@@ -1530,8 +1530,6 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1530
1530
$ fvalues = $ fvalue ;
1531
1531
}
1532
1532
1533
- $ fvalues = Database::escape_string ($ fvalues );
1534
-
1535
1533
$ sqluf = "SELECT * FROM $ t_uf WHERE field_variable=' $ fname' " ;
1536
1534
$ resuf = Database::query ($ sqluf );
1537
1535
$ is_extra_file = false ;
@@ -1546,9 +1544,9 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1546
1544
UserManager::process_tags (explode ('; ' , $ fvalues ), $ user_id , $ rowuf ['id ' ]);
1547
1545
return true ;
1548
1546
break ;
1549
- case self ::USER_FIELD_TYPE_SELECT_MULTIPLE :
1547
+ /* case self::USER_FIELD_TYPE_SELECT_MULTIPLE :
1550
1548
// check code from UserManager::update_user_picture() to use something similar here
1551
- break ;
1549
+ break;*/
1552
1550
case self ::USER_FIELD_TYPE_RADIO :
1553
1551
case self ::USER_FIELD_TYPE_SELECT :
1554
1552
case self ::USER_FIELD_TYPE_SELECT_MULTIPLE :
@@ -1610,7 +1608,7 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1610
1608
$ rowufv = Database::fetch_array ($ resufv );
1611
1609
if ($ rowufv ['field_value ' ] != $ fvalues ) {
1612
1610
$ sqlu = "UPDATE $ t_ufv SET
1613
- field_value = ' $ fvalues',
1611
+ field_value = ' " .Database:: escape_string ( $ fvalues). " ',
1614
1612
tms = FROM_UNIXTIME( $ tms)
1615
1613
WHERE id = " .$ rowufv ['id ' ];
1616
1614
$ resu = Database::query ($ sqlu );
@@ -1624,7 +1622,11 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1624
1622
if ($ rowufv ['field_value ' ] != $ fvalues ) {
1625
1623
if ($ is_extra_file ) {
1626
1624
// To remove from user folder
1627
- self ::remove_user_extra_file ($ user_id , $ fname , $ rowufv ['field_value ' ]);
1625
+ self ::remove_user_extra_file (
1626
+ $ user_id ,
1627
+ $ fname ,
1628
+ $ rowufv ['field_value ' ]
1629
+ );
1628
1630
}
1629
1631
// If the new field is empty, delete it
1630
1632
if ($ fvalues == '' ) {
@@ -1633,7 +1635,7 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1633
1635
} else {
1634
1636
// Otherwise update it
1635
1637
$ sql_query = "UPDATE $ t_ufv SET
1636
- field_value = ' $ fvalues',
1638
+ field_value = ' " .Database:: escape_string ( $ fvalues). " ',
1637
1639
tms = FROM_UNIXTIME( $ tms)
1638
1640
WHERE id = " .$ rowufv ['id ' ];
1639
1641
}
@@ -1644,10 +1646,10 @@ public static function update_extra_field_value($user_id, $fname, $fvalue = '')
1644
1646
1645
1647
return true ;
1646
1648
} else {
1647
- $ sqli = "INSERT INTO $ t_ufv (user_id,field_id,field_value,tms)
1648
- VALUES ( $ user_id, " .$ rowuf ['id ' ].", ' $ fvalues', FROM_UNIXTIME( $ tms)) " ;
1649
- $ resi = Database::query ($ sqli );
1650
- return ( $ resi ? true : false ) ;
1649
+ $ sql = "INSERT INTO $ t_ufv (user_id,field_id,field_value,tms)
1650
+ VALUES ( $ user_id, " .$ rowuf ['id ' ].", ' " .Database:: escape_string ( $ fvalues). " ', FROM_UNIXTIME( $ tms)) " ;
1651
+ $ res = Database::query ($ sql );
1652
+ return $ res ? true : false ;
1651
1653
}
1652
1654
} else {
1653
1655
// Field not found
@@ -3491,12 +3493,12 @@ public static function add_tag($tag, $user_id, $field_id)
3491
3493
if ($ tag_id == 0 ) {
3492
3494
//the tag doesn't exist
3493
3495
$ sql = "INSERT INTO $ table_user_tag (tag, field_id,count) VALUES (' $ tag',' $ field_id', count + 1) " ;
3494
- $ result = Database::query ($ sql );
3495
- $ last_insert_id = Database::get_last_insert_id ();
3496
+ Database::query ($ sql );
3497
+ $ last_insert_id = Database::insert_id ();
3496
3498
} else {
3497
3499
//the tag exists we update it
3498
3500
$ sql = "UPDATE $ table_user_tag SET count = count + 1 WHERE id = $ tag_id " ;
3499
- $ result = Database::query ($ sql );
3501
+ Database::query ($ sql );
3500
3502
$ last_insert_id = $ tag_id ;
3501
3503
}
3502
3504
@@ -3507,7 +3509,7 @@ public static function add_tag($tag, $user_id, $field_id)
3507
3509
//if the relationship does not exist we create it
3508
3510
if (Database::num_rows ($ result ) == 0 ) {
3509
3511
$ sql = "INSERT INTO $ table_user_tag_values SET user_id = $ user_id, tag_id = $ last_insert_id " ;
3510
- $ result = Database::query ($ sql );
3512
+ Database::query ($ sql );
3511
3513
}
3512
3514
}
3513
3515
}
0 commit comments