool_to_bool(db_fetch_result($result,
-                       0, "auth_pass_encrypted"));
-
-               db_query("UPDATE ttrss_feeds SET last_update_started = NOW()
-                       WHERE id = '$feed'");
-
-               $auth_login = db_fetch_result($result, 0, "auth_login");
-               $auth_pass = db_fetch_result($result, 0, "auth_pass");
-
-               if ($auth_pass_encrypted && function_exists("mcrypt_decrypt")) {
-                       require_once "crypt.php";
-                       $auth_pass = decrypt_string($auth_pass);
-               }
+                       auth_pass_encrypted, feed_language,
+                       last_modified,
+                       ".SUBSTRING_FOR_DATE."(last_unconditional, 1, 19) AS last_unconditional
+                       FROM ttrss_feeds WHERE id = ?");
+               $sth->execute([$feed]);
+
+               if ($row = $sth->fetch()) {
+
+                       $owner_uid = $row["owner_uid"];
+                       $mark_unread_on_update = $row["mark_unread_on_update"];
 
-               $cache_images = sql_bool_to_bool(db_fetch_result($result, 0, "cache_images"));
-               $fetch_url = db_fetch_result($result, 0, "feed_url");
-               $feed_language = db_escape_string(mb_strtolower(db_fetch_result($result, 0, "feed_language")));
-               if (!$feed_language) $feed_language = 'english';
+                       $sth = $pdo->prepare("UPDATE ttrss_feeds SET last_update_started = NOW()
+                               WHERE id = ?");
+                       $sth->execute([$feed]);
 
-               $feed = db_escape_string($feed);
+                       $auth_login = $row["auth_login"];
+                       $auth_pass = $row["auth_pass"];
+                       $stored_last_modified = $row["last_modified"];
+                       $last_unconditional = $row["last_unconditional"];
+                       $cache_images = $row["cache_images"];
+                       $fetch_url = $row["feed_url"];
+
+                       $feed_language = mb_strtolower($row["feed_language"]);
+                       if (!$feed_language) $feed_language = 'english';
+
+               } else {
+                       return false;
+               }
 
                $date_feed_processed = date('Y-m-d H:i');
 
-               $cache_filename = CACHE_DIR . "/simplepie/" . sha1($fetch_url) . ".xml";
+               $cache_filename = CACHE_DIR . "/feeds/" . sha1($fetch_url) . ".xml";
 
                $pluginhost = new PluginHost();
                $pluginhost->set_debug($debug_enabled);
@@ -384,18 +409,33 @@ class RSSUtils {
                        _debug("local cache will not be used for this feed", $debug_enabled);
                }
 
+               global $fetch_last_modified;
+
                // fetch feed from source
                if (!$feed_data) {
-                       _debug("fetching [$fetch_url]...", $debug_enabled);
+                       _debug("last unconditional update request: $last_unconditional");
 
                        if (ini_get("open_basedir") && function_exists("curl_init")) {
                                _debug("not using CURL due to open_basedir restrictions");
                        }
 
-                       $feed_data = fetch_file_contents($fetch_url, false,
-                               $auth_login, $auth_pass, false,
-                               $no_cache ? FEED_FETCH_NO_CACHE_TIMEOUT : FEED_FETCH_TIMEOUT,
-                               0);
+                       if (time() - strtotime($last_unconditional) > MAX_CONDITIONAL_INTERVAL) {
+                               _debug("maximum allowed interval for conditional requests exceeded, forcing refetch");
+
+                               $force_refetch = true;
+                       } else {
+                               _debug("stored last modified for conditional request: $stored_last_modified", $debug_enabled);
+                       }
+
+                       _debug("fetching [$fetch_url] (force_refetch: $force_refetch)...", $debug_enabled);
+
+                       $feed_data = fetch_file_contents([
+                               "url" => $fetch_url,
+                               "login" => $auth_login,
+                               "pass" => $auth_pass,
+                               "timeout" => $no_cache ? FEED_FETCH_NO_CACHE_TIMEOUT : FEED_FETCH_TIMEOUT,
+                               "last_modified" => $force_refetch ? "" : $stored_last_modified
+                       ]);
 
                        global $fetch_curl_used;
 
@@ -408,9 +448,15 @@ class RSSUtils {
                        $feed_data = trim($feed_data);
 
                        _debug("fetch done.", $debug_enabled);
+                       _debug("source last modified: " . $fetch_last_modified, $debug_enabled);
+
+                       if ($feed_data && $fetch_last_modified != $stored_last_modified) {
+                               $sth = $pdo->prepare("UPDATE ttrss_feeds SET last_modified = ? WHERE id = ?");
+                               $sth->execute([substr($fetch_last_modified, 0, 245), $feed]);
+                       }
 
                        // cache vanilla feed data for re-use
-                       if ($feed_data && !$auth_pass && !$auth_login && is_writable(CACHE_DIR . "/simplepie")) {
+                       if ($feed_data && !$auth_pass && !$auth_login && is_writable(CACHE_DIR . "/feeds")) {
                                $new_rss_hash = sha1($feed_data);
 
                                if ($new_rss_hash != $rss_hash) {
@@ -426,18 +472,17 @@ class RSSUtils {
 
                        _debug("unable to fetch: $fetch_last_error [$fetch_last_error_code]", $debug_enabled);
 
-                       $error_escaped = '';
-
                        // If-Modified-Since
                        if ($fetch_last_error_code != 304) {
-                               $error_escaped = db_escape_string($fetch_last_error);
+                               $error_message = $fetch_last_error;
                        } else {
                                _debug("source claims data not modified, nothing to do.", $debug_enabled);
+                               $error_message = "";
                        }
 
