From 689699aa171df4cfbb2507afe9298977aaef828a Mon Sep 17 00:00:00 2001 From: jakubvrana Date: Tue, 28 Jul 2009 16:20:50 +0000 Subject: [PATCH] Shortcut for htmlspecialchars git-svn-id: https://adminer.svn.sourceforge.net/svnroot/adminer/trunk@936 7c3ca157-0c34-0410-bff1-cbf682f78f5c --- adminer/call.inc.php | 8 +++--- adminer/create.inc.php | 14 +++++----- adminer/database.inc.php | 4 +-- adminer/db.inc.php | 34 +++++++++++------------ adminer/dump.inc.php | 6 ++-- adminer/edit.inc.php | 2 +- adminer/event.inc.php | 14 +++++----- adminer/include/adminer.inc.php | 38 ++++++++++++------------- adminer/include/auth.inc.php | 4 +-- adminer/include/connect.inc.php | 6 ++-- adminer/include/design.inc.php | 12 ++++---- adminer/include/editing.inc.php | 6 ++-- adminer/include/functions.inc.php | 46 +++++++++++++++++-------------- adminer/indexes.inc.php | 2 +- adminer/privileges.inc.php | 6 ++-- adminer/procedure.inc.php | 6 ++-- adminer/schema.inc.php | 8 +++--- adminer/select.inc.php | 26 ++++++++--------- adminer/sql.inc.php | 6 ++-- adminer/table.inc.php | 36 ++++++++++++------------ adminer/trigger.inc.php | 8 +++--- adminer/user.inc.php | 14 +++++----- adminer/variables.inc.php | 4 +-- adminer/view.inc.php | 4 +-- compile.php | 2 +- coverage.php | 2 +- editor/example.php | 4 +-- editor/include/adminer.inc.php | 16 +++++------ 28 files changed, 171 insertions(+), 167 deletions(-) diff --git a/adminer/call.inc.php b/adminer/call.inc.php index e0c17d03..b3f6e179 100644 --- a/adminer/call.inc.php +++ b/adminer/call.inc.php @@ -1,5 +1,5 @@ query("SET @" . idf_escape($field["field"]) . " = " . $val); + $dbh->query("SET @" . idf_escape($field["field"]) . " = $val"); } } $call[] = (isset($out[$key]) ? "@" . idf_escape($field["field"]) : $val); } $result = $dbh->multi_query((isset($_GET["callf"]) ? "SELECT" : "CALL") . " " . idf_escape($_GET["call"]) . "(" . implode(", ", $call) . ")"); if (!$result) { - echo "

" . htmlspecialchars($dbh->error) . "\n"; + echo "

" . h($dbh->error) . "\n"; } else { do { $result = $dbh->store_result(); @@ -52,7 +52,7 @@ if ($in) { echo "\n"; foreach ($in as $key) { $field = $routine["fields"][$key]; - echo "
" . htmlspecialchars($field["field"]); + echo "
" . h($field["field"]); $value = $_POST["fields"][$key]; if (strlen($value) && ($field["type"] == "enum" || $field["type"] == "set")) { $value = intval($value); diff --git a/adminer/create.inc.php b/adminer/create.inc.php index ce5bb3b0..64de551a 100644 --- a/adminer/create.inc.php +++ b/adminer/create.inc.php @@ -126,13 +126,13 @@ $collations = collations(); $suhosin = floor(extension_loaded("suhosin") ? (min(ini_get("suhosin.request.max_vars"), ini_get("suhosin.post.max_vars")) - 13) / 8 : 0); if ($suhosin && count($row["fields"]) > $suhosin) { - echo "

" . htmlspecialchars(lang('Maximum number of allowed fields exceeded. Please increase %s and %s.', 'suhosin.post.max_vars', 'suhosin.request.max_vars')) . "\n"; + echo "

