diff --git a/html/ajax_card.php b/html/ajax_card.php index ca5fae651..a87cf6e89 100644 --- a/html/ajax_card.php +++ b/html/ajax_card.php @@ -233,7 +233,7 @@ case 'st': /* we filter thanks a given model of card */ if ( isset($cat)) { - $sql=$sql.sprintf(' where frd_id = '.FormatString ($cat)); + $sql=$sql.sprintf(' where frd_id = '.sql_string ($cat)); } else /* we filter thanks a given list of category of card @@ -241,7 +241,7 @@ case 'st': if ( isset($fil) && strlen(trim($fil)) > 0 ) { $sql=$sql.sprintf(" where fd_id in (%s)", - FormatString($fil)); + sql_string($fil)); } } $array=$cn->make_array($sql); diff --git a/html/ajax_poste.php b/html/ajax_poste.php index 517af01ca..efeab07bf 100644 --- a/html/ajax_poste.php +++ b/html/ajax_poste.php @@ -80,7 +80,7 @@ case "sf": $str_submit=HtmlInput::submit('sf',_('Recherche')); $r=''; $r.='
'; - $r.= 'Fermer'; + $r.= 'Fermer'; $r.='
'; $r.='
'.h2info(_('Poste Comptable')).'
'; @@ -117,7 +117,7 @@ case "sf": /* show result */ if ( isset($q) && strlen(trim($q)) > 0) { - $q=sql_string($q); + $q= sql_string($q); $sql.=sprintf(" $sep ( pcm_val::text like '%s%%' or pcm_lib::text ilike '%%%s%%') ", $q,$q); } diff --git a/html/fid.php b/html/fid.php index 5ecd2bf3b..dcb89d9df 100644 --- a/html/fid.php +++ b/html/fid.php @@ -57,8 +57,8 @@ $fPrice_purchase=(isset($_REQUEST['b']))?$_REQUEST['b']:'none'; if ( isset($_SESSION['isValid']) && $_SESSION['isValid'] == 1) { - $jrn=FormatString($_GET['j']); - $d=FormatString($_GET['d']); + $jrn=sql_string($_GET['j']); + $d=sql_string($_GET['d']); if ( $jrn == -1 ) $d='all'; diff --git a/html/login.php b/html/login.php index 4746e8b64..dcda63d8e 100644 --- a/html/login.php +++ b/html/login.php @@ -30,7 +30,7 @@ require_once('class_database.php'); if ( isset ($_POST["p_user"] ) ) { - $g_user=FormatString($_POST["p_user"]); + $g_user=sql_string($_POST["p_user"]); $g_pass=$_POST["p_pass"]; $_SESSION['g_user']=$g_user; $_SESSION['g_pass']=$g_pass; diff --git a/html/user_login.php b/html/user_login.php index d4d2e66ca..6951706c8 100644 --- a/html/user_login.php +++ b/html/user_login.php @@ -142,7 +142,7 @@ echo $w->input('p_nom',$p_nom); $filtre=""; if ( isset ($_GET ['p_nom'])) { - $filtre=FormatString($_GET['p_nom']); + $filtre=sql_string($_GET['p_nom']); } // If admin show everything otherwise only the available dossier diff --git a/include/ac_common.php b/include/ac_common.php index 7bc273ee4..9b869a487 100644 --- a/include/ac_common.php +++ b/include/ac_common.php @@ -391,7 +391,14 @@ function NoAccess($js=1) } exit - 1; } - +/** + * replaced by sql_string + * @deprecated + */ +function FormatString($p_string) +{ + return sql_string($p_string); +} /* ! * \brief Fix the problem with the quote char for the database * @@ -399,14 +406,13 @@ function NoAccess($js=1) * \return a string which won't let strange char for the database */ -function FormatString($p_string) +function sql_string($p_string) { $p_string = trim($p_string); if (strlen($p_string) == 0) return null; - $p_string = str_replace("\'", "'", $p_string); - $p_string = str_replace("''", "'", $p_string); - $p_string = str_replace("'", "\'", $p_string); + $p_string = str_replace("'", "''", $p_string); + $p_string = str_replace('\\', '\\\\', $p_string); return $p_string; } @@ -688,16 +694,7 @@ function format_date($p_date) return $str_date; } -/** - * @brief remove the quote or double quote