-                       db_query(
-                               "UPDATE ttrss_feeds SET last_error = '$error_escaped',
-                                       last_updated = NOW() WHERE id = '$feed'");
+                       $sth = $pdo->prepare("UPDATE ttrss_feeds SET last_error = ?,
+                                       last_updated = NOW() WHERE id = ?");
+                       $sth->execute([$error_message, $feed]);
 
                        return;
                }
@@ -449,8 +494,6 @@ class RSSUtils {
                $rss = new FeedParser($feed_data);
                $rss->init();
 
-               $feed = db_escape_string($feed);
-
                if (!$rss->error()) {
 
                        // We use local pluginhost here because we need to load different per-user feed plugins
@@ -459,26 +502,27 @@ class RSSUtils {
                        _debug("language: $feed_language", $debug_enabled);
                        _debug("processing feed data...", $debug_enabled);
 
-//                     db_query("BEGIN");
-
                        if (DB_TYPE == "pgsql") {
                                $favicon_interval_qpart = "favicon_last_checked < NOW() - INTERVAL '12 hour'";
                        } else {
                                $favicon_interval_qpart = "favicon_last_checked < DATE_SUB(NOW(), INTERVAL 12 HOUR)";
                        }
 
-                       $result = db_query("SELECT owner_uid,favicon_avg_color,
+                       $sth = $pdo->prepare("SELECT owner_uid,favicon_avg_color,
                                (favicon_last_checked IS NULL OR $favicon_interval_qpart) AS
                                                favicon_needs_check
-                               FROM ttrss_feeds WHERE id = '$feed'");
+                               FROM ttrss_feeds WHERE id = ?");
+                       $sth->execute([$feed]);
 
-                       $favicon_needs_check = sql_bool_to_bool(db_fetch_result($result, 0,
-                               "favicon_needs_check"));
-                       $favicon_avg_color = db_fetch_result($result, 0, "favicon_avg_color");
-
-                       $owner_uid = db_fetch_result($result, 0, "owner_uid");
+                       if ($row = $sth->fetch()) {
+                               $favicon_needs_check = $row["favicon_needs_check"];
+                               $favicon_avg_color = $row["favicon_avg_color"];
+                               $owner_uid = $row["owner_uid"];
+                       } else {
+                               return false;
+                       }
 
-                       $site_url = db_escape_string(mb_substr(rewrite_relative_url($fetch_url, $rss->get_link()), 0, 245));
+                       $site_url = mb_substr(rewrite_relative_url($fetch_url, $rss->get_link()), 0, 245);
 
                        _debug("site_url: $site_url", $debug_enabled);
                        _debug("feed_title: " . $rss->get_title(), $debug_enabled);
@@ -499,29 +543,35 @@ class RSSUtils {
                                if ($favicon_modified_new > $favicon_modified)
                                        $favicon_avg_color = '';
 
+                               $favicon_colorstring = "";
                                if (file_exists($favicon_file) && function_exists("imagecreatefromstring") && $favicon_avg_color == '') {
                                        require_once "colors.php";
 
-                                       db_query("UPDATE ttrss_feeds SET favicon_avg_color = 'fail' WHERE
-                                                       id = '$feed'");
+                                       $sth = $pdo->prepare("UPDATE ttrss_feeds SET favicon_avg_color = 'fail' WHERE
+                                                       id = ?");
+                                       $sth->execute([$feed]);
 
-                                       $favicon_color = db_escape_string(
-                                               calculate_avg_color($favicon_file));
+                                       $favicon_color = calculate_avg_color($favicon_file);
+
+                                       $favicon_colorstring = ",favicon_avg_color = " . $pdo->quote($favicon_color);
 
-                                       $favicon_colorstring = ",favicon_avg_color = '".$favicon_color."'";
                                } else if ($favicon_avg_color == 'fail') {
                                        _debug("floicon failed on this file, not trying to recalculate avg color", $debug_enabled);
                                }
 
-                               db_query("UPDATE ttrss_feeds SET favicon_last_checked = NOW()
-                                       $favicon_colorstring
-                                       WHERE id = '$feed'");
+                               $sth = $pdo->prepare("UPDATE ttrss_feeds SET favicon_last_checked = NOW()
+                                       $favicon_colorstring WHERE id = ?");
+                               $sth->execute([$feed]);
                        }
 
                        _debug("loading filters & labels...", $debug_enabled);
 
                        $filters = load_filters($feed, $owner_uid);
 
+                       if ($debug_enabled) {
+                               print_r($filters);
+                       }
+
                        _debug("" . count($filters) . " filters loaded.", $debug_enabled);
 
                        $items = $rss->get_items();
@@ -529,59 +579,11 @@ class RSSUtils {
                        if (!is_array($items)) {
                                _debug("no articles found.", $debug_enabled);
 
-                               db_query("UPDATE ttrss_feeds
-                                       SET last_updated = NOW(), last_error = '' WHERE id = '$feed'");
-
-                               return; // no articles
-                       }
-
-                       if ($pubsub_state != 2 && PUBSUBHUBBUB_ENABLED) {
-
-                               _debug("checking for PUSH hub...", $debug_enabled);
-
-                               $feed_hub_url = false;
-
-                               $links = $rss->get_links('hub');
-
-                               if ($links && is_array($links)) {
-                                       foreach ($links as $l) {
-                                               $feed_hub_url = $l;
-                                               break;
-                                       }
-                               }
-
-                               _debug("feed hub url: $feed_hub_url", $debug_enabled);
-
-                               $feed_self_url = $fetch_url;
-
-                               $links = $rss->get_links('self');
-
-                               if ($links && is_array($links)) {
-                                       foreach ($links as $l) {
-                                               $feed_self_url = $l;
-                                               break;
-                                       }
-                               }
-
-                               _debug("feed self url = $feed_self_url");
+                               $sth = $pdo->prepare("UPDATE ttrss_feeds
+                                       SET last_updated = NOW(), last_unconditional = NOW(), last_error = '' WHERE id = ?");
+                               $sth->execute([$feed]);
 
