X-Git-Url: https://delta.frontaccounting.com/gitweb/?a=blobdiff_plain;f=includes%2Fdb%2Fconnect_db_mysqli.inc;h=696fd8285a1646bc49aa406a41ff8ae4e7a32923;hb=2bcdab793e406bb5a44d2c4e079ec7cc2a1aa857;hp=65b4a339080000f143a5f6a94deb678f8e7ec041;hpb=a721b65478fd2a264b470e1265e69cf829031e7a;p=fa-stable.git

diff --git a/includes/db/connect_db_mysqli.inc b/includes/db/connect_db_mysqli.inc
index 65b4a339..696fd828 100644
--- a/includes/db/connect_db_mysqli.inc
+++ b/includes/db/connect_db_mysqli.inc
@@ -10,15 +10,16 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 define('DB_DUPLICATE_ERROR', 1062);
-define('SQL_MODE', ''); // STRICT_ALL_TABLES,NO_ZERO_IN_DATE ?
+define('SQL_MODE', 'STRICT_ALL_TABLES'); // prevents SQL injection with silent field content truncation
 
 $db_last_inserted_id = 0;
 
 function set_global_connection($company=-1)
 {
-	global $db, $path_to_root, $db_connections;
+	global $db, $path_to_root, $db_connections, $SysPrefs;
 
 	include ($path_to_root . "/config_db.php");
+
 	if ($company == -1) 
 		$company = user_company();
 
@@ -28,16 +29,18 @@ function set_global_connection($company=-1)
 
 	$connection = $db_connections[$company];
 
-	$db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
-		mysqli_select_db($db, $connection["dbname"]);
+	$db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"], "", 
+		!empty($connection["port"]) ? $connection["port"] : 3306); // default port in mysql is 3306
+		
+	mysqli_select_db($db, $connection["dbname"]);
 	///// From mysqli release 5.6.6 the sql_mode is no longer empty as it was prior to
 	///// this release. Just for safety we make it empty for all 5.6 release and higher.
 	///// This non empty sql_mode values can interphere with FA, so all is set empty during
 	///// our sessions.
 	///// We are, however, investigating the existing code to be compatible in the future.
-		db_query("SET sql_mode = '".SQL_MODE."'");
+	db_query("SET sql_mode = '".SQL_MODE."'");
 	/////
-	refresh_sys_prefs();
+	$SysPrefs->refresh();
 	return $db;
 }
 
@@ -132,8 +135,8 @@ function db_num_fields($result)
 function db_escape($value = "", $nullify = false)
 {
 	global $db;
-	
-	$value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding);
+
+	$value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding=='iso-8859-2' ? 'ISO-8859-1' : $_SESSION['language']->encoding);
 	$value = html_specials_encode($value);
 
   	//reset default if second parameter is skipped
@@ -186,15 +189,34 @@ function db_field_name($result, $n)
     return $fieldinfo->name;
 }
 
+function db_set_collation($db, $fa_collation)
+{
+	return mysqli_query($db, "ALTER DATABASE COLLATE ".get_mysql_collation($fa_collation));
+}
+
+/*
+	Create database for FA company. If database already exists,
+	just set collation to be sure nothing weird will happen later.
+*/
 function db_create_db($connection)
 {
-	$db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
+	global $db;
+
+	$db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"], "",
+		!empty($connection["port"]) ? $connection["port"] : 3306); // default port in mysql is 3306
 
 	if (!mysqli_select_db($db, $connection["dbname"]))
 	{
-		$sql = "CREATE DATABASE IF NOT EXISTS `" . $connection["dbname"] . "`";
+		$sql = "CREATE DATABASE IF NOT EXISTS `" . $connection["dbname"] . "`"
+			. " DEFAULT COLLATE '" . get_mysql_collation($connection["collation"]) . "'";
+
 		if (!mysqli_query($db, $sql) || !mysqli_select_db($db, $connection["dbname"]))
 			return 0;
+	} else {
+		if (!db_set_collation($db, $connection["collation"]))
+		{
+			return 0;
+		}
 	}
 	return $db;
 }