them - * @param $q string - * @return string correctly quoted - */ -function sql_string($q) -{ - $ret = str_replace("'", "''", $q); - return $ret; -} + /** * Should a dialog box that you are disconnected for ajax @@ -887,7 +884,7 @@ function compute_variable($p_string) { $array=array(); if ($p_string == '') return $array; - + $var=explode("&",$p_string); if (empty ($var)) return $array; for ($i=0;$i < count($var);$i++) diff --git a/include/action.common.inc.php b/include/action.common.inc.php index 8687701a3..c3d043323 100644 --- a/include/action.common.inc.php +++ b/include/action.common.inc.php @@ -368,9 +368,9 @@ function ShowActionList($cn,$p_base) if ( isset($_REQUEST['query']) ) { // if a query is request build the sql stmt - $query="and (ag_title ~* '".FormatString($_REQUEST['query'])."' ". - "or ag_ref ='".trim(FormatString($_REQUEST['query'])). - "' or ag_comment ~* '".trim(FormatString($_REQUEST['query']))."'". + $query="and (ag_title ~* '".sql_string($_REQUEST['query'])."' ". + "or ag_ref ='".trim(sql_string($_REQUEST['query'])). + "' or ag_comment ~* '".trim(sql_string($_REQUEST['query']))."'". ")"; } diff --git a/include/class_acc_ledger.php b/include/class_acc_ledger.php index b606f0676..e3135fd59 100644 --- a/include/class_acc_ledger.php +++ b/include/class_acc_ledger.php @@ -2406,7 +2406,7 @@ class Acc_Ledger $and=" and "; } // comment - $desc=FormatString($desc); + $desc=sql_string($desc); if ( $desc != null ) { $fil_desc=$and." ( upper(jr_comment) like upper('%".$desc."%') or upper(jr_pj_number) like upper('%".$desc."%') ". diff --git a/include/class_acc_ledger_fin.php b/include/class_acc_ledger_fin.php index 7b2e7552b..09d0beb8e 100644 --- a/include/class_acc_ledger_fin.php +++ b/include/class_acc_ledger_fin.php @@ -719,7 +719,7 @@ class Acc_Ledger_Fin extends Acc_Ledger $acc_operation->insert_jrnx(); - if ( FormatString(${"e_other$i"."_comment"}) == null ) + if ( sql_string(${"e_other$i"."_comment"}) == null ) { // if comment is blank set a default one $comment=" compte : ".$fBank->strAttribut(ATTR_DEF_NAME).' a '. @@ -797,7 +797,7 @@ class Acc_Ledger_Fin extends Acc_Ledger $op->j_id=$j_id; $op->oa_date=$e_date; $op->oa_debit=($amount < 0 )?'t':'f'; - $op->oa_description=FormatString($comment); + $op->oa_description=sql_string($comment); $op->save_form_plan($_POST,$i,$j_id); } diff --git a/include/class_acc_ledger_purchase.php b/include/class_acc_ledger_purchase.php index 4a01029a2..895827220 100644 --- a/include/class_acc_ledger_purchase.php +++ b/include/class_acc_ledger_purchase.php @@ -486,7 +486,7 @@ class Acc_Ledger_Purchase extends Acc_Ledger $op->oa_date=$e_date; $op->oa_debit=($amount > 0 )?'t':'f'; - $op->oa_description=FormatString($e_comm); + $op->oa_description=sql_string($e_comm); $op->save_form_plan($_POST,$i,$j_id); } // insert into quant_purchase diff --git a/include/class_acc_ledger_sold.php b/include/class_acc_ledger_sold.php index fef3b5ead..a63de7fbf 100644 --- a/include/class_acc_ledger_sold.php +++ b/include/class_acc_ledger_sold.php @@ -357,7 +357,7 @@ class Acc_Ledger_Sold extends Acc_Ledger $op->j_id=$j_id; $op->oa_date=$e_date; $op->oa_debit=($amount < 0 )?'t':'f'; - $op->oa_description=FormatString($e_comm); + $op->oa_description=sql_string($e_comm); $op->save_form_plan($_POST,$i,$j_id); } if ( $owner->MY_TVA_USE=='Y') diff --git a/include/class_acc_parm_code.php b/include/class_acc_parm_code.php index e89ce8a43..a89c74e46 100644 --- a/include/class_acc_parm_code.php +++ b/include/class_acc_parm_code.php @@ -89,9 +89,9 @@ class Acc_Parm_Code } else { - $this->p_comment=FormatString($this->p_comment); - $this->p_value=FormatString($this->p_value); - $this->p_code=FormatString($this->p_code); + $this->p_comment=sql_string($this->p_comment); + $this->p_value=sql_string($this->p_value); + $this->p_code=sql_string($this->p_code); $sql="update parm_code set ". "p_comment='".