spaces/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

converted from standard mysqli to mysqli prepared statements for security against sql injection

Browse Source
This commit is contained in:
jashton
2025-04-01 15:03:01 -06:00
parent e8ac27b5d5
commit cec9091ee0
7 changed files with 190 additions and 175 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/article_functions.php
+73 -45
View File
@@ -3,12 +3,12 @@ require_once 'db_functions.php';
function article_ids_by_recency()
{
$query = 'SELECT article_id FROM article ORDER BY published_at DESC;';
$results = query_one_or_more_results($query);
$conn = get_connection();
$results = $conn->query('SELECT article_id FROM article ORDER BY published_at DESC');
$ids = [];
while ($row = mysqli_fetch_array($results))
while ($row = $results->fetch_assoc())
$ids[] = $row['article_id'];
return $ids;
@@ -16,12 +16,15 @@ function article_ids_by_recency()
function articles_ids_by_author($author_id)
{
$query = 'SELECT article_id FROM article WHERE author_id = ' . $author_id . ' ORDER BY published_at DESC;';
$results = query_one_or_more_results($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT article_id FROM article WHERE author_id = ? ORDER BY published_at DESC');
$stmt->bind_param('i', $author_id);
$stmt->execute();
$results = $stmt->get_result();
$ids = [];
while ($row = mysqli_fetch_array($results))
while ($row = $results->fetch_assoc())
$ids[] = $row['article_id'];
return $ids;
@@ -29,24 +32,27 @@ function articles_ids_by_author($author_id)
function article_tags()
{
$query = 'SELECT * FROM tags;';
$results = query_one_or_more_results($query);
$conn = get_connection();
$results = $conn->query('SELECT * FROM tags');
$tags = [];
while ($row = mysqli_fetch_array($results))
while ($row = $results->fetch_assoc())
$tags[] = $row;
return $tags;
}
function article_ids_by_tag($tag_id)
function article_ids_by_tag($tag)
{
$query = 'SELECT article_id FROM article WHERE article.article_id IN ( SELECT article_tags.article_id FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE tag = "' . $tag_id . '") ORDER BY published_at DESC;';
$results = query_one_or_more_results($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT article_id FROM article WHERE article.article_id IN ( SELECT article_tags.article_id FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE tag = ?) ORDER BY published_at DESC');
$stmt->bind_param('s', $tag);
$stmt->execute();
$results = $stmt->get_result();
$ids = [];
while ($row = mysqli_fetch_array($results))
while ($row = $results->fetch_assoc())
$ids[] = $row['article_id'];
return $ids;
@@ -57,11 +63,16 @@ function article_ids_by_tag($tag_id)
*/
function article_page_from_markdown($article_id)
{
$query = 'SELECT * FROM article WHERE article_id = ' . $article_id . ';';
$article = query_one_result($query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT * FROM article WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
$article = $stmt->get_result()->fetch_assoc();
$query = 'SELECT user_id, username, profile_picture FROM user WHERE user_id = ' . $article['author_id'] . ';';
$author = query_one_result($query);
$stmt = $conn->prepare('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $article['author_id']);
$stmt->execute();
$author = $stmt->get_result()->fetch_assoc();
$markdown = read_file_one_string($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/article.md');
@@ -93,23 +104,31 @@ function article_page_from_markdown($article_id)
*/
function article_card($article_id)
{
$article_query = 'SELECT * FROM article WHERE article_id = ' . $article_id . ';';
$article = query_one_result($article_query);
$conn = get_connection();
$stmt = $conn->prepare('SELECT * FROM article WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
$article = $stmt->get_result()->fetch_assoc();
$stmt = $conn->prepare('SELECT tag FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
$tags_results = $stmt->get_result();
$article_tags_query = 'SELECT tag FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE article_id = ' . $article_id . ';';
$tags_results = query_one_or_more_results($article_tags_query);
$tags_html = '';
if ($tags_results != null) {
$tags_html .= '<div class="tag_row">';
while ($row = mysqli_fetch_array($tags_results))
while ($row = $tags_results->fetch_assoc())
$tags_html .= '<a href="/articles.php?tag=' . $row['tag'] . '" class="tag">#' . $row['tag'] . '</a>';
$tags_html .= '</div>';
}
$author_query = 'SELECT user_id, username, profile_picture FROM user WHERE user_id = ' . $article['author_id'] . ';';
$author = query_one_result($author_query);
$stmt = $conn->prepare('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $article['author_id']);
$stmt->execute();
$author = $stmt->get_result()->fetch_assoc();
$card = '
<div class="article_card">
@@ -139,53 +158,62 @@ function article_card($article_id)
function create_article($author_id, $title, $excerpt, $tags, $markdown_file_contents)
{
$stmt = 'INSERT INTO article (author_id, title, excerpt, published_at) VALUES (' . $author_id . ', "' . $title . '", "' . $excerpt . '", CURRENT_TIMESTAMP);';
$id = exec_statement($stmt, 0);
$conn = get_connection();
$stmt = $conn->prepare('INSERT INTO article (author_id, title, excerpt, published_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)');
$stmt->bind_param('iss', $author_id, $title, $excerpt);
$stmt->execute();
$id = mysqli_insert_id($conn);
$path = $_ENV['ARTICLES_FQ_PATH'] . $id . '/';
mkdir($path);
echo '<p>created ' . $path . '</p>';
$fs = fopen($path . 'article.md', 'a');
fwrite($fs, $markdown_file_contents);
fclose($fs);
$stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES ';
for ($i = 0; $i < count($tags); $i++) {
$stmt .= '(' . $id . ', ' . $tags[$i] . ')';
if (count($tags) > 0) {
$tag_insert_stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES ';
for ($i = 0; $i < count($tags); $i++) {
$tag_insert_stmt .= '(' . $id . ', ?)';
if ($i < count($tags) - 1)
$stmt .= ', ';
if ($i < count($tags) - 1)
$tag_insert_stmt .= ', ';
}
if ($i == count($tags) - 1)
$stmt .= ';';
$stmt = $conn->prepare($tag_insert_stmt);
$stmt->bind_param('i', ...$tags);
$stmt->execute();
}
if (count($tags) > 0)
exec_statement($stmt, 0);
return $id;
}
function delete_article($article_id)
{
$stmt = 'DELETE FROM article_tags WHERE article_id = ' . $article_id . ';';
exec_statement($stmt, 1);
$conn = get_connection();
$stmt = $conn->prepare('DELETE FROM article_tags WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
$stmt = 'DELETE FROM article WHERE article_id = ' . $article_id . ';';
exec_statement($stmt, 1);
$stmt = $conn->prepare('DELETE FROM article WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
delete_dir($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/');
}
function delete_articles_by_author($author_id)
{
$stmt = 'DELETE FROM article WHERE author_id = "' . $author_id . '";';
return exec_statement($stmt, 1);
$conn = get_connection();
$stmt = $conn->prepare('DELETE FROM article WHERE author_id = ?');
$stmt->bind_param('i', $author_id);
$stmt->execute();
}
function increment_read_counter($article_id)
{
$stmt = 'UPDATE article SET read_count = read_count + 1 WHERE article_id = ' . $article_id . ';';
return exec_statement($stmt, 1);
$conn = get_connection();
$stmt = $conn->prepare('UPDATE article SET read_count = read_count + 1 WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
}