Author: pwang
Date: 2013-02-07 16:28:26 -0800 (Thu, 07 Feb 2013)
New Revision: 31113
Modified:
new_cytoscape_website/plugin_website/plugins/displayplugininfo.php
new_cytoscape_website/plugin_website/plugins/getPluginURLs.php
new_cytoscape_website/plugin_website/plugins/getpluginInfo.php
new_cytoscape_website/plugin_website/plugins/keywordsearch.php
new_cytoscape_website/plugin_website/plugins/pluginInfoEdit.php
new_cytoscape_website/plugin_website/plugins/pluginsubmit.php
new_cytoscape_website/plugin_website/plugins/pluginsubmiturl.php
new_cytoscape_website/plugin_website/plugins/pluginsubmitzip.php
new_cytoscape_website/plugin_website/plugins/processSearchWords.inc
new_cytoscape_website/plugin_website/plugins/sendApprovalEmail.php
new_cytoscape_website/plugin_website/plugins/themesubmit.php
new_cytoscape_website/plugin_website/plugins/uploadNewPluginData.inc
Log:
Use mysql_real_escape_string()
Modified: new_cytoscape_website/plugin_website/plugins/displayplugininfo.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/displayplugininfo.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/displayplugininfo.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -55,7 +55,7 @@
*/
$query = 'SELECT distinct plugin_auto_id,name, unique_id, description,
license, license_required, project_url FROM plugin_list,plugin_version WHERE
plugin_list.plugin_auto_id = plugin_version.plugin_id '.
-" AND name = '".$name."'";
+" AND name = '".mysql_real_escape_string($name)."'";
// Run the query
if (!($pluginList = @ mysql_query ($query, $connection)))
Modified: new_cytoscape_website/plugin_website/plugins/getPluginURLs.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/getPluginURLs.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/getPluginURLs.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -19,6 +19,8 @@
// Generate plugin external URLs in XML format
function getPluginURLs($connection, $name){
+ $name = mysql_real_escape_string($name);
+
$returnResult='<plugin>';
$returnResult .= '<pluginName>'.$name.'</pluginName>';
Modified: new_cytoscape_website/plugin_website/plugins/getpluginInfo.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/getpluginInfo.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/getpluginInfo.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -2,7 +2,7 @@
function getPluginFileSize($connection, $plugin_file_id) {
$query = 'SELECT length(file_data) as pluginFileSize FROM plugin_files
' .
- 'WHERE plugin_file_auto_id = ' . $plugin_file_id;
+ 'WHERE plugin_file_auto_id = ' .
mysql_real_escape_string($plugin_file_id);
// Run the query
if (!($PluginFileInfo = @ mysql_query($query, $connection)))
@@ -31,7 +31,7 @@
// A plugin may be released by more than one institution, more than one
author at
// each institution
- $query = 'SELECT * FROM authors, plugin_author WHERE
plugin_author.plugin_version_id =' . $plugin_version_id .
+ $query = 'SELECT * FROM authors, plugin_author WHERE
plugin_author.plugin_version_id =' .
mysql_real_escape_string($plugin_version_id) .
' and plugin_author.author_id = authors.author_auto_id ORDER BY
authorship_seq';
// Run the query
@@ -87,7 +87,7 @@
//Get info for all versions of the given plugin (one plugin may have
more than one version)
$query = 'SELECT * FROM plugin_version' .
- ' WHERE plugin_id = ' . $pluginList_row['plugin_auto_id'].' and status
= "published"';
+ ' WHERE plugin_id = ' .
mysql_real_escape_string($pluginList_row['plugin_auto_id']).' and status =
"published"';
// Run the query
if (!($allVersionInfo = @ mysql_query($query, $connection)))
Modified: new_cytoscape_website/plugin_website/plugins/keywordsearch.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/keywordsearch.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/keywordsearch.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -83,9 +83,9 @@
foreach ( $searchArray as $searchWord )
{
if ( $i == 0 )
- $wordSQL .= "word='" . $searchWord ."' ";
+ $wordSQL .= "word='" . mysql_real_escape_string($searchWord) ."' ";
else
- $wordSQL .= " OR word='" . $searchWord ."' ";
+ $wordSQL .= " OR word='" . mysql_real_escape_string($searchWord) ."' ";
$i++;
}
Modified: new_cytoscape_website/plugin_website/plugins/pluginInfoEdit.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/pluginInfoEdit.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/pluginInfoEdit.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -153,7 +153,7 @@
//exit("Exit before processing");
// Get the category_id
- $query = 'SELECT category_id FROM categories WHERE name = "' .