$this->p_comment."' ". ",p_value='".$this->p_value."' ". diff --git a/include/class_action.php b/include/class_action.php index f08b3be1f..36e6b28c4 100644 --- a/include/class_action.php +++ b/include/class_action.php @@ -256,7 +256,7 @@ class Action $ag_ref=new IText(); $ag_ref->readonly=$upd; $ag_ref->name="ag_ref"; - $ag_ref->value=FormatString($this->ag_ref); + $ag_ref->value=sql_string($this->ag_ref); $client_label=new ISpan(); /* Add button */ diff --git a/include/class_anc_account.php b/include/class_anc_account.php index 4a8b7748f..3ff4fd0ad 100644 --- a/include/class_anc_account.php +++ b/include/class_anc_account.php @@ -89,7 +89,7 @@ class Anc_Account */ function get_by_name($p_name) { - $p_name=FormatString($p_name); + $p_name=sql_string($p_name); if ( $p_name == null ) $p_name=$this->name; @@ -158,15 +158,15 @@ class Anc_Account private function format_data() { - $this->name=FormatString($this->name); - $this->pa_id=FormatString($this->pa_id); - $this->amount=FormatString($this->amount); + $this->name=sql_string($this->name); + $this->pa_id=sql_string($this->pa_id); + $this->amount=sql_string($this->amount); if (strlen($this->amount) == 0 ) $this->amount=0.0; if ( isNumber($this->amount) ==0 ) $this->amount=0; - $this->description=FormatString($this->description); + $this->description=sql_string($this->description); } function delete() { diff --git a/include/class_anc_plan.php b/include/class_anc_plan.php index 5e64eb4b2..4fd11f083 100644 --- a/include/class_anc_plan.php +++ b/include/class_anc_plan.php @@ -88,22 +88,22 @@ class Anc_Plan function update() { if ( $this->id==0) return; - $name=FormatString($this->name); + $name=sql_string($this->name); if ( strlen($name) == 0) return; - $description=FormatString($this->description); + $description=sql_string($this->description); $this->db->exec_sql("update plan_analytique set pa_name=$1, pa_description=$2 where pa_id=$3",array($name,$description,$this->id)); } function add() { - $name=FormatString($this->name); + $name=sql_string($this->name); if ( strlen($name) == 0) return; if ( $this->isAppend() == false) return; - $description=FormatString($this->description); + $description=sql_string($this->description); $this->db->exec_sql("insert into plan_analytique(pa_name,pa_description)". " values (". "'".$name."',". diff --git a/include/class_contact.php b/include/class_contact.php index 6209ca0f5..462299ff2 100644 --- a/include/class_contact.php +++ b/include/class_contact.php @@ -49,7 +49,7 @@ class contact extends Fiche */ function Summary($p_search="",$p_action="",$p_sql="") { - $p_search=FormatString($p_search); + $p_search=sql_string($p_search); $extra_sql=""; if ( $this->company != "") { diff --git a/include/class_document_modele.php b/include/class_document_modele.php index c08d75dc6..e047684ec 100644 --- a/include/class_document_modele.php +++ b/include/class_document_modele.php @@ -114,7 +114,7 @@ class Document_modele * first created (-> insert into document_modele) * in that case the name and the type must be set * set before calling Save, the name will be modified - * with FormatString + * with sql_string * */ function Save() diff --git a/include/class_fiche.php b/include/class_fiche.php index 10f138d6c..3fe32cb38 100644 --- a/include/class_fiche.php +++ b/include/class_fiche.php @@ -252,7 +252,7 @@ class Fiche where frd_id=".