Changeset 1076

Timestamp:

05/10/2008 08:10:56 AM (22 months ago)

Author:

DotMG

Message:

refs #1 Comment#13

• Replaced $q by $qs where $_POST['q'] is used for SQL query (sanitized for SQL)
• replaced $q by $qx where $_POST['q'] is echoed in XHTML output (sanitized for XHTML)
• added DocBlock.

Files:

• trunk/handlers/referrers/referrers.php (modified) (7 diffs)

trunk/handlers/referrers/referrers.php

@@ -15 +15 @@
  * @author              {@link http://wikkawiki.org/DarTar Dario Taraborelli} - code cleanup, search/filter functionality added.
  * @author              {@link http://wikkawiki.org/JavaWoman JavaWoman} - more code cleanup, accessibility, integration with referrers_sites
+ * @uses                Config::$referrers_purge_time
+ * @uses                Config::$wakka_name
+ * @uses                Wakka::FormClose()
+ * @uses                Wakka::FormOpen()
+ * @uses                Wakka::GetHandler()
+ * @uses                Wakka::GetPageTag()
+ * @uses                Wakka::GetUser()
+ * @uses                Wakka::Href()
+ * @uses                Wakka::htmlspecialchars_ent()
+ * @uses                Wakka::IsAdmin()
+ * @uses                Wakka::LoadAll()
+ * @uses                Wakka::LoadSingle()
+ * @uses                Wakka::makeId()
+ *
  * @since               Wikka 1.1.7
  *
@@ -32 +46 @@
  *                              - turn list into form with checkboxes to allow mass blacklisting
  *
- * @input               string  $q  optional: string used to filter the referrers;
+ * @input               string  $qs  optional: string used to filter the referrers;
  *                              default: NULL;
  *                              the default can be overridden by providing a POST parameter 'q'
- * @input               integer $qo optional: determines the kind of search to be performed for string $q:
+ * @input               integer $qo optional: determines the kind of search to be performed for string $qs:
  *                              1: search for all referrers containing a given string
  *                              0: search for all referrers not containing a given string
@@ -139 +153 @@
 // initialize parameters
 
-$q = NULL;                                                              # search string
+$qs = NULL;                                                             # search string sanitized for SQL query
+$qx = '';                                                               # search string sanitized for XHTML
 $qo = 1;                                                                # search string option
 $h = HITS_DEFAULT;                                              # hits number
@@ -247 +262 @@
         if ('' != $tq)
         {
-                $q = mysql_real_escape_string($tq);
+                $qs = mysql_real_escape_string($tq);
+                $qx = $this->htmlspecialchars_ent($tq);
                 if (isset($_POST['qo']))
                 {
@@ -342 +358 @@
                 }
                 $query .= ' GROUP BY host ';
-                if (isset($q))
-                {
-                        $query .= ' HAVING host '.$string_option." '%".$q."%'";                 # filter by string (derived column so we use HAVING)
+                if (isset($qs))
+                {
+                        $query .= ' HAVING host '.$string_option." '%".$qs."%'";                        # filter by string (derived column so we use HAVING)
                 }
                 if ($hits_option != HITS_MIN_OPTION || $h != 1)
@@ -361 +377 @@
                         $query .= " WHERE page_tag = '".mysql_real_escape_string($tag)."'";
                 }
-                if (isset($q))
+                if (isset($qs))
                 {
                         $query .= (!strpos($query,'WHERE')) ? ' WHERE' : ' AND';
-                        $query .= ' referrer '.$string_option." '%".$q."%'";                    # filter by string
+                        $query .= ' referrer '.$string_option." '%".$qs."%'";                   # filter by string
                 }
                 #if ($days != $max_days)
@@ -473 +489 @@
         $form .= '</select> '."\n";
         $form .= '<label for="q">'.FORM_URL_STRING_LABEL.'</label> '."\n";
-        $form .= '<input type ="text" name="q" id="q" title="'.FORM_URL_STRING_TITLE.'" size="10" maxlength="50" value="'.$q.'" />';
+        $form .= '<input type ="text" name="q" id="q" title="'.FORM_URL_STRING_TITLE.'" size="10" maxlength="50" value="'.$qx.'" />';
 
         $form .= '<br />'."\n";