$category . '"';
+ $query = 'SELECT category_id FROM categories WHERE name = "' .
mysql_real_escape_string($category) . '"';
// Run the query
if (!($result = @ mysql_query($query, $connection)))
showerror();
@@ -171,20 +171,20 @@
// For table plugin_list
$query1_prefix = 'update plugin_list set ';
- $query1_suffix = ' where plugin_auto_id = '.$db_plugin_id;
+ $query1_suffix = ' where plugin_auto_id =
'.mysql_real_escape_string($db_plugin_id);
$query1 = $query1_prefix;
if ($name != $db_name) { // plugin name
- $query1 .='name ="'.$name.'",';
+ $query1 .='name
="'.mysql_real_escape_string($name).'",';
}
if ($description != $db_description) {
- $query1 .='description ="'.$description.'",';
+ $query1 .='description
="'.mysql_real_escape_string($description).'",';
}
if ($projectURL != $db_projectURL) {
- $query1 .='project_url ="'.$projectURL.'",';
+ $query1 .='project_url
="'.mysql_real_escape_string($projectURL).'",';
}
if ($category_id != $db_categoryID) {
- $query1 .='category_id ='.$category_id.',';
+ $query1 .='category_id
='.mysql_real_escape_string($category_id).',';
}
if ($query1 != $query1_prefix) {
$query1 .='sysdat ='.'now()';
@@ -198,19 +198,19 @@
// query to update table plugin_version
$query2_prefix = 'update plugin_version set ';
- $query2_suffix = ' where version_auto_id = '.$versionID;
+ $query2_suffix = ' where version_auto_id =
'.mysql_real_escape_string($versionID);
$query2 = $query2_prefix;
// Check plugin_file_id???
if ($version != $db_version) { // plugin version
- $query2 .='version ="'.$version.'",';
+ $query2 .='version
="'.mysql_real_escape_string($version).'",';
}
if ($releaseDate != $db_releaseDate) {
- $query2 .='release_date ="'.$releaseDate.'",';
+ $query2 .='release_date
="'.mysql_real_escape_string($releaseDate).'",';
}
if ($cyVersion != $db_cyVersion) {
- $query2 .='cy_version ="'.$cyVersion.'",';
+ $query2 .='cy_version
="'.mysql_real_escape_string($cyVersion).'",';
}
if ($query2 != $query2_prefix) {
@@ -228,11 +228,11 @@
// delete the existing authors
for ($i = 0; $i < count($db_author_ids); $i++) {
- $query = 'delete from plugin_author where author_id
='.$db_author_ids[$i];
+ $query = 'delete from plugin_author where author_id
='.mysql_real_escape_string($db_author_ids[$i]);
// Run the query
if (!(@ mysql_query($query, $connection)))
showerror();
- $query = 'delete from authors where author_auto_id
='.$db_author_ids[$i];
+ $query = 'delete from authors where author_auto_id
='.mysql_real_escape_string($db_author_ids[$i]);
// Run the query
if (!(@ mysql_query($query, $connection)))
showerror();
@@ -241,7 +241,7 @@
// Add new authors into tables
for ($i = 0; $i < count($names); $i++) {
if (!(empty($names[$i]) && empty($emails[$i]) &&
empty($affiliations[$i]) && empty($affiliationURLs[$i]))) {
- $query = 'INSERT INTO authors VALUES (0, "' .
$names[$i] . '", "' . $emails[$i] . '","' . $affiliations[$i] . '","' .