" . h(lang('Maximum number of allowed fields exceeded. Please increase %s and %s.', 'suhosin.post.max_vars', 'suhosin.request.max_vars')) . "\n"; } ?>

-: "> +: "> @@ -141,7 +141,7 @@ if ($suhosin && count($row["fields"]) > $suhosin) {

: "> -: " maxlength="60"> +: " maxlength="60"> @@ -155,15 +155,15 @@ if ($dbh->server_info >= 5.1) {

-(">) -: "> +(">) +: "> > $val) { echo ''; - echo ' diff --git a/adminer/database.inc.php b/adminer/database.inc.php index f807da57..d70e37a3 100644 --- a/adminer/database.inc.php +++ b/adminer/database.inc.php @@ -72,8 +72,8 @@ if ($_POST) {

' . htmlspecialchars($name) . '
' - : '' + ? '
' + : '' ) . "\n"; ?> diff --git a/adminer/db.inc.php b/adminer/db.inc.php index ba068171..5fcdbb7f 100644 --- a/adminer/db.inc.php +++ b/adminer/db.inc.php @@ -31,16 +31,16 @@ if ($tables_views && !$error) { $message = lang('Tables have been dropped.'); } else { while ($row = $result->fetch_assoc()) { - $message .= htmlspecialchars("$row[Table]: $row[Msg_text]") . "
"; + $message .= h("$row[Table]: $row[Msg_text]") . "
"; } } } query_redirect(queries(), substr($SELF, 0, -1), $message, $result, false, !$result); } -page_header(lang('Database') . ": " . htmlspecialchars($_GET["db"]), $error, false); -echo '

' . lang('Alter database') . "\n"; -echo '

' . lang('Database schema') . "\n"; +page_header(lang('Database') . ": " . h($_GET["db"]), $error, false); +echo '

' . lang('Alter database') . "\n"; +echo '

' . lang('Database schema') . "\n"; echo "

" . lang('Tables and views') . "

\n"; $table_status = table_status(); @@ -53,17 +53,17 @@ if (!$table_status) { foreach ($table_status as $row) { $name = $row["Name"]; table_comment($row); - echo ''; - echo '' . htmlspecialchars($name) . ''; + echo ''; + echo '' . h($name) . ''; if (isset($row["Rows"])) { echo "$row[Engine]$row[Collation]"; foreach (array("Data_length" => "create", "Index_length" => "indexes", "Data_free" => "edit", "Auto_increment" => "create", "Rows" => "select") as $key => $link) { $val = number_format($row[$key], 0, '.', lang(',')); - echo '' . (strlen($row[$key]) ? '' . str_replace(" ", " ", ($key == "Rows" && $row["Engine"] == "InnoDB" && $val ? lang('~ %s', $val) : $val)) . '' : ' '); + echo '' . (strlen($row[$key]) ? '' . str_replace(" ", " ", ($key == "Rows" && $row["Engine"] == "InnoDB" && $val ? lang('~ %s', $val) : $val)) . '' : ' '); } - echo "" . (strlen(trim($row["Comment"])) ? htmlspecialchars($row["Comment"]) : " "); + echo "" . (strlen(trim($row["Comment"])) ? h($row["Comment"]) : " "); } else { - echo '' . lang('View') . ''; + echo '' . lang('View') . ''; } } echo "\n"; @@ -71,27 +71,27 @@ if (!$table_status) { $dbs = get_databases(); if (count($dbs) != 1) { $db = (isset($_POST["target"]) ? $_POST["target"] : $_GET["db"]); - echo "

" . lang('Move to other database') . ($dbs ? ": " : ': ') . " \n"; + echo "

" . lang('Move to other database') . ($dbs ? ": " : ': ') . " \n"; } echo "\n"; } if ($dbh->server_info >= 5) { - echo '

' . lang('Create view') . "\n"; + echo '

' . lang('Create view') . "\n"; echo "

" . lang('Routines') . "