$p_frd_id; if ( $p_search != "" ) { - $a=FormatString($p_search); + $a=sql_string($p_search); $sql="select * from vw_fiche_attr where frd_id=".$p_frd_id. " and vw_name ~* '$p_search'"; } @@ -344,7 +344,7 @@ class Fiche if ($this->id==0) return NOTFOUND; // object is not in memory we need to look into the database $sql="select ad_value from fiche_detail - where f_id=".FormatString($this->id)." and ad_id=".$p_ad_id; + where f_id=".sql_string($this->id)." and ad_id=".$p_ad_id; $Res=$this->cn->exec_sql($sql); $row=Database::fetch_all($Res); // if not found return error @@ -738,7 +738,7 @@ class Fiche if ( $id == ATTR_DEF_QUICKCODE) { $sql=sprintf("select insert_quick_code(%d,'%s')", - $fiche_id,FormatString($value)); + $fiche_id,sql_string($value)); $this->cn->exec_sql($sql); continue; } @@ -752,7 +752,7 @@ class Fiche // account if ( $id == ATTR_DEF_ACCOUNT ) { - $v=FormatString($value); + $v=sql_string($value); try { @@ -793,14 +793,14 @@ class Fiche $exist=$this->cn->count_sql("select f_id from fiche join fiche_def using (fd_id) ". " join fiche_detail using(f_id) ". " where frd_id in (8,9,14) and ad_id=".ATTR_DEF_QUICKCODE. - " and ad_value='".FormatString($value)."'"); - if ( $exist == 0 && FormatString($value) != null ) + " and ad_value='".sql_string($value)."'"); + if ( $exist == 0 && sql_string($value) != null ) { $value=""; } } // Normal traitement - $value2=FormatString($value); + $value2=sql_string($value); $sql=sprintf("select attribut_insert(%d,%d,'%s')", $fiche_id,$id,trim($value2)); @@ -861,7 +861,7 @@ class Fiche if ( $id == ATTR_DEF_QUICKCODE) { $sql=sprintf("select update_quick_code(%d,'%s')", - $jft_id,FormatString($value)); + $jft_id,sql_string($value)); $this->cn->exec_sql($sql); continue; } @@ -887,7 +887,7 @@ class Fiche ' values (%d,0,\'%s\',upper(\'%s\'),\'d\',\'%s\')', $this->id, 'initial', - FormatString($value), + sql_string($value), $exercice); $this->cn->exec_sql($str_stock); @@ -895,7 +895,7 @@ class Fiche else { $str_stock=sprintf("update stock_goods set sg_code=upper('%s') where f_id=%d", - FormatString($value), + sql_string($value), $this->id); $this->cn->exec_sql($str_stock); } @@ -904,7 +904,7 @@ class Fiche // account if ( $id == ATTR_DEF_ACCOUNT ) { - $v=FormatString($value); + $v=sql_string($value); if ( trim($v) != '' ) { if ( strpos($v,',') != 0) @@ -964,7 +964,7 @@ class Fiche array(ATTR_DEF_QUICKCODE,$value)); - if ( Database::num_row($exist) == 0 && FormatString($value) != null ) + if ( Database::num_row($exist) == 0 && sql_string($value) != null ) { $value="Attention : pas de société "; } @@ -1507,7 +1507,7 @@ class Fiche { $str_dossier=dossier::get(); - $p_search=FormatString($p_search); + $p_search=sql_string($p_search); $script=$_SERVER['PHP_SELF']; // Creation of the nav bar // Get the max numberRow @@ -1819,7 +1819,7 @@ class Fiche $and=" and "; if (isset($query)) { - $query=FormatString($query); + $query=sql_string($query); if (strlen(trim($query)) > 1) { diff --git a/include/class_fiche_def.php b/include/class_fiche_def.php index d4300d3ed..dcac1d46a 100644 --- a/include/class_fiche_def.php +++ b/include/class_fiche_def.php @@ -185,7 +185,7 @@ class Fiche_Def ${"p_$key"}=$element; } // Format correctly the name of the cat. of card - $p_nom_mod=FormatString($p_nom_mod); + $p_nom_mod=sql_string($p_nom_mod); // Name can't be empty @@ -205,7 +205,7 @@ class Fiche_Def // and insert into fiche_def // if p_class_base is null get the default class base from // fiche_def_ref - if ( FormatString($p_class_base) == null ) + if ( sql_string($p_class_base) == null ) { // p_class is null // So we take the default one $p_class_base=$fiche_Def_ref->frd_class_base; @@ -223,7 +223,7 @@ class Fiche_Def $p_create='false'; // Class is valid ? - if ( FormatString($p_class_base) != null || strpos(',',$p_class_base) != 0 ) + if ( sql_string($p_class_base) != null || strpos(',',$p_class_base) != 0 ) { // p_class is a valid number $sql="insert into fiche_def(fd_label,fd_class_base,frd_id,fd_create_account) @@ -531,7 +531,7 @@ class Fiche_Def function SaveLabel($p_label) { if ( $this->id == 0 ) return; - $p_label=FormatString($p_label); + $p_label=sql_string($p_label); if (strlen(trim ($p_label)) == 0 ) { return; @@ -566,7 +566,7 @@ class Fiche_Def function save_class_base($p_label) { if ( $this->id == 0 ) return; - $p_label=FormatString($p_label); + $p_label=sql_string($p_label); $sql="update fiche_def set fd_class_base=$1 ". "where fd_id=$2"; diff --git a/include/class_iperiod.php b/include/class_iperiod.php index 74822ec26..437f7107f 100644 --- a/include/class_iperiod.php +++ b/include/class_iperiod.php @@ -114,7 +114,7 @@ class IPeriod extends HtmlInput $cond=''; if ( $sql_closed=="") $and=" where " ; else $and=" and "; if ($this->type == 'all' ) $cond=$and.' true '; - $cond.=" $and p_exercice='".FormatString($this->exercice)."'"; + $cond.=" $and p_exercice='".sql_string($this->exercice)."'"; } $sql.=$cond." order by p_start,p_end"; diff --git a/include/class_pre_operation.php b/include/class_pre_operation.php index 5293cdc80..1e1fdecd6 100644 --- a/include/class_pre_operation.php +++ b/include/class_pre_operation.php @@ -231,8 +231,8 @@ class Pre_operation_detail public function get_operation() { $value=$this->db->make_array("select od_id,od_name from op_predef ". - " where jrn_def_id=".FormatString($this->jrn_def_id). - " and od_direct ='".FormatString($this->od_direct)."'". + " where jrn_def_id=".sql_string($this->jrn_def_id). + " and od_direct ='".sql_string($this->od_direct)."'". " order by od_name"); return $value; } diff --git a/include/class_user.php b/include/class_user.php index bc612ea8f..0ba342c7e 100644 --- a/include/class_user.php +++ b/include/class_user.php @@ -268,7 +268,7 @@ class User { if ( $this->admin != 1 && $this->is_local_admin() != 1) { - $sql_type=($p_type=='ALL')?'':"and jrn_def_type=upper('".FormatString($p_type)."')"; + $sql_type=($p_type=='ALL')?'':"and jrn_def_type=upper('".sql_string($p_type)."')"; switch($p_access) { case 3: @@ -296,7 +296,7 @@ class User } else { - $sql_type=($p_type=='ALL')?'':"where jrn_def_type=upper('".FormatString($p_type)."')"; + $sql_type=($p_type=='ALL')?'':"where jrn_def_type=upper('".sql_string($p_type)."')"; $sql="select