Update from usntable branch.

[fa-stable.git] / includes / db / references_db.inc

diff --git a/includes/db/references_db.inc b/includes/db/references_db.inc
index 48b16fad23c12d9d571a24bd74590b9679f3d1b0..e5212c656f4c8b3573749efa0f6f8edf4b361f8c 100644 (file)
--- a/includes/db/references_db.inc
+++ b/includes/db/references_db.inc
@@ -13,9 +13,11 @@
 
 function get_reference($type, $id)
 {
-       $sql = "SELECT * FROM ".TB_PREF."refs WHERE type=$type AND id=$id";
+       $sql = "SELECT * FROM ".TB_PREF."refs WHERE type=".db_escape($type)." AND id=".db_escape($id);
 
-       return db_query($sql, "could not query reference table");
+       $result = db_query($sql, "could not query reference table");
+    $row = db_fetch($result);
+    return $row['reference'];
 }
 
 //--------------------------------------------------------------------------------------------------
@@ -23,16 +25,26 @@ function get_reference($type, $id)
 function add_reference($type, $id, $reference)
 {
        $sql = "INSERT INTO ".TB_PREF."refs (type, id, reference)
-               VALUES ($type, $id, " . db_escape(trim($reference)) . ")";
+               VALUES (".db_escape($type).", ".db_escape($id).", "
+                       . db_escape(trim($reference)) . ")";
 
        db_query($sql, "could not add reference entry");
 }
 
+//--------------------------------------------------------------------------------------------------
+ 
+function update_reference($type, $id, $reference)
+{
+    $sql = "UPDATE ".TB_PREF."refs SET reference=".db_escape($reference)
+                       ." WHERE type=".db_escape($type)." AND id=".db_escape($id);
+    db_query($sql, "could not update reference entry");
+}
+
 //--------------------------------------------------------------------------------------------------
 
 function delete_reference($type, $id)
 {
-       $sql = "DELETE FROM ".TB_PREF."refs WHERE type=$type AND id=$id";
+       $sql = "DELETE FROM ".TB_PREF."refs WHERE type=$type AND id=".db_escape($id);
 
        return db_query($sql, "could not delete from reference table");
 }
@@ -41,7 +53,8 @@ function delete_reference($type, $id)
 
 function find_reference($type, $reference)
 {
-       $sql = "SELECT id FROM ".TB_PREF."refs WHERE type=$type AND reference='$reference'";
+       $sql = "SELECT id FROM ".TB_PREF."refs WHERE type=".db_escape($type)
+               ." AND reference=".db_escape($reference);
 
        $result = db_query($sql, "could not query reference table");
 
@@ -52,7 +65,8 @@ function find_reference($type, $reference)
 
 function save_next_reference($type, $reference)
 {
-    $sql = "UPDATE ".TB_PREF."sys_types SET next_reference=" . db_escape(trim($reference)) . " WHERE type_id = $type";
+    $sql = "UPDATE ".TB_PREF."sys_types SET next_reference=" . db_escape(trim($reference)) 
+               . " WHERE type_id = ".db_escape($type);
 
        db_query($sql, "The next transaction ref for $type could not be updated");
 }
@@ -61,7 +75,7 @@ function save_next_reference($type, $reference)
 
 function get_next_reference($type)
 {
-    $sql = "SELECT next_reference FROM ".TB_PREF."sys_types WHERE type_id = $type";
+    $sql = "SELECT next_reference FROM ".TB_PREF."sys_types WHERE type_id = ".db_escape($type);
 
     $result = db_query($sql,"The last transaction ref for $type could not be retreived");