Activated strict SQL mode, minor SQL injection fix, fixed _vl() debug helper.

[fa-stable.git] / includes / db / connect_db_mysqli.inc

diff --git a/includes/db/connect_db_mysqli.inc b/includes/db/connect_db_mysqli.inc
index 897316d698e22e56c9dcfc8e3257971c555d81a1..696fd8285a1646bc49aa406a41ff8ae4e7a32923 100644 (file)
--- a/includes/db/connect_db_mysqli.inc
+++ b/includes/db/connect_db_mysqli.inc
@@ -10,7 +10,7 @@
     See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
 ***********************************************************************/
 define('DB_DUPLICATE_ERROR', 1062);
-define('SQL_MODE', ''); // STRICT_ALL_TABLES,NO_ZERO_IN_DATE ?
+define('SQL_MODE', 'STRICT_ALL_TABLES'); // prevents SQL injection with silent field content truncation
 
 $db_last_inserted_id = 0;
 
@@ -29,8 +29,10 @@ function set_global_connection($company=-1)
 
        $connection = $db_connections[$company];
 
-       $db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
-               mysqli_select_db($db, $connection["dbname"]);
+       $db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"], "", 
+               !empty($connection["port"]) ? $connection["port"] : 3306); // default port in mysql is 3306
+               
+       mysqli_select_db($db, $connection["dbname"]);
        ///// From mysqli release 5.6.6 the sql_mode is no longer empty as it was prior to
        ///// this release. Just for safety we make it empty for all 5.6 release and higher.
        ///// This non empty sql_mode values can interphere with FA, so all is set empty during
@@ -133,8 +135,8 @@ function db_num_fields($result)
 function db_escape($value = "", $nullify = false)
 {
        global $db;
-       
-       $value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding);
+
+       $value = @html_entity_decode($value, ENT_QUOTES, $_SESSION['language']->encoding=='iso-8859-2' ? 'ISO-8859-1' : $_SESSION['language']->encoding);
        $value = html_specials_encode($value);
 
        //reset default if second parameter is skipped
@@ -200,7 +202,8 @@ function db_create_db($connection)
 {
        global $db;
 
-       $db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"]);
+       $db = mysqli_connect($connection["host"], $connection["dbuser"], $connection["dbpassword"], "",
+               !empty($connection["port"]) ? $connection["port"] : 3306); // default port in mysql is 3306
 
        if (!mysqli_select_db($db, $connection["dbname"]))
        {