blallo/tt-rss
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

plugins/note: use PDO

Browse source
This commit is contained in:
Andrew Dolgov 2017-12-03 10:43:19 +03:00
parent 2179332acd
commit ef2438a503
1 changed files with 26 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
plugins/note/init.php
View file

@ -1,5 +1,7 @@
<?php
class Note extends Plugin {
/* @var PluginHost $host */
private $host;
function about() {
@ -27,12 +29,15 @@ class Note extends Plugin {
}
function edit() {
$param = db_escape_string($_REQUEST['param']);
$param = $_REQUEST['param'];
$result = db_query("SELECT note FROM ttrss_user_entries WHERE
ref_id = '$param' AND owner_uid = " . $_SESSION['uid']);
$sth = $this->pdo->prepare("SELECT note FROM ttrss_user_entries WHERE
ref_id = ? AND owner_uid = ?");
$sth->execute([$param, $_SESSION['uid']]);
$note = db_fetch_result($result, 0, "note");
if ($row = $sth->fetch()) {
$note = $row['note'];
print_hidden("id", "$param");
print_hidden("op", "pluginhandler");
@ -46,6 +51,8 @@ class Note extends Plugin {
name='note'>$note</textarea>";
print "</td></tr></table>";
}
print "<div class='dlgButtons'>";
print "<button dojoType=\"dijit.form.Button\"
onclick=\"dijit.byId('editNoteDlg').execute()\">".__('Save')."</button> ";
@ -56,11 +63,12 @@ class Note extends Plugin {
}
function setNote() {
$id = db_escape_string($_REQUEST["id"]);
$note = trim(strip_tags(db_escape_string($_REQUEST["note"])));
$id = $_REQUEST["id"];
$note = trim(strip_tags($_REQUEST["note"]));
db_query("UPDATE ttrss_user_entries SET note = '$note'
WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
$sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET note = ?
WHERE ref_id = ? AND owner_uid = ?");
$sth->execute([$note, $id, $_SESSION['uid']]);
$formatted_note = Article::format_article_note($id, $note);