jrn_def_id,jrn_def_type,jrn_def_name,jrn_def_class_deb,jrn_def_class_cred,jrn_deb_max_line,jrn_cred_max_line, jrn_type_id,jrn_desc,'W' as uj_priv from jrn_def join jrn_type on jrn_def_type=jrn_type_id diff --git a/include/dossier.inc.php b/include/dossier.inc.php index 12daa8881..4b3e0b565 100644 --- a/include/dossier.inc.php +++ b/include/dossier.inc.php @@ -44,14 +44,14 @@ if ( isset ($_POST["DATABASE"]) ) { $cn=new Database(); $dos=trim($_POST["DATABASE"]); - $dos=FormatString($dos); + $dos=sql_string($dos); if (strlen($dos)==0) { echo _("Le nom du dossier est vide"); exit -1; } $encoding=$cn->get_value("select encoding from pg_database where ". - " datname='".domaine.'mod'.FormatString($_POST["FMOD_ID"])."'"); + " datname='".domaine.'mod'.sql_string($_POST["FMOD_ID"])."'"); if ( $encoding != 6 ) { alert(_('Désolé vous devez migrer ce modèle en unicode')); @@ -62,7 +62,7 @@ if ( isset ($_POST["DATABASE"]) ) exit(); } - $desc=FormatString($_POST["DESCRIPTION"]); + $desc=sql_string($_POST["DESCRIPTION"]); try { $cn->start(); @@ -89,7 +89,7 @@ if ( isset ($_POST["DATABASE"]) ) //-- // setting the year //-- - $year=FormatString($_POST['YEAR']); + $year=sql_string($_POST['YEAR']); if ( strlen($year) != 4 || isNumber($year) == 0 || $year > 2100 || $year < 2000 || $year != round($year,0)) { echo "$year"._(" est une année invalide"); @@ -101,7 +101,7 @@ if ( isset ($_POST["DATABASE"]) ) domaine, $l_id, domaine, - FormatString($_POST["FMOD_ID"])); + sql_string($_POST["FMOD_ID"])); ob_start(); if ( $cn->exec_sql($Sql)==false) { @@ -336,7 +336,7 @@ if ( $sa == 'remove' ) echo "

$msg "._('inexistant')."

"; exit(); } - $sql="drop database ".domaine."dossier".FormatString($_REQUEST['d']); + $sql="drop database ".domaine."dossier".sql_string($_REQUEST['d']); ob_start(); if ( $cn->exec_sql($sql)==false) { diff --git a/include/export_bilan_oth.php b/include/export_bilan_oth.php index 7210bb7f9..3e041c6d9 100644 --- a/include/export_bilan_oth.php +++ b/include/export_bilan_oth.php @@ -37,8 +37,7 @@ $cn=new Database($gDossier); $bilan=new Acc_Bilan($cn); $bilan->get_request_get(); $bilan->load(); -/*\!bug the headers shouldn't be sent here, but it doesn't work - * a html header is send before, to fix asap */ + if ( $bilan->b_type=='odt') { header("Expires: Mon, 26 Jul 1997 05:00:00 GMT"); diff --git a/include/export_gl_csv.php b/include/export_gl_csv.php index fc40161de..2847da25b 100644 --- a/include/export_gl_csv.php +++ b/include/export_gl_csv.php @@ -52,7 +52,7 @@ if ( isset($poste_id) && strlen(trim($poste_id)) != 0 && isNumber($poste_id) ) $parent=$poste_id; $a_poste=$cn->get_array("select pcm_val from tmp_pcmn where pcm_val::text like '$parent%' order by pcm_val::text"); } - elseif ( $cn->count_sql('select * from tmp_pcmn where pcm_val='.FormatString($poste_id)) != 0 ) + elseif ( $cn->count_sql('select * from tmp_pcmn where pcm_val='.sql_string($poste_id)) != 0 ) { $a_poste=array('pcm_val' => $poste_id); } diff --git a/include/fiche.inc.php b/include/fiche.inc.php index e518d830a..690c6e2da 100644 --- a/include/fiche.inc.php +++ b/include/fiche.inc.php @@ -358,7 +358,7 @@ if ( isset ( $_GET["action"]) ) ShowRecherche(); $sql="select distinct f_id,fd_id from fiche join fiche_detail using (f_id) where - upper(ad_value) like upper('%".FormatString($_GET["search_text"])."%') order by f_id"; + upper(ad_value) like upper('%".sql_string($_GET["search_text"])."