Moving 2.0 development version to main trunk.

[fa-stable.git] / includes / db / references_db.inc

diff --git a/includes/db/references_db.inc b/includes/db/references_db.inc
index 77e688a5467c5bff62090a36a80373d7811c0562..a41597f9701d1e69e8abaadeb9d1594b1798040e 100644 (file)
--- a/includes/db/references_db.inc
+++ b/includes/db/references_db.inc
@@ -5,7 +5,7 @@
 function get_reference($type, $id)
 {
        $sql = "SELECT * FROM ".TB_PREF."refs WHERE type=$type AND id=$id";
-       
+
        return db_query($sql, "could not query reference table");
 }
 
@@ -14,8 +14,8 @@ function get_reference($type, $id)
 function add_reference($type, $id, $reference)
 {
        $sql = "INSERT INTO ".TB_PREF."refs (type, id, reference)
-               VALUES ($type, $id, '" . trim($reference) . "')";
-                               
+               VALUES ($type, $id, " . db_escape(trim($reference)) . ")";
+
        db_query($sql, "could not add reference entry");
 }
 
@@ -24,7 +24,7 @@ function add_reference($type, $id, $reference)
 function delete_reference($type, $id)
 {
        $sql = "DELETE FROM ".TB_PREF."refs WHERE type=$type AND id=$id";
-       
+
        return db_query($sql, "could not delete from reference table");
 }
 
@@ -33,9 +33,9 @@ function delete_reference($type, $id)
 function find_reference($type, $reference)
 {
        $sql = "SELECT id FROM ".TB_PREF."refs WHERE type=$type AND reference='$reference'";
-       
+
        $result = db_query($sql, "could not query reference table");
-       
+
     return (db_num_rows($result) > 0);
 }
 
@@ -43,9 +43,9 @@ function find_reference($type, $reference)
 
 function save_next_reference($type, $reference)
 {
-    $sql = "UPDATE ".TB_PREF."sys_types SET next_reference='" . trim($reference) . "' WHERE type_id = $type";  
-    
-       db_query($sql, "The next transaction ref for $type could not be updated");      
+    $sql = "UPDATE ".TB_PREF."sys_types SET next_reference=" . db_escape(trim($reference)) . " WHERE type_id = $type";
+
+       db_query($sql, "The next transaction ref for $type could not be updated");
 }
 
 //--------------------------------------------------------------------------------------------------
@@ -53,9 +53,9 @@ function save_next_reference($type, $reference)
 function get_next_reference($type)
 {
     $sql = "SELECT next_reference FROM ".TB_PREF."sys_types WHERE type_id = $type";
-    
+
     $result = db_query($sql,"The last transaction ref for $type could not be retreived");
-    
+
     $row = db_fetch_row($result);
     return $row[0];
 }