$affiliationURLs[$i] . '")';
+ $query = 'INSERT INTO authors VALUES (0, "'
.mysql_real_escape_string($names[$i]) . '", "' .
mysql_real_escape_string($emails[$i]) . '","' .
mysql_real_escape_string($affiliations[$i]) . '","' .
mysql_real_escape_string($affiliationURLs[$i]) . '")';
// Run the query
if (!(@ mysql_query($query, $connection)))
@@ -250,7 +250,7 @@
$author_auto_id = mysql_insert_id($connection);
$authorship_seq = $i;
- $query = 'INSERT INTO plugin_author VALUES (' .
$versionID . ', ' . $author_auto_id . ',' . $authorship_seq . ')';
+ $query = 'INSERT INTO plugin_author VALUES (' .
mysql_real_escape_string($versionID) . ', ' .
mysql_real_escape_string($author_auto_id) . ',' .
mysql_real_escape_string($authorship_seq) . ')';
// Run the query
if (!(@ mysql_query($query, $connection)))
Modified: new_cytoscape_website/plugin_website/plugins/pluginsubmit.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/pluginsubmit.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/pluginsubmit.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -239,7 +239,7 @@
// Get the category_id
- $query = 'SELECT category_id FROM categories WHERE name = "' .
$pluginProps['pluginCategory'] . '"';
+ $query = 'SELECT category_id FROM categories WHERE name = "' .
mysql_real_escape_string($pluginProps['pluginCategory']) . '"';
// Run the query
if (!($result = @ mysql_query($query, $connection)))
showerror();
@@ -261,26 +261,26 @@
// For table plugin_list
$query1_prefix = 'update plugin_list set ';
- $query1_suffix = ' where plugin_auto_id = ' . $db_plugin_id;
+ $query1_suffix = ' where plugin_auto_id = ' .
mysql_real_escape_string($db_plugin_id);
$query1 = $query1_prefix;
if ($pluginProps['pluginName'] != $db_name) {
- $query1 .= 'name ="' . $pluginProps['pluginName'] .
'",';
+ $query1 .= 'name ="' .
mysql_real_escape_string($pluginProps['pluginName']) . '",';
}
if ($pluginProps['pluginDescription'] != $db_description) {
- $query1 .= 'description ="' .
$pluginProps['pluginDescription'] . '",';
+ $query1 .= 'description ="' .
mysql_real_escape_string($pluginProps['pluginDescription']) . '",';
}
if ($license != $db_license) {
- $query1 .= 'license ="' . $license . '",';
+ $query1 .= 'license ="' .
mysql_real_escape_string($license) . '",';
}
if ($license_required != $db_license_required) {
- $query1 .= 'license_required ="' . $license_required .
'",';
+ $query1 .= 'license_required ="' .
mysql_real_escape_string($license_required) . '",';
}
if ($pluginProps['projectURL'] != $db_projectURL) {
- $query1 .= 'project_url ="' .
$pluginProps['projectURL'] . '",';
+ $query1 .= 'project_url ="' .
mysql_real_escape_string($pluginProps['projectURL']) . '",';
}
if ($category_id != $db_categoryID) {
- $query1 .= 'category_id =' . $category_id . ',';
+ $query1 .= 'category_id =' .
mysql_real_escape_string($category_id) . ',';
}
if ($query1 != $query1_prefix) {
$query1 .= 'sysdat =' . 'now()';
@@ -294,37 +294,37 @@
// query to update table plugin_version
$query2_prefix = 'update plugin_version set ';
- $query2_suffix = ' where version_auto_id = ' . $versionID;
+ $query2_suffix = ' where version_auto_id = ' .
mysql_real_escape_string($versionID);
$query2 = $query2_prefix;
// Check plugin_file_id???
if ($pluginProps['pluginVersion'] != $db_version) { // plugin
version
- $query2 .= 'version ="' . $pluginProps['pluginVersion']
. '",';
+ $query2 .= 'version ="' .
mysql_real_escape_string($pluginProps['pluginVersion']) . '",';
}
if ($pluginProps['releaseDate'] != $db_releaseDate) {
- $query2 .= 'release_date ="' .