-                               if ($feed_hub_url && $feed_self_url && function_exists('curl_init') &&
-                                       !ini_get("open_basedir")) {
-
-                                       require_once 'lib/pubsubhubbub/Subscriber.php';
-
-                                       $callback_url = get_self_url_prefix() .
-                                               "/public.php?op=pubsub&id=$feed";
-
-                                       $s = new Pubsubhubbub\Subscriber\Subscriber($feed_hub_url, $callback_url);
-
-                                       $rc = $s->subscribe($feed_self_url);
-
-                                       _debug("feed hub url found, subscribe request sent. [rc=$rc]", $debug_enabled);
-
-                                       db_query("UPDATE ttrss_feeds SET pubsub_state = 1
-                                               WHERE id = '$feed'");
-                               }
+                               return true; // no articles
                        }
 
                        _debug("processing articles...", $debug_enabled);
@@ -589,29 +591,34 @@ class RSSUtils {
                        $tstart = time();
 
                        foreach ($items as $item) {
-                               if ($_REQUEST['xdebug'] == 3) {
+                               $pdo->beginTransaction();
+
+                               if (clean($_REQUEST['xdebug']) == 3) {
                                        print_r($item);
                                }
 
                                if (ini_get("max_execution_time") > 0 && time() - $tstart >= ini_get("max_execution_time") * 0.7) {
                                        _debug("looks like there's too many articles to process at once, breaking out", $debug_enabled);
+                                       $pdo->commit();
                                        break;
                                }
 
-                               $entry_guid = $item->get_id();
-                               if (!$entry_guid) $entry_guid = $item->get_link();
+                               $entry_guid = strip_tags($item->get_id());
+                               if (!$entry_guid) $entry_guid = strip_tags($item->get_link());
                                if (!$entry_guid) $entry_guid = RSSUtils::make_guid_from_title($item->get_title());
-                               if (!$entry_guid) continue;
+
+                               if (!$entry_guid) {
+                                       $pdo->commit();
+                                       continue;
+                               }
 
                                $entry_guid = "$owner_uid,$entry_guid";
 
-                               $entry_guid_hashed = db_escape_string('SHA1:' . sha1($entry_guid));
+                               $entry_guid_hashed = 'SHA1:' . sha1($entry_guid);
 
                                _debug("guid $entry_guid / $entry_guid_hashed", $debug_enabled);
 
-                               $entry_timestamp = "";
-
-                               $entry_timestamp = $item->get_date();
+                               $entry_timestamp = strip_tags($item->get_date());
 
                                _debug("orig date: " . $item->get_date(), $debug_enabled);
 
@@ -623,31 +630,32 @@ class RSSUtils {
 
                                _debug("date $entry_timestamp [$entry_timestamp_fmt]", $debug_enabled);
 
-//                             $entry_title = html_entity_decode($item->get_title(), ENT_COMPAT, 'UTF-8');
-//                             $entry_title = decode_numeric_entities($entry_title);
-                               $entry_title = $item->get_title();
+                               $entry_title = strip_tags($item->get_title());
 
                                $entry_link = rewrite_relative_url($site_url, $item->get_link());
 
+                               $entry_language = mb_substr(trim($item->get_language()), 0, 2);
+
                                _debug("title $entry_title", $debug_enabled);
                                _debug("link $entry_link", $debug_enabled);
+                               _debug("language $entry_language", $debug_enabled);
 
                                if (!$entry_title) $entry_title = date("Y-m-d H:i:s", $entry_timestamp);;
 
                                $entry_content = $item->get_content();
                                if (!$entry_content) $entry_content = $item->get_description();
 
-                               if ($_REQUEST["xdebug"] == 2) {
+                               if (clean($_REQUEST["xdebug"]) == 2) {
                                        print "content: ";
                                        print htmlspecialchars($entry_content);
                                        print "\n";
                                }
 
-                               $entry_comments = db_escape_string(mb_substr($item->get_comments_url(), 0, 245));
+                               $entry_comments = mb_substr(strip_tags($item->get_comments_url()), 0, 245);
                                $num_comments = (int) $item->get_comments_count();
 
-                               $entry_author = $item->get_author(); // escaped later
-                               $entry_guid = db_escape_string(mb_substr($entry_guid, 0, 245));
+                               $entry_author = strip_tags($item->get_author());
+                               $entry_guid = mb_substr($entry_guid, 0, 245);
 
                                _debug("author $entry_author", $debug_enabled);
                                _debug("num_comments: $num_comments", $debug_enabled);
@@ -667,30 +675,32 @@ class RSSUtils {
 
                                $entry_tags = array_unique($additional_tags);
 
-                               for ($i = 0; $i < count($entry_tags); $i++)
+                               for ($i = 0; $i < count($entry_tags); $i++) {
                                        $entry_tags[$i] = mb_strtolower($entry_tags[$i], 'utf-8');
 
+                                       // we don't support numeric tags, let's prefix them
+                                       if (is_numeric($entry_tags[$i])) $entry_tags[$i] = 't:' . $entry_tags[$i];
+                               }
+
                                _debug("tags found: " . join(",", $entry_tags), $debug_enabled);
 
                                _debug("done collecting data.", $debug_enabled);
 
-                               $result = db_query("SELECT id, content_hash, lang FROM ttrss_entries
-                                       WHERE guid = '".db_escape_string($entry_guid)."' OR guid = '$entry_guid_hashed'");
+                               $sth = $pdo->prepare("SELECT id, content_hash, lang FROM ttrss_entries
+                                       WHERE guid = ? OR guid = ?");
+                               $sth->execute([$entry_guid, $entry_guid_hashed]);
 