%') order by f_id"; $all=$cn->get_array($sql); // test on the size diff --git a/include/fiche_def.inc.php b/include/fiche_def.inc.php index f34154770..57cb0bb69 100644 --- a/include/fiche_def.inc.php +++ b/include/fiche_def.inc.php @@ -30,9 +30,9 @@ if ( isset ($_POST['confirm_mod'])) { extract ($_POST); $update=new Fiche_Def_Ref($cn); - $update->frd_id=FormatString($frd_id); - $update->frd_text=FormatString($frd_text); - $update->frd_class_base=FormatString($frd_class_base); + $update->frd_id=sql_string($frd_id); + $update->frd_text=sql_string($frd_text); + $update->frd_class_base=sql_string($frd_class_base); $update->Save(); } // Load All Fiche_def diff --git a/include/impress_bilan.inc.php b/include/impress_bilan.inc.php index 2962a727f..fdc5b02c4 100644 --- a/include/impress_bilan.inc.php +++ b/include/impress_bilan.inc.php @@ -56,7 +56,7 @@ echo HtmlInput::get_to_hidden(array('ac','type')); echo ''; echo ''; -$filter_year=" where p_exercice='".FormatString($exercice)."'"; +$filter_year=" where p_exercice='".sql_string($exercice)."'"; echo '
'; echo HtmlInput::hidden('type','bilan'); echo dossier::hidden(); diff --git a/include/impress_jrn.inc.php b/include/impress_jrn.inc.php index 6931298f3..c27ff91fa 100644 --- a/include/impress_jrn.inc.php +++ b/include/impress_jrn.inc.php @@ -106,7 +106,7 @@ print td($label).$w->input("jrn_id",$ret); print ''; print ''; // filter on the current year -$filter_year=" where p_exercice='".FormatString($exercice)."'"; +$filter_year=" where p_exercice='".sql_string($exercice)."'"; $periode_start=$cn->make_array("select p_id,to_char(p_start,'DD-MM-YYYY') from parm_periode $filter_year order by p_start,p_end"); $w->selected=(isset($_GET['from_periode']))?$_GET['from_periode']:''; diff --git a/include/impress_rapport.inc.php b/include/impress_rapport.inc.php index 6ce52c445..79a4bae25 100644 --- a/include/impress_rapport.inc.php +++ b/include/impress_rapport.inc.php @@ -217,7 +217,7 @@ echo ''; $w->javascript=''; print ''; // filter on the current year -$filter_year=" where p_exercice='".FormatString($exercice)."'"; +$filter_year=" where p_exercice='".sql_string($exercice)."'"; $periode_start=$cn->make_array("select p_id,to_char(p_start,'DD-MM-YYYY') from parm_periode $filter_year order by p_start,p_end"); print td("Période comptable : Depuis"); diff --git a/include/impress_rec.inc.php b/include/impress_rec.inc.php index 9095b5d9e..fc5dfe650 100644 --- a/include/impress_rec.inc.php +++ b/include/impress_rec.inc.php @@ -29,7 +29,6 @@ global $g_user; /** *@file - *@todo add the export to PDF */ $aledger=$g_user->get_ledger('ALL',3); echo '
'; diff --git a/include/modele.inc.php b/include/modele.inc.php index cdef1bad5..b67185dbe 100644 --- a/include/modele.inc.php +++ b/include/modele.inc.php @@ -61,7 +61,7 @@ $cn=new Database(); if ( isset ($_POST["FMOD_NAME"]) ) { $encoding=$cn->get_value("select encoding from pg_database where ". - " datname='".domaine.'dossier'.FormatString($_POST["FMOD_DBID"])."'"); + " datname='".domaine.'dossier'.sql_string($_POST["FMOD_DBID"])."'"); if ( $encoding != 6 ) { @@ -74,8 +74,8 @@ if ( isset ($_POST["FMOD_NAME"]) ) exit(); } - $mod_name=FormatString($_POST["FMOD_NAME"]); - $mod_desc=FormatString($_POST["FMOD_DESC"]); + $mod_name=sql_string($_POST["FMOD_NAME"]); + $mod_desc=sql_string($_POST["FMOD_DESC"]); if ( $mod_name != null) { $Res=$cn->exec_sql("insert into modeledef(mod_name,mod_desc) @@ -381,7 +381,7 @@ if ( $sa == 'add') echo "