$pluginProps['releaseDate'] . '",';
+ $query2 .= 'release_date ="' .
mysql_real_escape_string($pluginProps['releaseDate']) . '",';
}
if ($pluginProps['themeOnly'] != $db_themeOnly) {
- $query2 .= 'theme_only ="' . $pluginProps['themeOnly']
. '",';
+ $query2 .= 'theme_only ="' .
mysql_real_escape_string($pluginProps['themeOnly']) . '",';
}
if ($releaseNote != $db_releaseNote) {
- $query2 .= 'release_note ="' . $releaseNote . '",';
+ $query2 .= 'release_note ="' .
mysql_real_escape_string($releaseNote) . '",';
}
if ($releaseNoteURL != $db_releaseNoteURL) {
- $query2 .= 'release_note_url ="' . $releaseNoteURL .
'",';
+ $query2 .= 'release_note_url ="' .
mysql_real_escape_string($releaseNoteURL) . '",';
}
if ($comment != $db_comment) {
- $query2 .= 'comment ="' . $comment . '",';
+ $query2 .= 'comment ="' .
mysql_real_escape_string($comment) . '",';
}
//if ($jarURL != $db_jarURL) {
// $query2 .='jar_url ="'.$jarURL.'",';
//}
if ($sourceURL != $db_sourceURL) {
- $query2 .= 'source_url ="' . $sourceURL . '",';
+ $query2 .= 'source_url ="' .
mysql_real_escape_string($sourceURL) . '",';
}
if ($pluginProps['cytoscapeVersion'] != $db_cyVersion) {
- $query2 .= 'cy_version ="' .
$pluginProps['cytoscapeVersion'] . '",';
+ $query2 .= 'cy_version ="' .
mysql_real_escape_string($pluginProps['cytoscapeVersion']) . '",';
}
//Determine the status based on what button is clicked
@@ -361,7 +361,7 @@
if ($fileUpload['name'] != NULL) { // A file is selected
$md5 = md5_file($fileUpload['tmp_name']);
$fileUpload_type = $fileUpload['type'];
- $fileUpload_name = $fileUpload['name'];
+ $fileUpload_name =
mysql_real_escape_string($fileUpload['name']);
$fileHandle = fopen($fileUpload['tmp_name'], "r");
$fileContent = fread($fileHandle, $fileUpload['size']);
@@ -383,11 +383,11 @@
// delete the existing authors
for ($i = 0; $i < count($db_author_ids); $i++) {
- $query = 'delete from plugin_author where author_id ='
. $db_author_ids[$i];
+ $query = 'delete from plugin_author where author_id ='
. mysql_real_escape_string($db_author_ids[$i]);
// Run the query
if (!(@ mysql_query($query, $connection)))
showerror();
- $query = 'delete from authors where author_auto_id =' .
$db_author_ids[$i];
+ $query = 'delete from authors where author_auto_id =' .
mysql_real_escape_string($db_author_ids[$i]);
// Run the query
if (!(@ mysql_query($query, $connection)))
showerror();
@@ -396,7 +396,7 @@
// Add new authors into tables
for ($i = 0; $i <
count($pluginProps['pluginAuthorsInstitutions']['names']); $i++) {
- $query = 'INSERT INTO authors VALUES (0, "' .
addslashes($pluginProps['pluginAuthorsInstitutions']['names'][$i]) . '", "' .
NULL . '","' . $pluginProps['pluginAuthorsInstitutions']['insts'][$i] . '","' .
NULL . '")';
+ $query = 'INSERT INTO authors VALUES (0, "' .
mysql_real_escape_string(addslashes($pluginProps['pluginAuthorsInstitutions']['names'][$i]))
. '", "' . NULL . '","' .
mysql_real_escape_string($pluginProps['pluginAuthorsInstitutions']['insts'][$i])
. '","' . NULL . '")';
// Run the query
if (!(@ mysql_query($query, $connection)))
@@ -405,7 +405,7 @@
$author_auto_id = mysql_insert_id($connection);
$authorship_seq = $i;
- $query = 'INSERT INTO plugin_author VALUES (' .