-                               if (db_num_rows($result) != 0) {
-                                       $base_entry_id = db_fetch_result($result, 0, "id");
-                                       $entry_stored_hash = db_fetch_result($result, 0, "content_hash");
+                               if ($row = $sth->fetch()) {
+                                       $base_entry_id = $row["id"];
+                                       $entry_stored_hash = $row["content_hash"];
                                        $article_labels = Article::get_article_labels($base_entry_id, $owner_uid);
-                                       $entry_language = db_fetch_result($result, 0, "lang");
 
                                        $existing_tags = Article::get_article_tags($base_entry_id, $owner_uid);
                                        $entry_tags = array_unique(array_merge($entry_tags, $existing_tags));
-
                                } else {
                                        $base_entry_id = false;
                                        $entry_stored_hash = "";
                                        $article_labels = array();
-                                       $entry_language = "";
                                }
 
                                $article = array("owner_uid" => $owner_uid, // read only
@@ -705,6 +715,7 @@ class RSSUtils {
                                        "force_catchup" => false, // ugly hack for the time being
                                        "score_modifier" => 0, // no previous value, plugin should recalculate score modifier based on content if needed
                                        "language" => $entry_language,
+                                       "num_comments" => $num_comments, // read only
                                        "feed" => array("id" => $feed,
                                                "fetch_url" => $fetch_url,
                                                "site_url" => $site_url,
@@ -724,11 +735,11 @@ class RSSUtils {
                                        // dupes when the entry gets purged and reinserted again e.g.
                                        // in the case of SLOW SLOW OMG SLOW updating feeds
 
-                                       $base_entry_id = db_fetch_result($result, 0, "id");
-
-                                       db_query("UPDATE ttrss_entries SET date_updated = NOW()
-                                               WHERE id = '$base_entry_id'");
+                                       $sth = $pdo->prepare("UPDATE ttrss_entries SET date_updated = NOW()
+                                               WHERE id = ?");
+                                       $sth->execute([$base_entry_id]);
 
+                                       $pdo->commit();
                                        continue;
                                }
 
@@ -745,23 +756,20 @@ class RSSUtils {
                                        $entry_plugin_data .= mb_strtolower(get_class($plugin)) . ",";
                                }
 
-                               if ($_REQUEST["xdebug"] == 2) {
+                               if (clean($_REQUEST["xdebug"]) == 2) {
                                        print "processed content: ";
                                        print htmlspecialchars($article["content"]);
                                        print "\n";
                                }
 
-                               $entry_plugin_data = db_escape_string($entry_plugin_data);
-
                                _debug("plugin data: $entry_plugin_data", $debug_enabled);
 
                                // Workaround: 4-byte unicode requires utf8mb4 in MySQL. See https://tt-rss.org/forum/viewtopic.php?f=1&t=3377&p=20077#p20077
-                               if (DB_TYPE == "mysql") {
+                               if (DB_TYPE == "mysql" && MYSQL_CHARSET != "UTF8MB4") {
                                        foreach ($article as $k => $v) {
-
                                                // i guess we'll have to take the risk of 4byte unicode labels & tags here
                                                if (is_string($article[$k])) {
-                                                       $article[$k] = preg_replace('/[\x{10000}-\x{10FFFF}]/u', "\xEF\xBF\xBD", $v);
+                                                       $article[$k] = RSSUtils::strip_utf8mb4($v);
                                                }
                                        }
                                }
@@ -817,15 +825,14 @@ class RSSUtils {
                                }
 
                                $entry_tags = $article["tags"];
-                               $entry_guid = db_escape_string($entry_guid);
-                               $entry_title = db_escape_string($article["title"]);
-                               $entry_author = db_escape_string(mb_substr($article["author"], 0, 245));
-                               $entry_link = db_escape_string($article["link"]);
+                               $entry_title = strip_tags($article["title"]);
+                               $entry_author = mb_substr(strip_tags($article["author"]), 0, 245);
+                               $entry_link = strip_tags($article["link"]);
                                $entry_content = $article["content"]; // escaped below
                                $entry_force_catchup = $article["force_catchup"];
                                $article_labels = $article["labels"];
                                $entry_score_modifier = (int) $article["score_modifier"];
-                               $entry_language = db_escape_string($article["language"]);
+                               $entry_language = $article["language"];
 
                                if ($debug_enabled) {
                                        _debug("article labels:", $debug_enabled);
@@ -840,20 +847,17 @@ class RSSUtils {
                                if ($cache_images && is_writable(CACHE_DIR . '/images'))
                                        RSSUtils::cache_media($entry_content, $site_url, $debug_enabled);
 
-                               $entry_content = db_escape_string($entry_content, false);
+                               $csth = $pdo->prepare("SELECT id FROM ttrss_entries
+                                       WHERE guid = ? OR guid = ?");
+                               $csth->execute([$entry_guid, $entry_guid_hashed]);
 
-                               //db_query("BEGIN");
-
-                               $result = db_query("SELECT id FROM      ttrss_entries
-                                       WHERE (guid = '$entry_guid' OR guid = '$entry_guid_hashed')");
-
-                               if (db_num_rows($result) == 0) {
+                               if (!$row = $csth->fetch()) {
 
                                        _debug("base guid [$entry_guid or $entry_guid_hashed] not found, creating...", $debug_enabled);
 
