removed mysql_* functions

timo-bes · Jul 22, 2010 · 3517433 · 3517433
1 parent 1b3870c
commit 3517433
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 13 deletions.
diff --git a/API.php b/API.php
@@ -63,8 +63,10 @@ public function getSearchEvolution($idSite, $period, $date) {
 		$searchTerm = Piwik_Common::getRequestVar('search_term', false);
 
 		$where = '';
+		$bind = array();
 		if ($searchTerm) {
-			$where = 'AND action.search_term = "'.mysql_escape_string($searchTerm).'"';
+			$where = 'AND action.search_term = :searchTerm';
+			$bind[':searchTerm'] = $searchTerm;
 		}
 
 		// TODO: exclude multiple result pages from totalSearches
@@ -91,7 +93,7 @@ public function getSearchEvolution($idSite, $period, $date) {
 			GROUP BY
 				visit.visit_server_date
 		';
-		$result = Piwik_FetchAll($query);
+		$result = Piwik_FetchAll($query, $bind);
 
 		$dataTable = new Piwik_DataTable();
 		$data = array();
@@ -228,12 +230,13 @@ private function loadAssociatedPages($site, $following, $searchTerm, Piwik_Perio
 			$setAction = 'idaction_url';
 		}
 
+		$bind = array();
 		if ($searchTerm) {
 			// analyze one search term
-			$searchTerm = mysql_escape_string($searchTerm);
-			$where = 'AND action_set.search_term = "'.$searchTerm.'" '
+			$where = 'AND action_set.search_term = :searchTerm '
 			       . 'AND (action_get.search_term IS NULL OR '
-			       . 'action_get.search_term != "'.$searchTerm.'")';
+			       . 'action_get.search_term != :searchTerm)';
+			$bind[':searchTerm'] = $searchTerm;
 		} else {
 			// analyze all keywords
 			$where = 'AND action_set.search_term IS NOT NULL';
@@ -243,11 +246,12 @@ private function loadAssociatedPages($site, $following, $searchTerm, Piwik_Perio
 		if (substr($url, -1) == '/') {
 			$url = substr($url, 0, -1);
 		}
+		$bind[':url'] = $url;
 
 		$sql = '
 			SELECT
 				action_get.idaction,
-				REPLACE(action_get.name, "'.mysql_escape_string($url).'", "") AS label,
+				REPLACE(action_get.name, :url, "") AS label,
 				COUNT(action_get.idaction) AS hits
 			FROM
 				'.Piwik_Common::prefixTable('log_action').' AS action_set
@@ -268,7 +272,7 @@ private function loadAssociatedPages($site, $following, $searchTerm, Piwik_Perio
 			GROUP BY
 				action_get.idaction
 		';
-		return Piwik_FetchAll($sql);
+		return Piwik_FetchAll($sql, $bind);
 	}
 
 }
diff --git a/Controller.php b/Controller.php
@@ -183,18 +183,20 @@ private function analyzeSite($idSite) {
 		$sql = '
 			SELECT idaction, name
 			FROM '.Piwik_Common::prefixTable('log_action').'
-			WHERE type = 1 AND name LIKE "'.mysql_escape_string($url).'%"
+			WHERE type = 1 AND name LIKE :name"
 		';
+		$bind = array(':name' => $url.'%');
 		$result = Piwik_FetchAll($sql);
 		$parameter = $site['sitesearch_parameter'];
 		foreach ($result as $action) {
 			$hit = preg_match('/'.$parameter.'=(.*?)(&|$)/i', $action['name'], $match);
 			if ($hit) {
+				$bind[':searchTerm'] = urldecode($match[1]);
 				Piwik_Query('
 					UPDATE '.Piwik_Common::prefixTable('log_action').'
-					SET search_term = "'.mysql_escape_string(urldecode($match[1])).'"
+					SET search_term = :searchTerm
 					where idaction = '.intval($action['idaction']).'
-				');
+				', $bind);
 			}
 		}
 	}

diff --git a/SiteSearch.php b/SiteSearch.php
@@ -121,10 +121,10 @@ public function logResults($notification) {
 				if ($hit) {
 					$sql = '
 						UPDATE '.Piwik_Common::prefixTable('log_action').'
-						SET search_term = "'.mysql_escape_string(urldecode($match[1])).'"
-						where idaction = '.intval($idaction).'
+						SET search_term = :searchTerm
+						WHERE idaction = '.intval($idaction).'
 					';
-					Piwik_Query($sql);
+					Piwik_Query($sql, array(':searchTerm' => urldecode($match[1])));
 				}
 			}
 		}