$versionID . ', ' . $author_auto_id . ',' . $authorship_seq . ')';
+ $query = 'INSERT INTO plugin_author VALUES (' .
mysql_real_escape_string($versionID) . ', ' .
mysql_real_escape_string($author_auto_id) . ',' .
mysql_real_escape_string($authorship_seq) . ')';
// Run the query
if (!(@ mysql_query($query, $connection)))
@@ -414,15 +414,15 @@
// query to update table contacts
$query5_prefix = 'update contacts set ';
- $query5_suffix = ' where plugin_version_id = ' . $versionID;
+ $query5_suffix = ' where plugin_version_id = ' .
mysql_real_escape_string($versionID);
$query5 = $query5_prefix;
if ($contactName != $db_contactName) {
- $query5 .= 'name ="' . $contactName . '",';
+ $query5 .= 'name ="' .
mysql_real_escape_string($contactName) . '",';
}
if ($contactEmail != $db_contactEmail) {
- $query5 .= 'email ="' . $contactEmail . '",';
+ $query5 .= 'email ="' .
mysql_real_escape_string($contactEmail) . '",';
}
if ($query5 != $query5_prefix) {
Modified: new_cytoscape_website/plugin_website/plugins/pluginsubmiturl.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/pluginsubmiturl.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/pluginsubmiturl.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -183,7 +183,7 @@
else {
// Get the category_id
- $query = 'SELECT category_id FROM categories WHERE name = "' .
$pluginProps['pluginCategory'] . '"';
+ $query = 'SELECT category_id FROM categories WHERE name = "' .
mysql_real_escape_string($pluginProps['pluginCategory']) . '"';
// Run the query
if (!($result = @ mysql_query($query, $connection)))
Modified: new_cytoscape_website/plugin_website/plugins/pluginsubmitzip.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/pluginsubmitzip.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/pluginsubmitzip.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -153,7 +153,7 @@
//echo "Form is validated, process the data<br>";
// Get the category_id
- $query = 'SELECT category_id FROM categories WHERE name = "' .
$pluginProps['pluginCategory'] . '"';
+ $query = 'SELECT category_id FROM categories WHERE name = "' .
mysql_real_escape_string($pluginProps['pluginCategory']) . '"';
// Run the query
if (!($result = @ mysql_query($query, $connection)))
showerror();
Modified: new_cytoscape_website/plugin_website/plugins/processSearchWords.inc
===================================================================
--- new_cytoscape_website/plugin_website/plugins/processSearchWords.inc
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/processSearchWords.inc
2013-02-08 00:28:26 UTC (rev 31113)
@@ -2,6 +2,9 @@
// update two tables 'description_word' and 'description_work_link' for a
plugin deletion
function deleteWords($connection, $plugin_id) {
+
+ $plugin_id = mysql_real_escape_string($plugin_id);
+
// get the list of words for the plugin in table 'description_word_link'
$dbQuery = "select word_id from description_word_link where plugin_id =
$plugin_id";
// Run the query
@@ -58,6 +61,8 @@
// 'description_words' and 'description_word_link'
function addWords($connection, $plugin_id){
+ $plugin_id = mysql_real_escape_string($plugin_id);
+
//Get the description of this plugin
$IndexText = getPluginDescription($connection, $plugin_id);
@@ -132,7 +137,7 @@
// Store word in table 'description_words' if it does not exist.
