/[drupal]/contributions/modules/contact/contact.module
ViewVC logotype

Diff of /contributions/modules/contact/contact.module

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph | View Patch Patch

revision 1.63, Wed Nov 17 19:27:53 2004 UTC revision 1.64, Wed Nov 24 22:03:32 2004 UTC
# Line 1  Line 1 
1  <?php  <?php
2  // $Id: contact.module,v 1.62 2004/11/17 00:41:19 drumm Exp $  // $Id: contact.module,v 1.63 2004/11/17 19:27:53 drumm Exp $
3    
4  define('SOURCES_FORM', 0);  define('SOURCES_FORM', 0);
5  define('SOURCES_FORM_ADMIN', 1);  define('SOURCES_FORM_ADMIN', 1);
# Line 931  function _contact_query_cond($edit) { Line 931  function _contact_query_cond($edit) {
931    $form = _contact_get_form();    $form = _contact_get_form();
932    $and = array();    $and = array();
933    if ($edit['mail']) {    if ($edit['mail']) {
934      $and[] = 'c.mail LIKE \'%'. check_query($edit['mail']) .'%\'';      $and[] = 'c.mail LIKE \'%'. db_escape_string($edit['mail']) .'%\'';
935    }    }
936    foreach ($form->fields as $field) {    foreach ($form->fields as $field) {
937      if ($edit[$field->name]) {      if ($edit[$field->name]) {
# Line 939  function _contact_query_cond($edit) { Line 939  function _contact_query_cond($edit) {
939          $or = array();          $or = array();
940          foreach ($edit[$field->name] as $value) {          foreach ($edit[$field->name] as $value) {
941            if ($value) {            if ($value) {
942              $or[] = 'f'. $field->ffid .' LIKE \'%'. check_query($value) .'%\'';              $or[] = 'f'. $field->ffid .' LIKE \'%'. db_escape_string($value) .'%\'';
943            }            }
944          }          }
945          if (count($or) > 0) {          if (count($or) > 0) {
# Line 947  function _contact_query_cond($edit) { Line 947  function _contact_query_cond($edit) {
947          }          }
948        }        }
949        else {        else {
950          $and[] = 'j'. $field->ffid .'.data LIKE \'%'. check_query($edit[$field->name]) .'%\'';          $and[] = 'j'. $field->ffid .'.data LIKE \'%'. db_escape_string($edit[$field->name]) .'%\'';
951        }        }
952      }      }
953    }    }
954    if ($edit['sources']) {    if ($edit['sources']) {
955      foreach ($edit['sources'] as $csid) {      foreach ($edit['sources'] as $csid) {
956        $or[] = 'd.csid = \''. check_query($csid) .'\'';        $or[] = 'd.csid = \''. db_escape_string($csid) .'\'';
957      }      }
958      $and[] = '('. implode(' OR ', $or) .')';      $and[] = '('. implode(' OR ', $or) .')';
959    }    }
Legend:
Removed from v.1.63  
changed lines
  Added in v.1.64
  ViewVC Help
Powered by ViewVC 1.1.2