\n"; $result = $dbh->query("SELECT * FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA = " . $dbh->quote($_GET["db"])); if ($result->num_rows) { echo "\n"; while ($row = $result->fetch_assoc()) { echo ""; - echo "
" . htmlspecialchars($row["ROUTINE_TYPE"]); - echo '' . htmlspecialchars($row["ROUTINE_NAME"]) . ''; - echo '' . lang('Alter') . ""; + echo "" . h($row["ROUTINE_TYPE"]); + echo '' . h($row["ROUTINE_NAME"]) . ''; + echo '' . lang('Alter') . ""; } echo "
\n"; } $result->free(); - echo '

' . lang('Create procedure') . ' ' . lang('Create function') . "\n"; + echo '

' . lang('Create procedure') . ' ' . lang('Create function') . "\n"; } if ($dbh->server_info >= 5.1 && ($result = $dbh->query("SHOW EVENTS"))) { @@ -101,12 +101,12 @@ if ($dbh->server_info >= 5.1 && ($result = $dbh->query("SHOW EVENTS"))) { echo "" . lang('Name') . "" . lang('Schedule') . "" . lang('Start') . "" . lang('End') . "\n"; while ($row = $result->fetch_assoc()) { echo ""; - echo '' . htmlspecialchars($row["Name"]) . ""; + echo '' . h($row["Name"]) . ""; echo "" . ($row["Execute at"] ? lang('At given time') . "" . $row["Execute at"] : lang('Every') . " " . $row["Interval value"] . " " . $row["Interval field"] . "$row[Starts]"); echo "$row[Ends]"; } echo "\n"; } $result->free(); - echo '

' . lang('Create event') . "\n"; + echo '

' . lang('Create event') . "\n"; } diff --git a/adminer/dump.inc.php b/adminer/dump.inc.php index a27b0e0b..60d4d1d3 100644 --- a/adminer/dump.inc.php +++ b/adminer/dump.inc.php @@ -182,11 +182,11 @@ if (strlen($_GET["db"])) { $views = ""; foreach (table_status() as $row) { $checked = (strlen($_GET["dump"]) && $row["Name"] != $_GET["dump"] ? '' : " checked='checked'"); - $print = '"; + $print = ""; if (!$row["Engine"]) { $views .= "$print\n"; } else { - echo "$print\n"; + echo "$print\n"; } } echo $views; @@ -194,7 +194,7 @@ if (strlen($_GET["db"])) { echo "\n"; foreach (get_databases() as $db) { if (!information_schema($db)) { - echo '\n"; + echo '\n"; } } } diff --git a/adminer/edit.inc.php b/adminer/edit.inc.php index e556c038..c134e988 100644 --- a/adminer/edit.inc.php +++ b/adminer/edit.inc.php @@ -85,7 +85,7 @@ if ($fields) { $create = $dbh->result($dbh->query("SHOW CREATE TABLE " . idf_escape($_GET["edit"])), 1); } $checked = ($_POST ? $_POST["on_update"][bracket_escape($name)] : preg_match("~\n\\s*" . preg_quote(idf_escape($name), '~') . " timestamp.* on update CURRENT_TIMESTAMP~i", $create)); - echo ''; + echo ''; } echo "\n"; } diff --git a/adminer/event.inc.php b/adminer/event.inc.php index 6ada53ff..07208ef5 100644 --- a/adminer/event.inc.php +++ b/adminer/event.inc.php @@ -23,7 +23,7 @@ if ($_POST && !$error) { } } -page_header((strlen($_GET["event"]) ? lang('Alter event') . ": " . htmlspecialchars($_GET["event"]) : lang('Create event')), $error); +page_header((strlen($_GET["event"]) ? lang('Alter event') . ": " . h($_GET["event"]) : lang('Create event')), $error); $row = array(); if ($_POST) { @@ -37,15 +37,15 @@ if ($_POST) {

