r73868 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r73867‎ | r73868 | r73869 >
Date:04:04, 28 September 2010
Author:brion
Status:ok
Tags:
Comment:
SQL escaping fix in ProofreadPage: use addQuotes() instead of hardcoded single-quotes, and name var $encCat instead of $cat per recommended norms
Modified paths:
  • /trunk/extensions/ProofreadPage/ProofreadPage_body.php (modified) (history)

Diff [purge]

Index: trunk/extensions/ProofreadPage/ProofreadPage_body.php
@@ -843,13 +843,13 @@
844844 $pagelist = "'" . implode( "', '", $pp ) . "'";
845845 $page_ns_index = MWNamespace::getCanonicalIndex( strtolower( $page_namespace ) );
846846 $dbr = wfGetDB( DB_SLAVE );
847 - $cat = $dbr->strencode( str_replace( ' ' , '_' , wfMsgForContent( 'proofreadpage_quality0_category' ) ) );
 847+ $encCat = $dbr->addQuotes( str_replace( ' ' , '_' , wfMsgForContent( 'proofreadpage_quality0_category' ) ) );
848848 $res = $dbr->select(
849849 array( 'page', 'categorylinks' ),
850850 array( 'page_title' ),
851851 array(
852852 "page_title IN ( $pagelist )",
853 - "cl_to='$cat'",
 853+ "cl_to=$encCat",
854854 "page_namespace=$page_ns_index"
855855 ),
856856 __METHOD__,

Status & tagging log