Security update merged from 2.1.

[fa-stable.git] / dimensions / includes / dimensions_db.inc

diff --git a/dimensions/includes/dimensions_db.inc b/dimensions/includes/dimensions_db.inc
index 2a89b59643b1551d7c8856bb5471ba022e95ab78..c455e891cfa8f462bf96426515991713c0b16464 100644 (file)
--- a/dimensions/includes/dimensions_db.inc
+++ b/dimensions/includes/dimensions_db.inc
@@ -19,7 +19,8 @@ function add_dimension($reference, $name, $type_, $date_, $due_date, $memo_)
        $duedate = date2sql($due_date);
 
        $sql = "INSERT INTO ".TB_PREF."dimensions (reference, name, type_, date_, due_date)
-               VALUES (".db_escape($reference).", ".db_escape($name).", $type_, '$date', '$duedate')";
+               VALUES (".db_escape($reference).", ".db_escape($name).", ".db_escape($type_)
+               .", ".db_escape($date_).", ".db_escape($due_date).")";
        db_query($sql, "could not add dimension");
 
        $id = db_insert_id();
@@ -41,10 +42,10 @@ function update_dimension($id, $name, $type_, $date_, $due_date, $memo_)
        $duedate = date2sql($due_date);
 
        $sql = "UPDATE ".TB_PREF."dimensions SET name=".db_escape($name).",
-               type_ = $type_,
-               date_='$date',
-               due_date='$duedate'
-               WHERE id = $id";
+               type_ = ".db_escape($type_).",
+               date_=".db_escape($date_).",
+               due_date=".db_escape($due_date)."
+               WHERE id = ".db_escape($id);
 
        db_query($sql, "could not update dimension");
 
@@ -60,7 +61,7 @@ function delete_dimension($id)
        begin_transaction();
 
        // delete the actual dimension
-       $sql="DELETE FROM ".TB_PREF."dimensions WHERE id=$id";
+       $sql="DELETE FROM ".TB_PREF."dimensions WHERE id=".db_escape($id);
        db_query($sql,"The dimension could not be deleted");
 
        delete_comments(ST_DIMENSION, $id);
@@ -72,7 +73,7 @@ function delete_dimension($id)
 
 function get_dimension($id, $allow_null=false)
 {
-    $sql = "SELECT * FROM ".TB_PREF."dimensions        WHERE id=$id";
+    $sql = "SELECT * FROM ".TB_PREF."dimensions        WHERE id=".db_escape($id);
 
        $result = db_query($sql, "The dimension could not be retrieved");
 
@@ -122,7 +123,7 @@ function dimension_has_deposits($id)
 
 function dimension_has_payments($id)
 {
-       $sql = "SELECT SUM(amount) FROM ".TB_PREF."gl_trans WHERE dimension_id = $id";
+       $sql = "SELECT SUM(amount) FROM ".TB_PREF."gl_trans WHERE dimension_id = ".db_escape($id);
        $res = db_query($sql, "Transactions could not be calculated");
        $row = db_fetch_row($res);
        return ($row[0] != 0.0);
@@ -138,7 +139,7 @@ function dimension_is_closed($id)
 
 function close_dimension($id)
 {
-       $sql = "UPDATE ".TB_PREF."dimensions SET closed='1' WHERE id = $id";
+       $sql = "UPDATE ".TB_PREF."dimensions SET closed='1' WHERE id = ".db_escape($id);
        db_query($sql, "could not close dimension");
 }