if (strlen($indexWord) != 0){
- $word_id = storeWord($connection, $indexWord);
+ $word_id =
mysql_real_escape_string(storeWord($connection, $indexWord));
}
if ($word_id == -1){
@@ -156,7 +161,7 @@
function getPluginDescription($connection, $pluginID) {
$description = "";
- $dbQuery = "select description from plugin_list where plugin_auto_id
=".$pluginID;
+ $dbQuery = "select description from plugin_list where plugin_auto_id
=".mysql_real_escape_string($pluginID);
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
showerror();
@@ -174,6 +179,8 @@
function storeWord($connection, $word) {
$word_id = -1;
+ $word = mysql_real_escape_string($word);
+
$dbQuery = "select * from description_words where word ='$word'";
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
Modified: new_cytoscape_website/plugin_website/plugins/sendApprovalEmail.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/sendApprovalEmail.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/sendApprovalEmail.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -54,7 +54,7 @@
// $to = $to . $cytostaff_emails[0] . " ";
//}
-$headers = "From: [email protected]\r\n";
+$headers = "From: [email protected]\r\nBCC: [email protected]
[email protected]";
//$subject = "[] ".$subject;
//mail("YourEmail", $subject, $message, $from);
Modified: new_cytoscape_website/plugin_website/plugins/themesubmit.php
===================================================================
--- new_cytoscape_website/plugin_website/plugins/themesubmit.php
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/themesubmit.php
2013-02-08 00:28:26 UTC (rev 31113)
@@ -135,7 +135,7 @@
// Get plugin_version_id based on the plugin -- 'category'',
'name' and 'version'
// Get the category_id
- $query = 'SELECT category_id FROM categories WHERE name = "' .
$pluginData['category'] . '"';
+ $query = 'SELECT category_id FROM categories WHERE name = "' .
mysql_real_escape_string($pluginData['category']) . '"';
// Run the query
if (!($result = @ mysql_query($query, $connection)))
showerror();
@@ -151,7 +151,7 @@
//
$query = 'SELECT version_auto_id FROM
plugin_list,plugin_version WHERE plugin_list.category_id ='.$category_id.
' and plugin_list.plugin_auto_id =
plugin_version.plugin_id '.
- 'and plugin_list.name
="'.$pluginData['name'].'" and plugin_version.version =
'.$pluginData['version'];
+ 'and plugin_list.name
="'.mysql_real_escape_string($pluginData['name']).'" and plugin_version.version
= '.mysql_real_escape_string($pluginData['version']);
//Run the query
if (!($result = @ mysql_query($query, $connection)))
@@ -192,8 +192,8 @@
function getThemeVersionID($connection, $themeData) {
$query = 'SELECT version_auto_id FROM theme_list, theme_version
WHERE theme_list.theme_auto_id = theme_version.theme_id ' .
- ' and theme_list.name = "' . $themeData['name']
.'"' .
- ' and theme_version.version = ' .
$themeData['version'];
+ ' and theme_list.name = "' .
mysql_real_escape_string($themeData['name']) .'"' .
+ ' and theme_version.version = ' .
mysql_real_escape_string($themeData['version']);
// Run the query
if (!($result = @ mysql_query($query, $connection)))
@@ -229,7 +229,7 @@
//Check if there is an old version of this theme in DB
$dbQuery = 'SELECT theme_auto_id FROM theme_list ' .
- ' WHERE name = "' . $themeData['name'] . '"';
+ ' WHERE name = "' .
mysql_real_escape_string($themeData['name']) . '"';
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
@@ -249,7 +249,7 @@
// Update the table "theme_list"
$dbQuery = 'UPDATE theme_list ' .
- 'SET description = "' .
addslashes($themeData['description']) . '" ' .
+ 'SET description = "' .
mysql_real_escape_string(addslashes($themeData['description'])) . '" ' .
'WHERE theme_auto_id = ' . $theme_auto_id;
// Run the query
@@ -264,7 +264,7 @@
$theme_unique_id = getThemeUniqueID($connection);
$dbQuery = 'INSERT INTO theme_list VALUES ' .
- '(0, "' . $themeData['name'] . '", ' . $theme_unique_id
. ', "' . addslashes($themeData['description']). '",now())';
+ '(0, "' . mysql_real_escape_string($themeData['name'])
. '", ' . $theme_unique_id . ', "' .
mysql_real_escape_string(addslashes($themeData['description'])). '",now())';
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
@@ -275,7 +275,7 @@
// Insert a row into table plugin_version
$dbQuery = 'INSERT INTO theme_version VALUES (0, ' . $theme_auto_id .
