Fixed issue: Conditions were not properly converted to EM expressions…

… when magicquotes are enabled
LimeSurvey · Apr 4, 2012 · c0ae148 · c0ae148
1 parent ed86bd0
commit c0ae148
Showing 1 changed file with 22 additions and 22 deletions.
diff --git a/application/helpers/expressions/em_manager_helper.php b/application/helpers/expressions/em_manager_helper.php
@@ -198,7 +198,7 @@ public static function UpgradeConditionsToRelevance($surveyId=NULL, $qid=NULL)
 
             $queries = array();
             foreach ($releqns as $key=>$value) {
-                $query = "UPDATE {{questions}} SET relevance='".addslashes($value)."' WHERE qid=".$key;
+                $query = "UPDATE {{questions}} SET relevance='".Yii::app()->db->quoteValue($value)."' WHERE qid=".$key;
                 dbExecuteAssoc($query);
                 $queries[] = $query;
             }
@@ -2331,17 +2331,17 @@ private function setVariableAndTokenMappingsForExpressionManager($surveyid,$forc
                 . "','sgqa':'" . $sgqa
                 . "','qid':" . $questionNum
                 . ",'gid':" . $groupNum
-//                . ",'mandatory':'" . $mandatory
-//                . "','question':'" . htmlspecialchars(preg_replace('/[[:space:]]/',' ',$question),ENT_QUOTES)
+                //                . ",'mandatory':'" . $mandatory
+                //                . "','question':'" . htmlspecialchars(preg_replace('/[[:space:]]/',' ',$question),ENT_QUOTES)
                 . ",'type':'" . $type
-//                . "','relevance':'" . (($relevance != '') ? htmlspecialchars(preg_replace('/[[:space:]]/',' ',$relevance),ENT_QUOTES) : 1)
-//                . "','readWrite':'" . $readWrite
-//                . "','grelevance':'" . (($grelevance != '') ? htmlspecialchars(preg_replace('/[[:space:]]/',' ',$grelevance),ENT_QUOTES) : 1)
+                //                . "','relevance':'" . (($relevance != '') ? htmlspecialchars(preg_replace('/[[:space:]]/',' ',$relevance),ENT_QUOTES) : 1)
+                //                . "','readWrite':'" . $readWrite
+                //                . "','grelevance':'" . (($grelevance != '') ? htmlspecialchars(preg_replace('/[[:space:]]/',' ',$grelevance),ENT_QUOTES) : 1)
                 . "','default':'" . (is_null($defaultValue) ? '' : $defaultValue)
                 . "','rowdivid':'" . (is_null($rowdivid) ?  '' : $rowdivid)
                 . "','onlynum':'" . ($onlynum ? '1' : '')
                 . "','gseq':" . $groupSeq
-//                . ",'qseq':" . $questionSeq
+                //                . ",'qseq':" . $questionSeq
                 .$ansList;
 
                 if ($type == 'M' || $type == 'P')
@@ -2697,19 +2697,19 @@ private function _ProcessSubQRelevance($eqn,$questionNum=NULL,$rowdivid=NULL, $t
                     $this->subQrelInfo[$questionNum] = array();
                 }
                 $this->subQrelInfo[$questionNum][$rowdivid] = array(
-                    'qid' => $questionNum,
-                    'eqn' => $eqn,
-                    'prettyPrintEqn' => $prettyPrint,
-                    'result' => $result,
-                    'numJsVars' => count($jsVars),
-                    'relevancejs' => $relevanceJS,
-                    'relevanceVars' => $relevanceVars,
-                    'rowdivid' => $rowdivid,
-                    'type'=>$type,
-                    'qtype'=>$qtype,
-                    'sgqa'=>$sgqa,
-                    'hasErrors'=>$hasErrors,
-                    );
+                'qid' => $questionNum,
+                'eqn' => $eqn,
+                'prettyPrintEqn' => $prettyPrint,
+                'result' => $result,
+                'numJsVars' => count($jsVars),
+                'relevancejs' => $relevanceJS,
+                'relevanceVars' => $relevanceVars,
+                'rowdivid' => $rowdivid,
+                'type'=>$type,
+                'qtype'=>$qtype,
+                'sgqa'=>$sgqa,
+                'hasErrors'=>$hasErrors,
+                );
             }
             return $result;
         }
@@ -5877,9 +5877,9 @@ public static function UpgradeQuestionAttributes($changeDB=false,$surveyid=NULL,
                 {
                     foreach  ($updates as $key=>$value)
                     {
-                        $query = "UPDATE {{question_attributes}} SET value='".addslashes($value)."' WHERE qid=".$qid." and attribute='".addslashes($key)."';";
+                        $query = "UPDATE {{question_attributes}} SET value='".Yii::app()->db->quoteValue($value)."' WHERE qid=".$qid." and attribute='".Yii::app()->db->quoteValue($key)."';";
                         $queries[] = $query;
-                        $query = "DELETE FROM {{question_attributes}} WHERE qid=".$qid." and attribute='".addslashes($reverseAttributeMap[$key])."';";
+                        $query = "DELETE FROM {{question_attributes}} WHERE qid=".$qid." and attribute='".Yii::app()->db->quoteValue($reverseAttributeMap[$key])."';";
                         $queries[] = $query;
 
                     }