From e62bb56b8733f2af0feedc75b132e13d31c10f61 Mon Sep 17 00:00:00 2001
From: dairiki <dairiki@96ab9672-09ca-45d6-a79d-3d69d39ca109>
Date: Wed, 7 Nov 2001 18:58:14 +0000
Subject: [PATCH] Fix SF bug #462168: hit count broken for pages with
 apostrophes in their names.

These fixes are untested, but they are entirely analogous to similar fixes
in mysql.php (which I have tested).  Barring typos on my part, I think
they're unlikely to cause problems.


git-svn-id: svn://svn.code.sf.net/p/phpwiki/code/branches/release-1_2-branch@607 96ab9672-09ca-45d6-a79d-3d69d39ca109
---
 lib/msql.php  | 12 +++++++-----
 lib/mssql.php | 12 +++++++-----
 lib/pgsql.php | 11 +++++++----
 3 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/lib/msql.php b/lib/msql.php
index 70def2437..a776dd931 100644
--- a/lib/msql.php
+++ b/lib/msql.php
@@ -1,4 +1,4 @@
-<?php rcs_id('$Id: msql.php,v 1.6.2.2 2001-11-04 03:46:10 dairiki Exp $');
+<?php rcs_id('$Id: msql.php,v 1.6.2.3 2001-11-07 18:58:14 dairiki Exp $');
 
    /*
       Database functions:
@@ -454,17 +454,18 @@
 
    function IncreaseHitCount($dbi, $pagename) {
 
-      $query = "select hits from hitcount where pagename='$pagename'";
+      $qpagename = addslashes($pagename);
+      $query = "select hits from hitcount where pagename='$qpagename'";
       $res = msql_query($query, $dbi['dbc']);
       if (msql_num_rows($res)) {
          $hits = msql_result($res, 0, 'hits');
          $hits++;
-         $query = "update hitcount set hits=$hits where pagename='$pagename'";
+         $query = "update hitcount set hits=$hits where pagename='$qpagename'";
          $res = msql_query($query, $dbi['dbc']);
 
       } else {
          $query = "insert into hitcount (pagename, hits) " .
-                  "values ('$pagename', 1)";
+                  "values ('$qpagename', 1)";
 	 $res = msql_query($query, $dbi['dbc']);
       }
 
@@ -473,7 +474,8 @@
 
    function GetHitCount($dbi, $pagename) {
 
-      $query = "select hits from hitcount where pagename='$pagename'";
+      $qpagename = addslashes($pagename);
+      $query = "select hits from hitcount where pagename='$qpagename'";
       $res = msql_query($query, $dbi['dbc']);
       if (msql_num_rows($res)) {
          $hits = msql_result($res, 0, 'hits');
diff --git a/lib/mssql.php b/lib/mssql.php
index ba0dc6fa6..4e776b428 100644
--- a/lib/mssql.php
+++ b/lib/mssql.php
@@ -1,4 +1,4 @@
-<?php rcs_id('$Id: mssql.php,v 1.1.2.3 2001-11-04 03:43:36 dairiki Exp $');
+<?php rcs_id('$Id: mssql.php,v 1.1.2.4 2001-11-07 18:58:14 dairiki Exp $');
 
    /* Microsoft SQL-Server library for PHPWiki
       Author: Andrew K. Pearson
@@ -217,15 +217,16 @@
    {
       global $HitCountStore;
 
+      $qpagename = addslashes($pagename);
       $rowexists = 0;
-      if ($res = mssql_query("select count(*) from $dbi[table] where pagename='$pagename'", $dbi['dbc'])) {
+      if ($res = mssql_query("select count(*) from $dbi[table] where pagename='$qpagename'", $dbi['dbc'])) {
          $rowexists = (mssql_result($res, 0, 0));
       }
 
       if ($rowexists)
-         $res = mssql_query("update $HitCountStore set hits=hits+1 where pagename='$pagename'", $dbi['dbc']);
+         $res = mssql_query("update $HitCountStore set hits=hits+1 where pagename='$qpagename'", $dbi['dbc']);
       else
-	     $res = mssql_query("insert into $HitCountStore (pagename, hits) values ('$pagename', 1)", $dbi['dbc']);
+	     $res = mssql_query("insert into $HitCountStore (pagename, hits) values ('$qpagename', 1)", $dbi['dbc']);
 
       return $res;
    }
@@ -234,7 +235,8 @@
    {
       global $HitCountStore;
 
-      $res = mssql_query("select hits from $HitCountStore where pagename='$pagename'", $dbi['dbc']);
+      $qpagename = addslashes($pagename);
+      $res = mssql_query("select hits from $HitCountStore where pagename='$qpagename'", $dbi['dbc']);
       if (mssql_num_rows($res))
          $hits = mssql_result($res, 0, 0);
       else
diff --git a/lib/pgsql.php b/lib/pgsql.php
index 6d32694d6..914a40f86 100644
--- a/lib/pgsql.php
+++ b/lib/pgsql.php
@@ -1,4 +1,4 @@
-<?php rcs_id('$Id: pgsql.php,v 1.4.2.3 2001-11-04 03:46:10 dairiki Exp $');
+<?php rcs_id('$Id: pgsql.php,v 1.4.2.4 2001-11-07 18:58:14 dairiki Exp $');
 
    /*
       Database functions:
@@ -318,12 +318,14 @@ function BackLinkSearchNextMatch($dbi, &$res) {
 
    function IncreaseHitCount($dbi, $pagename) {
       global $HitCountPageStore;
-      $query = "update $HitCountPageStore set hits=hits+1 where pagename='$pagename'";
+
+      $qpagename = addslashes($pagename);
+      $query = "update $HitCountPageStore set hits=hits+1 where pagename='$qpagename'";
       $res = pg_exec($dbi['dbc'], $query);
 
       if (!pg_cmdtuples($res)) {
          $query = "insert into $HitCountPageStore (pagename, hits) " .
-                  "values ('$pagename', 1)";
+                  "values ('$qpagename', 1)";
 	 $res = pg_exec($dbi['dbc'], $query);
       }
 
@@ -332,7 +334,8 @@ function BackLinkSearchNextMatch($dbi, &$res) {
 
    function GetHitCount($dbi, $pagename) {
       global $HitCountPageStore;
-      $query = "select hits from $HitCountPageStore where pagename='$pagename'";
+      $qpagename = addslashes($pagename);
+      $query = "select hits from $HitCountPageStore where pagename='$qpagename'";
       $res = pg_exec($dbi['dbc'], $query);
       if (pg_cmdtuples($res)) {
          $hits = pg_result($res, 0, "hits");
-- 
2.45.2