Fix queries: Add Database::escape_string

Author: jmontoyaa

main/admin/dashboard_add_users_to_user.php

@@ -67,6 +67,9 @@ function search_users($needle, $type = 'multiple')
 
     $xajax_response = new xajaxResponse();
     $return = '';
+    $needle = Database::escape_string($needle);
+    $type = Database::escape_string($type);
+
     if (!empty($needle) && !empty($type)) {
         $assigned_users_to_hrm = [];
 
@@ -387,8 +390,8 @@ function remove_item(origin) {
 
 if (api_is_multiple_url_enabled()) {
     $sql = "SELECT user.user_id, username, lastname, firstname
-            FROM $tbl_user user  
-            LEFT JOIN $tbl_access_url_rel_user au 
+            FROM $tbl_user user
+            LEFT JOIN $tbl_access_url_rel_user au
             ON (au.user_id = user.user_id)
             WHERE
                 $without_assigned_users

main/inc/lib/add_courses_to_session_functions.lib.php

@@ -32,10 +32,11 @@ public static function search_courses($needle, $type, $id_session)
             // xajax send utf8 datas... datas in db can be non-utf8 datas
             $charset = api_get_system_encoding();
             $needle = api_convert_encoding($needle, $charset, 'utf-8');
+            $needle = Database::escape_string($needle);
 
             $cond_course_code = '';
             if (!empty($id_session)) {
-                $id_session = intval($id_session);
+                $id_session = (int) $id_session;
                 // check course_code from session_rel_course table
                 $sql = 'SELECT c_id FROM '.$tbl_session_rel_course.'
                         WHERE session_id = '.$id_session;

main/session/session_add.php

@@ -13,7 +13,6 @@
 $this_section = SECTION_PLATFORM_ADMIN;
 
 SessionManager::protectSession(null, false);
-
 api_protect_limit_for_session_admin();
 
 $formSent = 0;
@@ -35,6 +34,7 @@ function search_coachs($needle)
     $return = '';
 
     if (!empty($needle)) {
+        $needle = Database::escape_string($needle);
         $order_clause = api_sort_by_first_name() ? ' ORDER BY firstname, lastname, username' : ' ORDER BY lastname, firstname, username';
 
         // search users where username or firstname or lastname begins likes $needle
@@ -166,44 +166,44 @@ function check_session_name($name)
                     $('#access').val(0);
                     $('#access').selectpicker('render');
                     accessSwitcher(0);
-                    $('#duration').val(parseInt(data.duration));                    
-                } else {                    
+                    $('#duration').val(parseInt(data.duration));
+                } else {
                     $('#access').val(1);
                     $('#access').selectpicker('render');
                     accessSwitcher(1);
-                    
+
                     var variables = [
                         'display_start_date',
                         'access_start_date',
                         'coach_access_start_date',
                         'display_end_date',
                         'access_end_date',
-                        'coach_access_end_date'                        
-                    ];                    
+                        'coach_access_end_date'
+                    ];
                     variables.forEach(function(variable) {
-                        var variableName = variable + '_to_local_time';                        
-                        if (data[variableName]) {                        
+                        var variableName = variable + '_to_local_time';
+                        if (data[variableName]) {
                             var parsedDate = $.datepicker.parseDateTime(
-                                'yy-mm-dd', 
-                                'hh:mm:ss', 
+                                'yy-mm-dd',
+                                'hh:mm:ss',
                                 data[variableName]
-                            );         
+                            );
                             if (parsedDate) {
                                 $('#'+variable).datetimepicker('setDate', parsedDate);
-                            }           
+                            }
                         }
                     });
                 }
-                
+
                 $('[name=\'show_description\']').prop('checked', false);
                 if (data.show_description) {
                     $('[name=\'show_description\']').prop('checked', true);
                 }
-                
+
                 $('[name=\'send_subscription_notification\']').prop('checked', false);
                 if (data.send_subscription_notification) {
                     $('[name=\'send_subscription_notification\']').prop('checked', true);
-                } 
+                }
 
                 $.each(data.extra_fields, function(i, item) {
                     var fieldName = 'extra_'+item.variable;
@@ -250,7 +250,7 @@ function check_session_name($name)
                             break;
                         case '4': // simple select
                         case '5': // multiple select
-                            var options = item.value.split(';');                            
+                            var options = item.value.split(';');
                             $('#'+fieldName+'').val(options);
                             $('#'+fieldName+'').selectpicker('render');
                             break;
@@ -328,20 +328,20 @@ function check_session_name($name)
                             if (item.value) {
                                 //    $('input[name='+fieldName+']').val(item.value);
                                 var url = '".$urlUpload."';
-                                
+
                                 url = url + item.value;
-                                
+
                                 var divFormGroup = fieldName + '-form-group';
                                 var divWrapper = fieldName + '_crop_image';
                                 var divPreview = fieldName + '_preview_image';
                                 var divCropButton = fieldName + '_crop_button';
                                 var cropResult = fieldName + '_crop_result';
-                                                                
+
                                 $('[name=\''+cropResult+'\']').val('import_file_from_session::' + sessionId);
                                 $('#' + divFormGroup).show();
                                 $('#' + divWrapper).show();
                                 $('#' + divCropButton).hide();
-                                $('#' + divPreview).attr('src', url);                                
+                                $('#' + divPreview).attr('src', url);
                                 //$('[name=\''+fieldName+'\']')
                             }
                             break;