-
" maxlength="64"> -
"> -
"> -
" size="6"> +
" maxlength="64"> +
"> +
"> +
" size="6">
-
" maxlength="64"> +
" maxlength="64">
 
-

+

diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php index f835ab5a..919fd192 100644 --- a/adminer/include/adminer.inc.php +++ b/adminer/include/adminer.inc.php @@ -33,8 +33,8 @@ class Adminer { function loginForm($username) { ?> -
"> -
+
"> +
' . htmlspecialchars($field["field"]) . ''; + return '' . h($field["field"]) . ''; } /** Links after select heading @@ -72,7 +72,7 @@ class Adminer { */ function selectLinks($tableStatus) { global $SELF; - return '' . lang('Table structure') . ''; + return '' . lang('Table structure') . ''; } /** Find backward keys for table @@ -90,7 +90,7 @@ class Adminer { function selectQuery($query) { global $SELF; // it would be nice if $query can be passed by reference and printed value would be returned but call_user() doesn't allow reference parameters - return "

" . htmlspecialchars($query) . " " . lang('Edit') . "\n"; + return "

" . h($query) . " " . lang('Edit') . "\n"; } /** Description of a row in a table @@ -163,8 +163,8 @@ class Adminer { echo '

' . lang('Search') . "\n"; $i++; } } @@ -211,7 +211,7 @@ class Adminer { */ function selectLimitPrint($limit) { echo "
" . lang('Limit') . "
"; //
for easy styling - echo ""; + echo ""; echo "
\n"; } @@ -222,7 +222,7 @@ class Adminer { function selectLengthPrint($text_length) { if (isset($text_length)) { echo "
" . lang('Text length') . "
"; - echo ''; + echo ''; echo "
\n"; } } @@ -340,7 +340,7 @@ class Adminer { global $SELF; $id = "sql-" . count($_SESSION["messages"]); $_SESSION["history"][$_GET["server"]][$_GET["db"]][] = $query; - return " " . lang('SQL command') . "'; + return " " . lang('SQL command') . "'; } /** Functions displayed in edit form @@ -422,18 +422,18 @@ class Adminer { ?>

- -"> + +"> ">

-

"> +

"> -"> +"> @@ -449,12 +449,12 @@ class Adminer { } else { echo "

\n"; while ($row = $result->fetch_row()) { - echo '' . lang('select') . ' '; - echo '' . $this->tableName(array("Name" => $row[0])) . "
\n"; //! Adminer::tableName may work with full table status + echo '' . lang('select') . ' '; + echo '' . $this->tableName(array("Name" => $row[0])) . "
\n"; //! Adminer::tableName may work with full table status } } $result->free(); - echo '

' . lang('Create new table') . "\n"; + echo '

' . lang('Create new table') . "\n"; } } } diff --git a/adminer/include/auth.inc.php b/adminer/include/auth.inc.php index 0b99c7b2..9be6903b 100644 --- a/adminer/include/auth.inc.php +++ b/adminer/include/auth.inc.php @@ -40,13 +40,13 @@ function auth_error($exception = null) { global $ignore, $dbh, $adminer; $username = $_SESSION["usernames"][$_GET["server"]]; unset($_SESSION["usernames"][$_GET["server"]]); - page_header(lang('Login'), (isset($username) ? htmlspecialchars($exception ? $exception->getMessage() : (is_string($dbh) ? $dbh : lang('Invalid credentials.'))) : (isset($_POST["server"]) ? lang('Sessions must be enabled.') : ($_POST ? lang('Session expired, please login again.') : ""))), null); + page_header(lang('Login'), (isset($username) ? h($exception ? $exception->getMessage() : (is_string($dbh) ? $dbh : lang('Invalid credentials.'))) : (isset($_POST["server"]) ? lang('Sessions must be enabled.') : ($_POST ? lang('Session expired, please login again.') : ""))), null); echo "\n"; $adminer->loginForm($username); echo "