- ',\'' . $themeData['cyVersion'] . '\',' .$themeData['version']
. ',\'' . $themeData['releaseDate'] .'\',\'public\',now())';
+ ',\'' . mysql_real_escape_string($themeData['cyVersion']) .
'\',' .mysql_real_escape_string($themeData['version']) . ',\'' .
mysql_real_escape_string($themeData['releaseDate']) .'\',\'public\',now())';
//echo "query = ",$dbQuery,'<br>';
// Run the query
Modified: new_cytoscape_website/plugin_website/plugins/uploadNewPluginData.inc
===================================================================
--- new_cytoscape_website/plugin_website/plugins/uploadNewPluginData.inc
2013-02-07 23:48:54 UTC (rev 31112)
+++ new_cytoscape_website/plugin_website/plugins/uploadNewPluginData.inc
2013-02-08 00:28:26 UTC (rev 31113)
@@ -26,7 +26,7 @@
$plugin_auto_id = NULL;
//Check if there is an old version of this plugin in DB
$dbQuery = 'SELECT plugin_auto_id FROM plugin_list ' .
- ' WHERE plugin_list.name = "' .
$pluginProps['pluginName'] . '" and category_id =' . $category_id;
+ ' WHERE plugin_list.name = "' .
mysql_real_escape_string($pluginProps['pluginName']) . '" and category_id =' .
mysql_real_escape_string($category_id);
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
@@ -48,11 +48,11 @@
// Update the table "plugin_list"
$dbQuery = 'UPDATE plugin_list ' .
- 'SET description = "' .
addslashes($pluginProps['pluginDescription']) . '",' .
- 'project_url ="' . $theProjuctURL . '",' .
- 'license ="' . addslashes($license) . '",' .
- 'license_required ="' . $license_required . '" ' .
- 'WHERE plugin_auto_id = ' . $plugin_auto_id;
+ 'SET description = "' .
mysql_real_escape_string(addslashes($pluginProps['pluginDescription'])) . '",' .
+ 'project_url ="' .
mysql_real_escape_string($theProjuctURL) . '",' .
+ 'license ="' .
mysql_real_escape_string(addslashes($license)) . '",' .
+ 'license_required ="' .
mysql_real_escape_string($license_required) . '" ' .
+ 'WHERE plugin_auto_id = ' .
mysql_real_escape_string($plugin_auto_id);
//echo "<br>uploadNewPluginData.inc line 57: dbQuery
=", $dbQuery, "<br>";
@@ -67,8 +67,8 @@
$plugin_unique_id = getUniqueID($connection);
$dbQuery = 'INSERT INTO plugin_list VALUES ' .
- '(0, "' . $pluginProps['pluginName'] . '", "' .
$plugin_unique_id . '", "' . addslashes($pluginProps['pluginDescription']) .
'", "' . $license . '", "' . $license_required . '", "' .
$pluginProps['projectURL'] . '",' .
- $category_id . ',now())';
+ '(0, "' .
mysql_real_escape_string($pluginProps['pluginName']) . '", "' .
mysql_real_escape_string($plugin_unique_id) . '", "' .
mysql_real_escape_string(addslashes($pluginProps['pluginDescription'])) . '",
"' . mysql_real_escape_string($license) . '", "' .
mysql_real_escape_string($license_required) . '", "' .
mysql_real_escape_string($pluginProps['projectURL']) . '",' .
+ mysql_real_escape_string($category_id) . ',now())';
// Run the query
if (!($result = @ mysql_query($dbQuery, $connection)))
@@ -79,15 +79,15 @@
// Insert a row into table plugin_version
$status = 'new';
- $dbQuery = 'INSERT INTO plugin_version VALUES (0, ' .
