From 2c31e82b60aebd650d288079b6dcd420e414e266 Mon Sep 17 00:00:00 2001 From: Nathan Guse Date: Sun, 9 Sep 2012 17:23:32 -0500 Subject: [PATCH] [ticket/11103] Coding guidelines (SQL Queries) PHPBB3-11103 --- phpBB/includes/notifications/service.php | 9 ++++++--- phpBB/includes/notifications/type/base.php | 3 ++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/phpBB/includes/notifications/service.php b/phpBB/includes/notifications/service.php index 5dcfeb127b..e697374b0a 100644 --- a/phpBB/includes/notifications/service.php +++ b/phpBB/includes/notifications/service.php @@ -66,7 +66,8 @@ class phpbb_notifications_service $notifications = $user_ids = array(); - $sql = 'SELECT * FROM ' . NOTIFICATIONS_TABLE . ' + $sql = 'SELECT * + FROM ' . NOTIFICATIONS_TABLE . ' WHERE user_id = ' . (int) $options['user_id'] . ' ORDER BY ' . $this->db->sql_escape($options['order_by']) . ' ' . $this->db->sql_escape($options['order_dir']); $result = $this->db->sql_query_limit($sql, $options['limit'], $options['start']); @@ -116,7 +117,8 @@ class phpbb_notifications_service // Make sure not to send new notifications to users who've already been notified about this item // This may happen when an item was added, but now new users are able to see the item - $sql = 'SELECT user_id FROM ' . NOTIFICATIONS_TABLE . " + $sql = 'SELECT user_id + FROM ' . NOTIFICATIONS_TABLE . " WHERE item_type = '" . $this->db->sql_escape($item_type) . "' AND item_id = " . (int) $item_id; $result = $this->db->sql_query($sql); @@ -239,7 +241,8 @@ class phpbb_notifications_service if (sizeof($user_ids)) { - $sql = 'SELECT * FROM ' . USERS_TABLE . ' + $sql = 'SELECT * + FROM ' . USERS_TABLE . ' WHERE ' . $this->db->sql_in_set('user_id', $user_ids); $result = $this->db->sql_query($sql); diff --git a/phpBB/includes/notifications/type/base.php b/phpBB/includes/notifications/type/base.php index e60b20c449..859ffb5116 100644 --- a/phpBB/includes/notifications/type/base.php +++ b/phpBB/includes/notifications/type/base.php @@ -183,7 +183,8 @@ abstract class phpbb_notifications_type_base implements phpbb_notifications_type $rowset = array(); - $sql = 'SELECT * FROM ' . USER_NOTIFICATIONS_TABLE . " + $sql = 'SELECT * + FROM ' . USER_NOTIFICATIONS_TABLE . " WHERE item_type = '" . static::get_item_type() . "' AND item_id = " . (int) $item_id; $result = $db->sql_query($sql);