\n"; hidden_fields($_POST, $ignore); // expired session foreach ($_FILES as $key => $val) { - echo ''; + echo ''; } echo "\n

\n"; page_footer("auth"); diff --git a/adminer/include/connect.inc.php b/adminer/include/connect.inc.php index 8d10be5b..ffe05339 100644 --- a/adminer/include/connect.inc.php +++ b/adminer/include/connect.inc.php @@ -2,7 +2,7 @@ function connect_error() { global $dbh, $SELF, $VERSION; if (strlen($_GET["db"])) { - page_header(lang('Database') . ": " . htmlspecialchars($_GET["db"]), lang('Invalid database.'), false); + page_header(lang('Database') . ": " . h($_GET["db"]), lang('Invalid database.'), false); } else { page_header(lang('Select database'), "", null); foreach (array( @@ -11,10 +11,10 @@ function connect_error() { 'processlist' => lang('Process list'), 'variables' => lang('Variables'), ) as $key => $val) { - echo '

$val\n"; + echo '

$val\n"; } echo "

" . lang('MySQL version: %s through PHP extension %s', "server_info < 4.1 ? " class='binary'" : "") . ">$dbh->server_info", "$dbh->extension") . "\n"; - echo "

" . lang('Logged as: %s', "" . htmlspecialchars($dbh->result($dbh->query("SELECT USER()"))) . "") . "\n"; + echo "

" . lang('Logged as: %s', "" . h($dbh->result($dbh->query("SELECT USER()"))) . "") . "\n"; } page_footer("db"); } diff --git a/adminer/include/design.inc.php b/adminer/include/design.inc.php index 07cd3547..060db123 100644 --- a/adminer/include/design.inc.php +++ b/adminer/include/design.inc.php @@ -8,7 +8,7 @@ function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") { -<?php echo $title . (strlen($title2) ? ": " . htmlspecialchars($title2) : "") . (strlen($_GET["server"]) && $_GET["server"] != "localhost" ? htmlspecialchars("- $_GET[server]") : "") . " - " . $adminer->name(); ?> +<?php echo $title . (strlen($title2) ? ": " . h($title2) : "") . (strlen($_GET["server"]) && $_GET["server"] != "localhost" ? h("- $_GET[server]") : "") . " - " . $adminer->name(); ?> @@ -23,21 +23,21 @@ function page_header($title, $error = "", $breadcrumb = array(), $title2 = "") { ' . (isset($_GET["server"]) ? htmlspecialchars($_GET["server"]) : lang('Server')) . ' » '; + echo '

$title" . (strlen($title2) ? ": " . htmlspecialchars($title2) : "") . "

\n"; + echo "

$title" . (strlen($title2) ? ": " . h($title2) : "") . "

\n"; if ($_SESSION["messages"]) { echo "
" . implode("
\n
", $_SESSION["messages"]) . "
\n"; $_SESSION["messages"] = array(); @@ -63,7 +63,7 @@ function page_footer($missing = false) { diff --git a/adminer/include/editing.inc.php b/adminer/include/editing.inc.php index 9202a43e..7c515257 100644 --- a/adminer/include/editing.inc.php +++ b/adminer/include/editing.inc.php @@ -21,7 +21,7 @@ function edit_type($key, $field, $collations, $foreign_keys = array()) { global $structured_types, $unsigned, $inout; ?> -" size="3"> +" size="3">
\n"; } @@ -310,7 +310,7 @@ ORDER BY ORDINAL_POSITION"); //! requires MySQL 5 } } if ($field["full_type"] == "tinyint(1)") { // bool - return '"; + return '"; } return ''; } @@ -346,7 +346,7 @@ ORDER BY ORDINAL_POSITION"); //! requires MySQL 5 foreach ($table_status as $row) { $name = $this->tableName($row); if (isset($row["Engine"]) && strlen($name)) { // ignore views and tables without name - echo '$name
\n"; + echo "$name
\n"; } } }