Changeset 3761:849987324197 for inc/core/class.dc.auth.php

Timestamp:

06/15/18 18:31:29 (7 years ago)

Author:

franck <carnet.franck.paul@…>

Branch:

sql-statement

Message:

Apply SQL Statement in DC code, work in progress

File:

• inc/core/class.dc.auth.php (modified) (4 diffs)

inc/core/class.dc.auth.php

@@ -93 +93 @@
     {
         # Check user and password
-        $strReq = 'SELECT user_id, user_super, user_pwd, user_change_pwd, ' .
-        'user_name, user_firstname, user_displayname, user_email, ' .
-        'user_url, user_default_blog, user_options, ' .
-        'user_lang, user_tz, user_post_status, user_creadt, user_upddt ' .
-        'FROM ' . $this->con->escapeSystem($this->user_table) . ' ' .
-        "WHERE user_id = '" . $this->con->escape($user_id) . "' ";
+        $sql = new dcSelectStatement($this->core, 'coreAuthCheckUser');
+        $sql
+            ->columns(array('user_id', 'user_super', 'user_pwd', 'user_change_pwd', 'user_name', 'user_firstname',
+                'user_displayname', 'user_email', 'user_url', 'user_default_blog', 'user_options', 'user_lang',
+                'user_tz', 'user_post_status', 'user_creadt', 'user_upddt'))
+            ->from($this->user_table)
+            ->where('user_id = ' . $sql->quote($user_id));
 
         try {
-            $rs = $this->con->select($strReq);
+            $rs = $this->con->select($sql->statement());
         } catch (Exception $e) {
             $err = $e->getMessage();
@@ -146 +147 @@
                 $cur           = $this->con->openCursor($this->user_table);
                 $cur->user_pwd = (string) $rs->user_pwd;
-                $cur->update("WHERE user_id = '" . $rs->user_id . "'");
+
+                $sql = new dcUpdateStatement($this->core, 'coreAuthCheckUser');
+                $sql->where('user_id = ' . $sql->quote($rs->user_id));
+                $cur->update($sql->whereStatement());
             }
         } elseif ($user_key != '') {
@@ -618 +622 @@
     public function recoverUserPassword($recover_key)
     {
-        $strReq = 'SELECT user_id, user_email ' .
-        'FROM ' . $this->user_table . ' ' .
-        "WHERE user_recover_key = '" . $this->con->escape($recover_key) . "' ";
+        $sql = new dcSelectStatement($this->core, 'coreAuthRecoverUserPwd');
+        $sql
+            ->columns(array('user_id', 'user_email'))
+            ->from($this->user_table)
+            ->where('user_recover_key = ' . $sql->quote($recover_key));
 
         $rs = $this->con->select($strReq);
@@ -635 +641 @@
         $cur->user_change_pwd  = 1; // User will have to change this temporary password at next login
 
-        $cur->update("WHERE user_recover_key = '" . $this->con->escape($recover_key) . "'");
+        $sql = new dcUpdateStatement($this->core, 'coreAuthRecoverUserPwd');
+        $sql->where('user_recover_key = ' . $sql->quote($recover_key));
+        $cur->update($sql->whereStatement());
 
         return array('user_email' => $rs->user_email, 'user_id' => $rs->user_id, 'new_pass' => $new_pass);