                                        // base post entry does not exist, create it
 
-                                       db_query(
+                                       $usth = $pdo->prepare(
                                                "INSERT INTO ttrss_entries
                                                        (title,
                                                        guid,
@@ -870,48 +874,40 @@ class RSSUtils {
                                                        lang,
                                                        author)
                                                VALUES
-                                                       ('$entry_title',
-                                                       '$entry_guid_hashed',
-                                                       '$entry_link',
-                                                       '$entry_timestamp_fmt',
-                                                       '$entry_content',
-                                                       '$entry_current_hash',
+                                                       (?, ?, ?, ?, ?, ?,
                                                        false,
                                                        NOW(),
-                                                       '$date_feed_processed',
-                                                       '$entry_comments',
-                                                       '$num_comments',
-                                                       '$entry_plugin_data',
-                                                       '$entry_language',
-                                                       '$entry_author')");
+                                                       ?, ?, ?, ?,     ?, ?)");
+
+                                               $usth->execute([$entry_title,
+                                                       $entry_guid_hashed,
+                                                       $entry_link,
+                                                       $entry_timestamp_fmt,
+                                                       "$entry_content",
+                                                       $entry_current_hash,
+                                                       $date_feed_processed,
+                                                       $entry_comments,
+                                                       (int)$num_comments,
+                                                       $entry_plugin_data,
+                                                       "$entry_language",
+                                                       "$entry_author"]);
 
                                }
 
-                               // now it should exist, if not - bad luck then
-
-                               $result = db_query("SELECT id FROM ttrss_entries
-                                       WHERE guid = '$entry_guid' OR guid = '$entry_guid_hashed'");
+                               $csth->execute([$entry_guid, $entry_guid_hashed]);
 
                                $entry_ref_id = 0;
                                $entry_int_id = 0;
 
-                               if (db_num_rows($result) == 1) {
+                               if ($row = $csth->fetch()) {
 
                                        _debug("base guid found, checking for user record", $debug_enabled);
 
-                                       $ref_id = db_fetch_result($result, 0, "id");
+                                       $ref_id = $row['id'];
                                        $entry_ref_id = $ref_id;
 
-                                       /* $stored_guid = db_fetch_result($result, 0, "guid");
-                                       if ($stored_guid != $entry_guid_hashed) {
-                                               if ($debug_enabled) _debug("upgrading compat guid to hashed one", $debug_enabled);
-
-                                               db_query("UPDATE ttrss_entries SET guid = '$entry_guid_hashed' WHERE
-                                                       id = '$ref_id'");
-                                       } */
-
                                        if (RSSUtils::find_article_filter($article_filters, "filter")) {
-                                               //db_query("COMMIT"); // close transaction in progress
+                                               $pdo->commit();
                                                continue;
                                        }
 
@@ -921,113 +917,114 @@ class RSSUtils {
 
                                        // check for user post link to main table
 
-                                       $query = "SELECT ref_id, int_id FROM ttrss_user_entries WHERE
-                                                       ref_id = '$ref_id' AND owner_uid = '$owner_uid'";
-
-//                                     if ($_REQUEST["xdebug"]) print "$query\n";
-
-                                       $result = db_query($query);
+                                       $sth = $pdo->prepare("SELECT ref_id, int_id FROM ttrss_user_entries WHERE
+                                                       ref_id = ? AND owner_uid = ?");
+                                       $sth->execute([$ref_id, $owner_uid]);
 
                                        // okay it doesn't exist - create user entry
-                                       if (db_num_rows($result) == 0) {
+                                       if ($row = $sth->fetch()) {
+                                               $entry_ref_id = $row["ref_id"];
+                                               $entry_int_id = $row["int_id"];
+
+                                               _debug("user record FOUND: RID: $entry_ref_id, IID: $entry_int_id", $debug_enabled);
+                                       } else {
 
                                                _debug("user record not found, creating...", $debug_enabled);
 
                                                if ($score >= -500 && !RSSUtils::find_article_filter($article_filters, 'catchup') && !$entry_force_catchup) {
-                                                       $unread = 'true';
-                                                       $last_read_qpart = 'NULL';
+                                                       $unread = 1;
+                                                       $last_read_qpart = null;
                                                } else {
-                                                       $unread = 'false';
-                                                       $last_read_qpart = 'NOW()';
+                                                       $unread = 0;
+                                                       $last_read_qpart = date("Y-m-d H:i"); // we can't use NOW() here because it gets quoted
                                                }
 
                                                if (RSSUtils::find_article_filter($article_filters, 'mark') || $score > 1000) {
-                                                       $marked = 'true';
+                                                       $marked = 1;
                                                } else {
-                                                       $marked = 'false';
+                                                       $marked = 0;
                                                }
 
                                                if (RSSUtils::find_article_filter($article_filters, 'publish')) {
-                                                       $published = 'true';
+                                                       $published = 1;
                                                } else {
-                                                       $published = 'false';
+                                                       $published = 0;
                                                }
 
-                                               $last_marked = ($marked == 'true') ? 'NOW()' : 'NULL';
-                                               $last_published = ($published == 'true') ? 'NOW()' : 'NULL';
+                                               $last_marked = ($marked == 1) ? 'NOW()' : 'NULL';
+                                               $last_published = ($published == 1) ? 'NOW()' : 'NULL';
 
-                                               $result = db_query(
+                                               $sth = $pdo->prepare(
                                                        "INSERT INTO ttrss_user_entries
                                                                (ref_id, owner_uid, feed_id, unread, last_read, marked,
                                                                published, score, tag_cache, label_cache, uuid,
                                                                last_marked, last_published)
-                                                       VALUES ('$ref_id', '$owner_uid', '$feed', $unread,
-                                                               $last_read_qpart, $marked, $published, '$score', '', '',
-                                                               '', $last_marked, $last_published)");
+                                                       VALUES (?, ?, ?, ?, ?, ?, ?, ?, '', '', '', ".$last_marked.", ".$last_published.")");
 