$plugin_auto_id . ', ';
+ $dbQuery = 'INSERT INTO plugin_version VALUES (0, ' .
mysql_real_escape_string($plugin_auto_id) . ', ';
if ($plugin_file_auto_id == NULL) {
$dbQuery .= 'NULL';
} else {
$dbQuery .= $plugin_file_auto_id;
}
- $dbQuery .= ',"' . $pluginProps['pluginVersion'] . '",\'' .
- $pluginProps['releaseDate'] . '\',"' . $releaseNote . '","' .
$releaseNoteURL . '","' . $pluginProps['minimumJavaVersion'] . '","' . $comment
. '","' . $jarURL . '","' .
- $sourceURL . '","' . $pluginProps['cytoscapeVersion'] . '","' .
$status . '","' . $reference.'","' .$pluginProps['themeOnly'].'", 0,now())';
+ $dbQuery .= ',"' .
mysql_real_escape_string($pluginProps['pluginVersion']) . '",\'' .
+ mysql_real_escape_string($pluginProps['releaseDate']) . '\',"'
. mysql_real_escape_string($releaseNote) . '","' .
mysql_real_escape_string($releaseNoteURL) . '","' .
mysql_real_escape_string($pluginProps['minimumJavaVersion']) . '","' .
mysql_real_escape_string($comment) . '","' . mysql_real_escape_string($jarURL)
. '","' .
+ $sourceURL . '","' .
mysql_real_escape_string($pluginProps['cytoscapeVersion']) . '","' .
mysql_real_escape_string($status) . '","' .
mysql_real_escape_string($reference).'","'
.mysql_real_escape_string($pluginProps['themeOnly']).'", 0,now())';
// Run the query
if (!(@ mysql_query($dbQuery, $connection)))
@@ -99,7 +99,7 @@
$authorCount =
count($pluginProps['pluginAuthorsInstitutions']['names']);
for ($i = 0; $i < $authorCount; $i++) {
- $dbQuery = 'INSERT INTO authors VALUES (0, "' .
addslashes($pluginProps['pluginAuthorsInstitutions']['names'][$i]) . '", "' .
'' . '","' . $pluginProps['pluginAuthorsInstitutions']['insts'][$i] . '","' .
'' . '")';
+ $dbQuery = 'INSERT INTO authors VALUES (0, "' .
mysql_real_escape_string(addslashes($pluginProps['pluginAuthorsInstitutions']['names'][$i]))
. '", "' . '' . '","' .
mysql_real_escape_string($pluginProps['pluginAuthorsInstitutions']['insts'][$i])
. '","' . '' . '")';
// Run the query
if (!(@ mysql_query($dbQuery, $connection)))
@@ -108,7 +108,7 @@
$author_auto_id = mysql_insert_id($connection);
$authorship_seq = $i;
- $dbQuery = 'INSERT INTO plugin_author VALUES (' .
$version_auto_id . ', ' . $author_auto_id . ',' . $authorship_seq . ')';
+ $dbQuery = 'INSERT INTO plugin_author VALUES (' .
mysql_real_escape_string($version_auto_id) . ', ' .
mysql_real_escape_string($author_auto_id) . ',' .
mysql_real_escape_string($authorship_seq) . ')';
// Run the query
if (!(@ mysql_query($dbQuery, $connection)))
@@ -120,7 +120,7 @@
//echo "contactName =",$contactName,"<br>";
//echo "contactEmail =",$contactEmail,"<br>";
- $dbQuery = 'INSERT INTO contacts VALUES (0, "' .
addslashes($contactName) . '", "' . $contactEmail . '",' . $version_auto_id .
', now())';
+ $dbQuery = 'INSERT INTO contacts VALUES (0, "' .
mysql_real_escape_string(addslashes($contactName)) . '", "' .
mysql_real_escape_string($contactEmail) . '",' .
mysql_real_escape_string($version_auto_id) . ', now())';
// Run the query
if (!(@ mysql_query($dbQuery, $connection)))
--
You received this message because you are subscribed to the Google Groups
"cytoscape-cvs" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
Visit this group at http://groups.google.com/group/cytoscape-cvs?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.