$msg inexistant

"; exit(); } - $sql="drop database ".domaine."mod".FormatString($_REQUEST['m']); + $sql="drop database ".domaine."mod".sql_string($_REQUEST['m']); ob_start(); if ( $cn->exec_sql($sql)==false) { diff --git a/include/param_jrn_add.inc.php b/include/param_jrn_add.inc.php index 98c4973c5..6489c75bb 100644 --- a/include/param_jrn_add.inc.php +++ b/include/param_jrn_add.inc.php @@ -76,7 +76,7 @@ if ( isset ($_POST["add"]) ) $p_jrn_name=$_POST["p_jrn_name"]; - $p_jrn_class_deb=FormatString($_POST["p_jrn_class_deb"]); + $p_jrn_class_deb=sql_string($_POST["p_jrn_class_deb"]); if (strlen(trim($p_jrn_name))==0) return; // compute the jrn_def.jrn_def_code $p_code=sprintf("%s%02d",trim(substr($_POST['p_jrn_type'],0,1)),Acc_Ledger::next_number($cn,$_POST['p_jrn_type'])); diff --git a/include/param_jrn_detail.inc.php b/include/param_jrn_detail.inc.php index 60ad58d95..b8073c1e0 100644 --- a/include/param_jrn_detail.inc.php +++ b/include/param_jrn_detail.inc.php @@ -114,7 +114,7 @@ If ( isset ($_POST["update"] )) $p_jrn_name=$_POST['p_jrn_name']; if (strlen(trim($p_jrn_name))==0) return; - $p_jrn_name=FormatString($p_jrn_name); + $p_jrn_name=sql_string($p_jrn_name); $p_jrn_fiche_deb=""; $p_jrn_fiche_cred=""; $bank=null; diff --git a/include/param_pcmn.inc.php b/include/param_pcmn.inc.php index be4e493c9..18a7fcba9 100644 --- a/include/param_pcmn.inc.php +++ b/include/param_pcmn.inc.php @@ -289,7 +289,7 @@ for ($i=0; $i <$MaxRow; $i++) echo "$td"; printf ("", $A['pcm_val'], - FormatString($A['pcm_lib']), + sql_string($A['pcm_lib']), $A['pcm_val_parent'], $A['pcm_type'], dossier::id()); diff --git a/include/restore.inc.php b/include/restore.inc.php index 34cacf5ba..b27a5b4e9 100644 --- a/include/restore.inc.php +++ b/include/restore.inc.php @@ -67,7 +67,7 @@ if ( isset ($_REQUEST['sa'] )) $id=$cn->get_next_seq('dossier_id'); if ( strlen(trim($_REQUEST['database'])) == 0 ) - $lname=$id." Restauration :".FormatString($_FILES['file']['name']); + $lname=$id." Restauration :".sql_string($_FILES['file']['name']); else $lname=$id." ".$_REQUEST['database']; @@ -129,7 +129,7 @@ if ( isset ($_REQUEST['sa'] )) $id=$cn->get_next_seq('s_modid'); if ( strlen(trim($_REQUEST['database'])) == 0 ) - $lname=$id." Restauration :".FormatString($_FILES['file']['name']); + $lname=$id." Restauration :".sql_string($_FILES['file']['name']); else $lname=$id." ".$_REQUEST['database']; diff --git a/include/stock.inc.php b/include/stock.inc.php index 759015fd3..fb1a9a798 100644 --- a/include/stock.inc.php +++ b/include/stock.inc.php @@ -79,7 +79,7 @@ if ( isset ($_POST['sub_change'])) $type=( $change < 0 )?'c':'d'; if ( $change != 0) { - $comment=FormatString($comment); + $comment=sql_string($comment); $Res=$cn->exec_sql("insert into stock_goods ( j_id, f_id, diff --git a/include/user_common.php b/include/user_common.php index bbddb4893..b607884f7 100644 --- a/include/user_common.php +++ b/include/user_common.php @@ -56,7 +56,7 @@ function InsertStockGoods($p_cn,$p_j_id,$p_good,$p_quant,$p_type) $code=new Fiche($p_cn); $code->get_by_qcode($p_good); $code_marchandise=$code->strAttribut(ATTR_DEF_STOCK); - $p_good=FormatString($p_good); + $p_good=sql_string($p_good); $sql="select f_id from vw_poste_qcode where j_qcode=upper('$p_good')"; $Res=$p_cn->exec_sql($sql); $r=Database::fetch_array($Res,0);