diff --git a/checkin_notes b/checkin_notes index a7aaaf3c6e..bc69b764e3 100755 --- a/checkin_notes +++ b/checkin_notes @@ -19545,3 +19545,14 @@ David 16 Nov 2004 sched/ validate_util.C + +Bruce 16 Nov 2004 + - Fix bug in ops pages displaying counts of zero if 'additional clauses' includes string + names such as name='first_workunit' + + html/inc/ + db_ops.inc + util_ops.inc + + html/ops + db_action.php diff --git a/html/inc/db_ops.inc b/html/inc/db_ops.inc index 3d3d816567..a37aa84678 100644 --- a/html/inc/db_ops.inc +++ b/html/inc/db_ops.inc @@ -104,9 +104,10 @@ class SqlQueryString { } function add($clause) { if (!$this->query) { - $this->query .= "where $clause"; + $cleaned=boinc_real_escape_string($clause); + $this->query .= "where $cleaned"; } else { - $this->query .= " and $clause"; + $this->query .= " and $cleaned"; } } function addclause($clause) { diff --git a/html/inc/util_ops.inc b/html/inc/util_ops.inc index e5a8d156fd..a6f81e7db3 100644 --- a/html/inc/util_ops.inc +++ b/html/inc/util_ops.inc @@ -23,9 +23,19 @@ define("TITLE_FONT", " "); define("BODY_COLOR", " bgcolor=ffffff "); define("NOLOGIN", "Not logged in. Click here to login.\n"); +function boinc_real_escape_string($unstripped) { + if (1) { + // valid for PHP>=4.3.0, 5. If there is a run-time php_version() function please use it + // instead of this hack! + return mysql_real_escape_string($unstripped); + } else { + return str_replace("\'", "'", str_replace("\\\"", "'", $unstripped)); + } +} + function admin_page_head($title) { - echo "$title\n"; - echo TABLE . "" . TITLE_FONT . "".PROJECT.": $title\n"; + echo "$title\n"; + echo TABLE . "" . TITLE_FONT . "".PROJECT.": $title\n"; } function admin_page_tail() { diff --git a/html/ops/db_action.php b/html/ops/db_action.php index 59b26a0cf8..28f984b4bf 100644 --- a/html/ops/db_action.php +++ b/html/ops/db_action.php @@ -116,16 +116,7 @@ } } -if (1) { - // valid for PHP>=4.3.0, 5. If there is a run-time php_version() function please use it - // instead of this hack! - $escapehell=mysql_real_escape_string($main_query); -} else { - $escapehell=str_replace("\'", "'", $main_query); - $escapehell=str_replace("\\\"", "'", $escapehell); -} - - $result = mysql_query($escapehell); + $result = mysql_query(boinc_real_escape_string($main_query)); if ($result) { if ($detail == "low") { start_table();