-                                               if (PUBSUBHUBBUB_HUB && $published == 'true') {
-                                                       $rss_link = get_self_url_prefix() .
-                                                               "/public.php?op=rss&id=-2&key=" .
-                                                               get_feed_access_key(-2, false, $owner_uid);
+                                               $sth->execute([$ref_id, $owner_uid, $feed, $unread, $last_read_qpart, $marked,
+                                                       $published, $score]);
 
-                                                       $p = new pubsubhubbub\publisher\Publisher(PUBSUBHUBBUB_HUB);
+                                               $sth = $pdo->prepare("SELECT int_id FROM ttrss_user_entries WHERE
+                                                               ref_id = ? AND owner_uid = ? AND
+                                                               feed_id = ? LIMIT 1");
 
-                                                       /* $pubsub_result = */ $p->publish_update($rss_link);
-                                               }
-
-                                               $result = db_query(
-                                                       "SELECT int_id FROM ttrss_user_entries WHERE
-                                                               ref_id = '$ref_id' AND owner_uid = '$owner_uid' AND
-                                                               feed_id = '$feed' LIMIT 1");
-
-                                               if (db_num_rows($result) == 1) {
-                                                       $entry_int_id = db_fetch_result($result, 0, "int_id");
-                                               }
-                                       } else {
-                                               _debug("user record FOUND", $debug_enabled);
+                                               $sth->execute([$ref_id, $owner_uid, $feed]);
 
-                                               $entry_ref_id = db_fetch_result($result, 0, "ref_id");
-                                               $entry_int_id = db_fetch_result($result, 0, "int_id");
+                                               if ($row = $sth->fetch())
+                                                       $entry_int_id = $row['int_id'];
                                        }
 
-                                       _debug("RID: $entry_ref_id, IID: $entry_int_id", $debug_enabled);
+                                       _debug("resulting RID: $entry_ref_id, IID: $entry_int_id", $debug_enabled);
 
-                                       if (DB_TYPE == "pgsql") {
-                                               $tsvector_combined = db_escape_string(mb_substr($entry_title . ' ' . strip_tags(str_replace('<', ' <', $entry_content)),
-                                                       0, 1000000));
+                                       if (DB_TYPE == "pgsql")
+                                               $tsvector_qpart = "tsvector_combined = to_tsvector(:ts_lang, :ts_content),";
+                                       else
+                                               $tsvector_qpart = "";
 
-                                               $tsvector_qpart = "tsvector_combined = to_tsvector('$feed_language', '$tsvector_combined'),";
+                                       $sth = $pdo->prepare("UPDATE ttrss_entries
+                                               SET title = :title,
+                                                       $tsvector_qpart
+                                                       content = :content,
+                                                       content_hash = :content_hash,
+                                                       updated = :updated,
+                                                       date_updated = NOW(),
+                                                       num_comments = :num_comments,
+                                                       plugin_data = :plugin_data,
+                                                       author = :author,
+                                                       lang = :lang
+                                               WHERE id = :id");
+
+                                       $params = [":title" => $entry_title,
+                                               ":content" => "$entry_content",
+                                               ":content_hash" => $entry_current_hash,
+                                               ":updated" => $entry_timestamp_fmt,
+                                               ":num_comments" => (int)$num_comments,
+                                               ":plugin_data" => $entry_plugin_data,
+                                               ":author" => "$entry_author",
+                                               ":lang" => $entry_language,
+                                               ":id" => $ref_id];
 
-                                       } else {
-                                               $tsvector_qpart = "";
+                                       if (DB_TYPE == "pgsql") {
+                                               $params[":ts_lang"] = $feed_language;
+                                               $params[":ts_content"] = mb_substr(strip_tags($entry_title . " " . $entry_content), 0, 900000);
                                        }
 
-                                       db_query("UPDATE ttrss_entries
-                                               SET title = '$entry_title',
-                                                       content = '$entry_content',
-                                                       content_hash = '$entry_current_hash',
-                                                       updated = '$entry_timestamp_fmt',
-                                                       $tsvector_qpart
-                                                       num_comments = '$num_comments',
-                                                       plugin_data = '$entry_plugin_data',
-                                                       author = '$entry_author',
-                                                       lang = '$entry_language'
-                                               WHERE id = '$ref_id'");
+                                       $sth->execute($params);
 
                                        // update aux data
-                                       db_query("UPDATE ttrss_user_entries
-                                                       SET score = '$score' WHERE ref_id = '$ref_id'");
+                                       $sth = $pdo->prepare("UPDATE ttrss_user_entries
+                                                       SET score = ? WHERE ref_id = ?");
+                                       $sth->execute([$score, $ref_id]);
 
                                        if ($mark_unread_on_update) {
                                                _debug("article updated, marking unread as requested.", $debug_enabled);
 
-                                               db_query("UPDATE ttrss_user_entries
-                                                       SET last_read = null, unread = true WHERE ref_id = '$ref_id'");
+                                               $sth = $pdo->prepare("UPDATE ttrss_user_entries
+                                                       SET last_read = null, unread = true WHERE ref_id = ?");
+                                               $sth->execute([$ref_id]);
                                        }
                                }
 
-                               //db_query("COMMIT");
-
                                _debug("assigning labels [other]...", $debug_enabled);
 
