From 826a695077d08b6d370bccfbaa655950e2dcb60a Mon Sep 17 00:00:00 2001
From: Brion Vibber <brion@status.net>
Date: Fri, 19 Nov 2010 15:06:26 -0800
Subject: [PATCH] Ticket #2797: replace addslashes() with explicit escape calls
 on the DB objects

---
 classes/Queue_item.php |  2 +-
 lib/search_engines.php | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/classes/Queue_item.php b/classes/Queue_item.php
index c7e17be6e8..007d4ed232 100644
--- a/classes/Queue_item.php
+++ b/classes/Queue_item.php
@@ -32,7 +32,7 @@ class Queue_item extends Memcached_DataObject
         if ($transports) {
             if (is_array($transports)) {
                 // @fixme use safer escaping
-                $list = implode("','", array_map('addslashes', $transports));
+                $list = implode("','", array_map(array($qi, 'escape'), $transports));
                 $qi->whereAdd("transport in ('$list')");
             } else {
                 $qi->transport = $transports;
diff --git a/lib/search_engines.php b/lib/search_engines.php
index 332db3f89a..19703e03fd 100644
--- a/lib/search_engines.php
+++ b/lib/search_engines.php
@@ -52,10 +52,10 @@ class MySQLSearch extends SearchEngine
     {
         if ('profile' === $this->table) {
             $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
-                                    'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+                                    'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
             if (strtolower($q) != $q) {
                 $this->target->whereAdd('MATCH(nickname, fullname, location, bio, homepage) ' .
-                                        'AGAINST (\''.addslashes(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
+                                        'AGAINST (\''.$this->target->escape(strtolower($q)).'\' IN BOOLEAN MODE)', 'OR');
             }
             return true;
         } else if ('notice' === $this->table) {
@@ -64,13 +64,13 @@ class MySQLSearch extends SearchEngine
             $this->target->whereAdd('notice.is_local != ' . Notice::GATEWAY);
 
             if (strtolower($q) != $q) {
-                $this->target->whereAdd("( MATCH(content) AGAINST ('" . addslashes($q) .
+                $this->target->whereAdd("( MATCH(content) AGAINST ('" . $this->target->escape($q) .
                     "' IN BOOLEAN MODE)) OR ( MATCH(content) " .
-                    "AGAINST ('"  . addslashes(strtolower($q)) .
+                    "AGAINST ('"  . $this->target->escape(strtolower($q)) .
                     "' IN BOOLEAN MODE))");
             } else {
                 $this->target->whereAdd('MATCH(content) ' .
-                                         'AGAINST (\''.addslashes($q).'\' IN BOOLEAN MODE)');
+                                         'AGAINST (\''.$this->target->escape($q).'\' IN BOOLEAN MODE)');
             }
 
             return true;
@@ -89,9 +89,9 @@ class MySQLLikeSearch extends SearchEngine
                            ' fullname LIKE "%%%1$s%%" OR '.
                            ' location LIKE "%%%1$s%%" OR '.
                            ' bio      LIKE "%%%1$s%%" OR '.
-                           ' homepage LIKE "%%%1$s%%")', addslashes($q));
+                           ' homepage LIKE "%%%1$s%%")', $this->target->escape($q, true));
         } else if ('notice' === $this->table) {
-            $qry = sprintf('content LIKE "%%%1$s%%"', addslashes($q));
+            $qry = sprintf('content LIKE "%%%1$s%%"', $this->target->escape($q, true));
         } else {
             throw new ServerException('Unknown table: ' . $this->table);
         }
@@ -107,12 +107,12 @@ class PGSearch extends SearchEngine
     function query($q)
     {
         if ('profile' === $this->table) {
-            return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.addslashes($q).'\')');
+            return $this->target->whereAdd('textsearch @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
         } else if ('notice' === $this->table) {
 
             // XXX: We need to filter out gateway notices (notice.is_local = -2) --Zach
 
-            return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.addslashes($q).'\')');
+            return $this->target->whereAdd('to_tsvector(\'english\', content) @@ plainto_tsquery(\''.$this->target->escape($q).'\')');
         } else {
             throw new ServerException('Unknown table: ' . $this->table);
         }