From: Andrew Dolgov <noreply@fakecake.org>
Date: Sun, 3 Dec 2017 07:58:13 +0000 (+0300)
Subject: plugins/embed_original: use PDO
X-Git-Tag: 17.12~13
X-Git-Url: https://git.wh0rd.org/?p=tt-rss.git;a=commitdiff_plain;h=fad986ff5d3a80a1c9d57e90c6e1cc39df5dc9be

plugins/embed_original: use PDO
---

diff --git a/plugins/embed_original/init.php b/plugins/embed_original/init.php
index a74905f8..1925d141 100644
--- a/plugins/embed_original/init.php
+++ b/plugins/embed_original/init.php
@@ -1,5 +1,7 @@
 <?php
 class Embed_Original extends Plugin {
+
+	/* @var PluginHost $host */
 	private $host;
 
 	function init($host) {
@@ -34,17 +36,17 @@ class Embed_Original extends Plugin {
 	}
 
 	function getUrl() {
-		$id = db_escape_string($_REQUEST['id']);
+		$id = $_REQUEST['id'];
 
-		$result = db_query("SELECT link
+		$sth = $this->pdo->prepare("SELECT link
 				FROM ttrss_entries, ttrss_user_entries
-				WHERE id = '$id' AND ref_id = id AND owner_uid = " .$_SESSION['uid']);
-
-		$url = "";
-
-		if (db_num_rows($result) != 0) {
-			$url = db_fetch_result($result, 0, "link");
+				WHERE id = ? AND ref_id = id AND owner_uid = ?");
+		$sth->execute([$id, $_SESSION['uid']]);
 
+		if ($row = $sth->fetch()) {
+			$url = $row['link'];
+		} else {
+			$url = "";
 		}
 
 		print json_encode(array("url" => $url, "id" => $id));