                                foreach ($article_labels as $label) {
@@ -1052,6 +1049,16 @@ class RSSUtils {
                                                $e_item = array(
                                                        rewrite_relative_url($site_url, $e->link),
                                                        $e->type, $e->length, $e->title, $e->width, $e->height);
+
+                                               // Yet another episode of "mysql utf8_general_ci is gimped"
+                                               if (DB_TYPE == "mysql" && MYSQL_CHARSET != "UTF8MB4") {
+                                                       for ($i = 0; $i < count($e_item); $i++) {
+                                                               if (is_string($e_item[$i])) {
+                                                                       $e_item[$i] = RSSUtils::strip_utf8mb4($e_item[$i]);
+                                                               }
+                                                       }
+                                               }
+
                                                array_push($enclosures, $e_item);
                                        }
                                }
@@ -1064,31 +1071,28 @@ class RSSUtils {
                                        print_r($enclosures);
                                }
 
-                               //db_query("BEGIN");
+                               $esth = $pdo->prepare("SELECT id FROM ttrss_enclosures
+                                               WHERE content_url = ? AND content_type = ? AND post_id = ?");
 
-//                             debugging
-//                             db_query("DELETE FROM ttrss_enclosures WHERE post_id = '$entry_ref_id'");
+                               $usth = $pdo->prepare("INSERT INTO ttrss_enclosures
+                                                       (content_url, content_type, title, duration, post_id, width, height) VALUES
+                                                       (?, ?, ?, ?, ?, ?, ?)");
 
                                foreach ($enclosures as $enc) {
-                                       $enc_url = db_escape_string($enc[0]);
-                                       $enc_type = db_escape_string($enc[1]);
-                                       $enc_dur = db_escape_string($enc[2]);
-                                       $enc_title = db_escape_string($enc[3]);
+                                       $enc_url = $enc[0];
+                                       $enc_type = $enc[1];
+                                       $enc_dur = (int)$enc[2];
+                                       $enc_title = $enc[3];
                                        $enc_width = intval($enc[4]);
                                        $enc_height = intval($enc[5]);
 
-                                       $result = db_query("SELECT id FROM ttrss_enclosures
-                                               WHERE content_url = '$enc_url' AND post_id = '$entry_ref_id'");
+                                       $esth->execute([$enc_url, $enc_type, $entry_ref_id]);
 
-                                       if (db_num_rows($result) == 0) {
-                                               db_query("INSERT INTO ttrss_enclosures
-                                                       (content_url, content_type, title, duration, post_id, width, height) VALUES
-                                                       ('$enc_url', '$enc_type', '$enc_title', '$enc_dur', '$entry_ref_id', $enc_width, $enc_height)");
+                                       if (!$esth->fetch()) {
+                                               $usth->execute([$enc_url, $enc_type, (string)$enc_title, $enc_dur, $entry_ref_id, $enc_width, $enc_height]);
                                        }
                                }
 
-                               //db_query("COMMIT");
-
                                // check for manual tags (we have to do it here since they're loaded from filters)
 
                                foreach ($article_filters as $f) {
@@ -1131,24 +1135,24 @@ class RSSUtils {
 
                                if (count($filtered_tags) > 0) {
 
-                                       //db_query("BEGIN");
+                                       $tsth = $pdo->prepare("SELECT id FROM ttrss_tags
+                                                       WHERE tag_name = ? AND post_int_id = ? AND
+                                                       owner_uid = ? LIMIT 1");
+
+                                       $usth = $pdo->prepare("INSERT INTO ttrss_tags
+                                                                       (owner_uid,tag_name,post_int_id)
+                                                                       VALUES (?, ?, ?)");
 
                                        foreach ($filtered_tags as $tag) {
 
                                                $tag = sanitize_tag($tag);
-                                               $tag = db_escape_string($tag);
 
                                                if (!tag_is_valid($tag)) continue;
 
-                                               $result = db_query("SELECT id FROM ttrss_tags
-                                                       WHERE tag_name = '$tag' AND post_int_id = '$entry_int_id' AND
-                                                       owner_uid = '$owner_uid' LIMIT 1");
+                                               $tsth->execute([$tag, $entry_int_id, $owner_uid]);
 
-                                               if ($result && db_num_rows($result) == 0) {
-
-                                                       db_query("INSERT INTO ttrss_tags
-                                                                       (owner_uid,tag_name,post_int_id)
-                                                                       VALUES ('$owner_uid','$tag', '$entry_int_id')");
+                                               if (!$tsth->fetch()) {
+                                                       $usth->execute([$owner_uid, $tag, $entry_int_id]);
                                                }
 
                                                array_push($tags_to_cache, $tag);
@@ -1158,30 +1162,30 @@ class RSSUtils {
 
                                        $tags_to_cache = array_unique($tags_to_cache);
 
-                                       $tags_str = db_escape_string(join(",", $tags_to_cache));
+                                       $tags_str = join(",", $tags_to_cache);
 
-                                       db_query("UPDATE ttrss_user_entries
-                                               SET tag_cache = '$tags_str' WHERE ref_id = '$entry_ref_id'
-                                               AND owner_uid = $owner_uid");
-
-                                       //db_query("COMMIT");
+                                       $tsth = $pdo->prepare("UPDATE ttrss_user_entries
+                                               SET tag_cache = ? WHERE ref_id = ?
+                                               AND owner_uid = ?");
+                                       $tsth->execute([$tags_str, $entry_ref_id, $owner_uid]);
                                }
 
                                _debug("article processed", $debug_enabled);
+
+                               $pdo->commit();
                        }
 
                        _debug("purging feed...", $debug_enabled);
 
                        purge_feed($feed, 0, $debug_enabled);
 
-                       db_query("UPDATE ttrss_feeds
-                               SET last_updated = NOW(), last_error = '' WHERE id = '$feed'");
-
-//                     db_query("COMMIT");
+                       $sth = $pdo->prepare("UPDATE ttrss_feeds
+                               SET last_updated = NOW(), last_unconditional = NOW(), last_error = '' WHERE id = ?");
+                       $sth->execute([$feed]);
 
                } else {
 
-                       $error_msg = db_escape_string(mb_substr($rss->error(), 0, 245));
+                       $error_msg = mb_substr($rss->error(), 0, 245);
 
                        _debug("fetch error: $error_msg", $debug_enabled);
 
@@ -1191,12 +1195,12 @@ class RSSUtils {
                                }
                        }
 
-                       db_query(
-                               "UPDATE ttrss_feeds SET last_error = '$error_msg',
-                               last_updated = NOW() WHERE id = '$feed'");
+                       $sth = $pdo->prepare("UPDATE ttrss_feeds SET last_error = ?,
+                               last_updated = NOW(), last_unconditional = NOW() WHERE id = ?");
+                       $sth->execute([$error_msg, $feed]);
 
                        unset($rss);
-                       return;
+                       return false;
                }
 
                _debug("done", $debug_enabled);
@@ -1218,10 +1222,10 @@ class RSSUtils {
                                if (!file_exists($local_filename)) {
                                        $file_content = fetch_file_contents($src);
 
-                                       if ($file_content && strlen($file_content) > _MIN_CACHE_FILE_SIZE) {
+                                       if ($file_content && strlen($file_content) > MIN_CACHE_FILE_SIZE) {
                                                file_put_contents($local_filename, $file_content);
                                        }
-                               } else {
+                               } else if (is_writable($local_filename)) {
                                        touch($local_filename);
                                }
                        }
@@ -1247,15 +1251,17 @@ class RSSUtils {
 
                                $local_filename = CACHE_DIR . "/images/" . sha1($src);
 
-                               if ($debug) _debug("cache_media: downloading: $src to $local_filename");
+                               if ($debug) _debug("cache_media: checking $src");
 
                                if (!file_exists($local_filename)) {
+                                       if ($debug) _debug("cache_media: downloading: $src to $local_filename");
+
                                        $file_content = fetch_file_contents($src);
 
-                                       if ($file_content && strlen($file_content) > _MIN_CACHE_FILE_SIZE) {
+                                       if ($file_content && strlen($file_content) > MIN_CACHE_FILE_SIZE) {
                                                file_put_contents($local_filename, $file_content);
                                        }
-                               } else {
+                               } else if (is_writable($local_filename)) {
                                        touch($local_filename);
                                }
                        }
@@ -1265,14 +1271,15 @@ class RSSUtils {
        static function expire_error_log($debug) {
                if ($debug) _debug("Removing old error log entries...");
 
+               $pdo = Db::pdo();
+
                if (DB_TYPE == "pgsql") {
-                       db_query("DELETE FROM ttrss_error_log
+                       $pdo->query("DELETE FROM ttrss_error_log
                                WHERE created_at < NOW() - INTERVAL '7 days'");
                } else {
-                       db_query("DELETE FROM ttrss_error_log
+                       $pdo->query("DELETE FROM ttrss_error_log
                                WHERE created_at < DATE_SUB(NOW(), INTERVAL 7 DAY)");
                }
-
        }
 
        static function expire_lock_files($debug) {
@@ -1297,7 +1304,7 @@ class RSSUtils {
        }
 
        static function expire_cached_files($debug) {
-               foreach (array("simplepie", "images", "export", "upload") as $dir) {
+               foreach (array("feeds", "images", "export", "upload") as $dir) {
                        $cache_dir = CACHE_DIR . "/$dir";
 
 //                     if ($debug) _debug("Expiring $cache_dir");
@@ -1309,7 +1316,7 @@ class RSSUtils {
 
                                if ($files) {
                                        foreach ($files as $file) {
-                                               if (time() - filemtime($file) > 86400*7) {
+                                               if (time() - filemtime($file) > 86400*CACHE_MAX_DAYS) {
                                                        unlink($file);
 
                                                        ++$num_deleted;
@@ -1479,19 +1486,23 @@ class RSSUtils {
        }
 
        static function cleanup_counters_cache($debug) {
-               $result = db_query("DELETE FROM ttrss_counters_cache
+               $pdo = Db::pdo();
+
+               $res = $pdo->query("DELETE FROM ttrss_counters_cache
                        WHERE feed_id > 0 AND
                        (SELECT COUNT(id) FROM ttrss_feeds WHERE
                                id = feed_id AND
                                ttrss_counters_cache.owner_uid = ttrss_feeds.owner_uid) = 0");
-               $frows = db_affected_rows($result);
 
-               $result = db_query("DELETE FROM ttrss_cat_counters_cache
+               $frows = $res->rowCount();
+
+               $res = $pdo->query("DELETE FROM ttrss_cat_counters_cache
                        WHERE feed_id > 0 AND
                        (SELECT COUNT(id) FROM ttrss_feed_categories WHERE
                                id = feed_id AND
                                ttrss_cat_counters_cache.owner_uid = ttrss_feed_categories.owner_uid) = 0");
-               $crows = db_affected_rows($result);
+
+               $crows = $res->rowCount();
 
                if ($debug) _debug("Removed $frows (feeds) $crows (cats) orphaned counter cache entries.");
        }
@@ -1552,6 +1563,10 @@ class RSSUtils {
                                                // 0       beshort         0xffd8          JPEG image data
                                                //error_log("check_feed_favicon: favicon_url=$favicon_url isa JPG image");
                                        }
+                                       elseif (preg_match('/^BM/', $contents)) {
+                                               // 0    string          BM      PC bitmap (OS2, Windows BMP files)
+                                               //error_log("check_feed_favicon, favicon_url=$favicon_url isa BMP image");
+                                       }
                                        else {
                                                //error_log("check_feed_favicon: favicon_url=$favicon_url isa UNKNOWN type");
                                                $contents = "";
@@ -1574,4 +1589,4 @@ class RSSUtils {
 
 
 
-}
\ No newline at end of file
+}