diff --git a/webroot/parser.php b/webroot/parser.php index 00526d6..1b85bbc 100644 --- a/webroot/parser.php +++ b/webroot/parser.php @@ -6,11 +6,18 @@ include("databaseinfo.php"); $now = time(); -// -// Search DB -// -mysql_connect ($DB_HOST, $DB_USER, $DB_PASSWORD); -mysql_select_db ($DB_NAME); +// Attempt to connect to the search database +try { + $db = new PDO("mysql:host=$DB_HOST;dbname=$DB_NAME", $DB_USER, $DB_PASSWORD); + $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); +} +catch(PDOException $e) +{ + echo "Error connecting to the search database\n"; + file_put_contents('PDOErrors.txt', $e->getMessage() . "\n-----\n", FILE_APPEND); + exit; +} + function GetURL($host, $port, $url) { @@ -35,10 +42,10 @@ function GetURL($host, $port, $url) function CheckHost($hostname, $port) { - global $now; + global $db, $now; $xml = GetURL($hostname, $port, "?method=collector"); - if ($xml == "") //No data was retrieved? (CURL may have timed out) + if ($xml == "") //No data was retrieved? (CURL may have timed out) $failcounter = "failcounter + 1"; else $failcounter = "0"; @@ -47,18 +54,18 @@ function CheckHost($hostname, $port) //won't be checked again until at least this much time has gone by. $next = $now + 600; - mysql_query("UPDATE hostsregister SET nextcheck = $next," . - " checked = 1, failcounter = " . $failcounter . - " WHERE host = '" . mysql_real_escape_string($hostname) . "'" . - " AND port = '" . mysql_real_escape_string($port) . "'"); + $query = $db->prepare("UPDATE hostsregister SET nextcheck = ?," . + " checked = 1, failcounter = $failcounter" . + " WHERE host = ? AND port = ?"); + $query->execute( array($next, $hostname, $port) ); - if ($xml != "") + if ($xml != "") parse($hostname, $port, $xml); } function parse($hostname, $port, $xml) { - global $now; + global $db, $now; /////////////////////////////////////////////////////////////////////// // @@ -93,9 +100,9 @@ function parse($hostname, $port, $xml) $expire = $regiondata->getElementsByTagName("expire")->item(0)->nodeValue; $next = $now + $expire; - $updater = mysql_query("UPDATE hostsregister SET nextcheck = $next " . - "WHERE host = '" . mysql_real_escape_string($hostname) . "' AND " . - "port = '" . mysql_real_escape_string($port) . "'"); + $query = $db->prepare("UPDATE hostsregister SET nextcheck = ?" . + " WHERE host = ? AND port = ?"); + $query->execute( array($next, $hostname, $port) ); // // Get the region data to be saved in the database @@ -122,21 +129,21 @@ function parse($hostname, $port, $xml) // // First, check if we already have a region that is the same // - $check = mysql_query("SELECT * FROM regions WHERE regionuuid = '" . - mysql_real_escape_string($regionuuid) . "'"); + $check = $db->prepare("SELECT * FROM regions WHERE regionuuid = ?"); + $check->execute( array($regionuuid) ); - if (mysql_num_rows($check) > 0) + if ($check->rowCount() > 0) { - mysql_query("DELETE FROM regions WHERE regionuuid = '" . - mysql_real_escape_string($regionuuid) . "'"); - mysql_query("DELETE FROM parcels WHERE regionuuid = '" . - mysql_real_escape_string($regionuuid) . "'"); - mysql_query("DELETE FROM allparcels WHERE regionUUID = '" . - mysql_real_escape_string($regionuuid) . "'"); - mysql_query("DELETE FROM parcelsales WHERE regionUUID = '" . - mysql_real_escape_string($regionuuid) . "'"); - mysql_query("DELETE FROM objects WHERE regionuuid = '" . - mysql_real_escape_string($regionuuid) . "'"); + $query = $db->prepare("DELETE FROM regions WHERE regionuuid = ?"); + $query->execute( array($regionuuid) ); + $query = $db->prepare("DELETE FROM parcels WHERE regionuuid = ?"); + $query->execute( array($regionuuid) ); + $query = $db->prepare("DELETE FROM allparcels WHERE regionuuid = ?"); + $query->execute( array($regionuuid) ); + $query = $db->prepare("DELETE FROM parcelsales WHERE regionuuid = ?"); + $query->execute( array($regionuuid) ); + $query = $db->prepare("DELETE FROM objects WHERE regionuuid = ?"); + $query->execute( array($regionuuid) ); } $data = $region->getElementsByTagName("data")->item(0); @@ -150,15 +157,11 @@ function parse($hostname, $port, $xml) // // Second, add the new info to the database // - $sql = "INSERT INTO regions VALUES('" . - mysql_real_escape_string($regionname) . "','" . - mysql_real_escape_string($regionuuid) . "','" . - mysql_real_escape_string($regionhandle) . "','" . - mysql_real_escape_string($url) . "','" . - mysql_real_escape_string($username) ."','" . - mysql_real_escape_string($useruuid) ."')"; - - mysql_query($sql); + $query = $db->prepare("INSERT INTO regions VALUES(:r_name, :r_uuid, " . + ":r_handle, :url, :u_name, :u_uuid)"); + $query->execute( array("r_name" => $regionname, "r_uuid" => $regionuuid, + "r_handle" => $regionhandle, "url" => $url, + "u_name" => $username, "u_uuid" => $useruuid) ); // // Start reading the parcel info @@ -192,7 +195,7 @@ function parse($hostname, $port, $xml) // Adding support for groups $group = $value->getElementsByTagName("group")->item(0); - + if ($group != "") { $groupuuid = $group->getElementsByTagName("groupuuid")->item(0)->nodeValue; @@ -214,52 +217,54 @@ function parse($hostname, $port, $xml) // // Save // - $sql = "INSERT INTO allparcels VALUES('" . - mysql_real_escape_string($regionuuid) . "','" . - mysql_real_escape_string($parcelname) . "','" . - mysql_real_escape_string($owneruuid) . "','" . - mysql_real_escape_string($groupuuid) . "','" . - mysql_real_escape_string($parcellanding) . "','" . - mysql_real_escape_string($parceluuid) . "','" . - mysql_real_escape_string($infouuid) . "','" . - mysql_real_escape_string($parcelarea) . "' )"; - - mysql_query($sql); + $query = $db->prepare("INSERT INTO allparcels VALUES(" . + ":r_uuid, :p_name, :o_uuid, :g_uuid, " . + ":landing, :p_uuid, :i_uuid, :area)"); + $query->execute( array("r_uuid" => $regionuuid, + "p_name" => $parcelname, + "o_uuid" => $owneruuid, + "g_uuid" => $groupuuid, + "landing" => $parcellanding, + "p_uuid" => $parceluuid, + "i_uuid" => $infouuid, + "area" => $parcelarea) ); if ($parceldirectory == "true") { - $sql = "INSERT INTO parcels VALUES('" . - mysql_real_escape_string($regionuuid) . "','" . - mysql_real_escape_string($parcelname) . "','" . - mysql_real_escape_string($parceluuid) . "','" . - mysql_real_escape_string($parcellanding) . "','" . - mysql_real_escape_string($parceldescription) . "','" . - mysql_real_escape_string($parcelcategory) . "','" . - mysql_real_escape_string($parcelbuild) . "','" . - mysql_real_escape_string($parcelscript) . "','" . - mysql_real_escape_string($parcelpublic) . "','". - mysql_real_escape_string($dwell) . "','" . - mysql_real_escape_string($infouuid) . "','" . - mysql_real_escape_string($regioncategory) . "')"; - - mysql_query($sql); + $query = $db->prepare("INSERT INTO parcels VALUES(" . + ":r_uuid, :p_name, :p_uuid, :landing, " . + ":desc, :cat, :build, :script, :public, ". + ":dwell, :i_uuid, :r_cat)"); + $query->execute( array("r_uuid" => $regionuuid, + "p_name" => $parcelname, + "p_uuid" => $parceluuid, + "landing" => $parcellanding, + "desc" => $parceldescription, + "cat" => $parcelcategory, + "build" => $parcelbuild, + "script" => $parcelscript, + "public" => $parcelpublic, + "dwell" => $dwell, + "i_uuid" => $infouuid, + "r_cat" => $regioncategory) ); } if ($parcelforsale == "true") { - $sql = "INSERT INTO parcelsales VALUES('" . - mysql_real_escape_string($regionuuid) . "','" . - mysql_real_escape_string($parcelname) . "','" . - mysql_real_escape_string($parceluuid) . "','" . - mysql_real_escape_string($parcelarea) . "','" . - mysql_real_escape_string($parcelsaleprice) . "','" . - mysql_real_escape_string($parcellanding) . "','" . - mysql_real_escape_string($infouuid) . "', '" . - mysql_real_escape_string($dwell) . "', '" . - mysql_real_escape_string($estateid) . "', '" . - mysql_real_escape_string($regioncategory) . "')"; - - mysql_query($sql); + $query = $db->prepare("INSERT INTO parcelsales VALUES(" . + ":r_uuid, :p_name, :p_uuid, :area, " . + ":price, :landing, :i_uuid, :dwell, " . + ":e_id, :r_cat)"); + $query->execute( array("r_uuid" => $regionuuid, + "p_name" => $parcelname, + "p_uuid" => $parceluuid, + "area" => $parcelarea, + "price" => $parcelsaleprice, + "landing" => $parcellanding, + "i_uuid" => $infouuid, + "dwell" => $dwell, + "e_id" => $estateid, + "r_cat" => $regioncategory) ); } } @@ -284,33 +289,37 @@ function parse($hostname, $port, $xml) $flags = $value->getElementsByTagName("flags")->item(0)->nodeValue; - mysql_query("INSERT INTO objects VALUES('" . - mysql_real_escape_string($uuid) . "','" . - mysql_real_escape_string($parceluuid) . "','" . - mysql_real_escape_string($location) . "','" . - mysql_real_escape_string($title) . "','" . - mysql_real_escape_string($description) . "','" . - mysql_real_escape_string($regionuuid) . "')"); + $query = $db->prepare("INSERT INTO objects VALUES(" . + ":uuid, :p_uuid, :location, " . + ":title, :desc, :r_uuid)"); + $query->execute( array("uuid" => $uuid, + "p_uuid" => $parceluuid, + "location" => $location, + "title" => $title, + "desc" => $description, + "r_uuid" => $regionuuid) ); } } } $sql = "SELECT host, port FROM hostsregister " . - "WHERE nextcheck < $now AND checked = 0 LIMIT 0,10"; - -$jobsearch = mysql_query($sql); + "WHERE nextcheck<$now AND checked=0 AND failcounter<10 LIMIT 0,10"; +$jobsearch = $db->query($sql); // // If the sql query returns no rows, all entries in the hostsregister // table have been checked. Reset the checked flag and re-run the // query to select the next set of hosts to be checked. // -if (mysql_num_rows($jobsearch) == 0) +if ($jobsearch->rowCount() == 0) { - mysql_query("UPDATE hostsregister SET checked = 0"); - $jobsearch = mysql_query($sql); + $jobsearch = $db->query("UPDATE hostsregister SET checked = 0"); + + $jobsearch = $db->query($sql); } -while ($jobs = mysql_fetch_row($jobsearch)) +while ($jobs = $jobsearch->fetch(PDO::FETCH_NUM)) CheckHost($jobs[0], $jobs[1]); + +$db = NULL; ?> diff --git a/webroot/query.php b/webroot/query.php index affb746..5fb15d6 100644 --- a/webroot/query.php +++ b/webroot/query.php @@ -5,11 +5,17 @@ include("databaseinfo.php"); -// -// Search DB -// -mysql_connect ($DB_HOST, $DB_USER, $DB_PASSWORD); -mysql_select_db ($DB_NAME); +// Attempt to connect to the database +try { + $db = new PDO("mysql:host=$DB_HOST;dbname=$DB_NAME", $DB_USER, $DB_PASSWORD); + $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); +} +catch(PDOException $e) +{ + echo "Error connecting to database\n"; + file_put_contents('PDOErrors.txt', $e->getMessage() . "\n-----\n", FILE_APPEND); + exit; +} # # Copyright (c)Melanie Thielker (http://opensimulator.org/) @@ -71,6 +77,8 @@ xmlrpc_server_register_method($xmlrpc_server, "dir_places_query", function dir_places_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $flags = $req['flags']; @@ -78,10 +86,12 @@ function dir_places_query($method_name, $params, $app_data) $category = $req['category']; $query_start = $req['query_start']; - $pieces = split(" ", $text); + $pieces = explode(" ", $text); $text = join("%", $pieces); - if ($text == "%%%") + if ($text != "%%%") + $text = "%$text%"; + else { $response_xml = xmlrpc_encode(array( 'success' => False, @@ -94,6 +104,7 @@ function dir_places_query($method_name, $params, $app_data) } $terms = array(); + $sqldata = array(); $type = process_region_type_flags($flags); if ($type != "") @@ -102,20 +113,32 @@ function dir_places_query($method_name, $params, $app_data) if ($flags & 1024) $order = "dwell DESC,"; - if ($category > 0) - $category = "searchcategory = '".mysql_real_escape_string($category)."' AND "; + if ($category <= 0) + $cat_where = ""; else - $category = ""; + { + $cat_where = "searchcategory = :cat AND "; - $text = mysql_real_escape_string($text); - $result = mysql_query("SELECT * FROM parcels WHERE $category " . - "(parcelname LIKE '%$text%'" . - " OR description LIKE '%$text%')" . - $type . " ORDER BY $order parcelname" . - " LIMIT ".(0+$query_start).",101"); + $sqldata['cat'] = $category; + } + + $sqldata['text1'] = $text; + $sqldata['text2'] = $text; + + //Prevent SQL injection by checking that $query_start is a number + if (!is_int($query_start)) + $query_start = 0; + + $sql = "SELECT * FROM parcels WHERE $cat_where" . + " (parcelname LIKE :text1" . + " OR description LIKE :text2)" . + $type . " ORDER BY $order parcelname" . + " LIMIT $query_start,101"; + $query = $db->prepare($sql); + $result = $query->execute($sqldata); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $data[] = array( "parcel_id" => $row["infouuid"], @@ -142,6 +165,8 @@ xmlrpc_server_register_method($xmlrpc_server, "dir_popular_query", function dir_popular_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $text = $req['text']; @@ -149,6 +174,7 @@ function dir_popular_query($method_name, $params, $app_data) $query_start = $req['query_start']; $terms = array(); + $sqldata = array(); if ($flags & 0x1000) //PicturesOnly (1 << 12) $terms[] = "has_picture = 1"; @@ -158,8 +184,10 @@ function dir_popular_query($method_name, $params, $app_data) if ($text != "") { - $text = mysql_real_escape_string($text); - $terms[] = "(name LIKE '%$text%')"; + $terms[] = "(name LIKE :text)"; + + $text = "%text%"; + $sqldata['text'] = $text; } if (count($terms) > 0) @@ -167,11 +195,16 @@ function dir_popular_query($method_name, $params, $app_data) else $where = ""; - $result = mysql_query("SELECT * FROM popularplaces" . $where . - " LIMIT " . mysql_real_escape_string($query_start) . ",101"); + //Prevent SQL injection by checking that $query_start is a number + if (!is_int($query_start)) + $query_start = 0; + + $query = $db->prepare("SELECT * FROM popularplaces" . $where . + " LIMIT $query_start,101"); + $result = $query->execute($sqldata); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $data[] = array( "parcel_id" => $row["infoUUID"], @@ -196,6 +229,8 @@ xmlrpc_server_register_method($xmlrpc_server, "dir_land_query", function dir_land_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $flags = $req['flags']; @@ -205,6 +240,7 @@ function dir_land_query($method_name, $params, $app_data) $query_start = $req['query_start']; $terms = array(); + $sqldata = array(); if ($type != 4294967295) //Include all types of land? { @@ -231,9 +267,17 @@ function dir_land_query($method_name, $params, $app_data) $terms[] = $s; if ($flags & 0x100000) //LimitByPrice (1 << 20) - $terms[] = "saleprice <= '" . mysql_real_escape_string($price) . "'"; + { + $terms[] = "saleprice <= :price"; + + $sqldata['price'] = $price; + } if ($flags & 0x200000) //LimitByArea (1 << 21) - $terms[] = "area >= '" . mysql_real_escape_string($area) . "'"; + { + $terms[] = "area >= :area"; + + $sqldata['area'] = $area; + } //The PerMeterSort flag is always passed from a map item query. //It doesn't hurt to have this as the default search order. @@ -253,14 +297,17 @@ function dir_land_query($method_name, $params, $app_data) else $where = ""; - $sql = "SELECT *,saleprice/area AS lsq FROM parcelsales" . $where . - " ORDER BY " . $order . " LIMIT " . - mysql_real_escape_string($query_start) . ",101"; + //Prevent SQL injection by checking that $query_start is a number + if (!is_int($query_start)) + $query_start = 0; - $result = mysql_query($sql); + $sql = "SELECT *,saleprice/area AS lsq FROM parcelsales" . $where . + " ORDER BY " . $order . " LIMIT $query_start,101"; + $query = $db->prepare($sql); + $result = $query->execute($sqldata); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $data[] = array( "parcel_id" => $row["infoUUID"], @@ -290,6 +337,8 @@ xmlrpc_server_register_method($xmlrpc_server, "dir_events_query", function dir_events_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $text = $req['text']; @@ -318,6 +367,7 @@ function dir_events_query($method_name, $params, $app_data) $search_text = $pieces[2]; $terms = array(); + $sqldata = array(); //Event times are in UTC so we need to get the current time in UTC. $now = time(); @@ -344,7 +394,11 @@ function dir_events_query($method_name, $params, $app_data) } if ($category > 0) - $terms[] = "category = ".$category.""; + { + $terms[] = "category = :category"; + + $sqldata['category'] = $category; + } $type = array(); if ($flags & 16777216) //IncludePG (1 << 24) @@ -360,9 +414,12 @@ function dir_events_query($method_name, $params, $app_data) if ($search_text != "") { - $search_text = mysql_real_escape_string($search_text); - $terms[] = "(name LIKE '%$search_text%' OR " . - "description LIKE '%$search_text%')"; + $terms[] = "(name LIKE :text1 OR " . + "description LIKE :text2)"; + + $search_text = "%$search_text%"; + $sqldata['text1'] = $search_text; + $sqldata['text2'] = $search_text; } if (count($terms) > 0) @@ -370,14 +427,17 @@ function dir_events_query($method_name, $params, $app_data) else $where = ""; - $sql = "SELECT owneruuid,name,eventid,dateUTC,eventflags,globalPos FROM events". $where. - " LIMIT " . mysql_real_escape_string($query_start) . ",101"; + //Prevent SQL injection by checking that $query_start is a number + if (!is_int($query_start)) + $query_start = 0; - $result = mysql_query($sql); + $sql = "SELECT owneruuid,name,eventid,dateUTC,eventflags,globalPos" . + " FROM events". $where. " LIMIT $query_start,101"; + $query = $db->prepare($sql); + $result = $query->execute($sqldata); $data = array(); - - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $date = strftime("%m/%d %I:%M %p", $row["dateUTC"]); @@ -410,6 +470,8 @@ xmlrpc_server_register_method($xmlrpc_server, "dir_classified_query", function dir_classified_query ($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $text = $req['text']; @@ -430,6 +492,7 @@ function dir_classified_query ($method_name, $params, $app_data) } $terms = array(); + $sqldata = array(); //Renew Weekly flag is bit 5 (32) in $flags. $f = array(); @@ -446,11 +509,21 @@ function dir_classified_query ($method_name, $params, $app_data) //Only restrict results based on category if it is not 0 (Any Category) if ($category > 0) - $terms[] = "category = " . $category; + { + $terms[] = "category = :category"; + + $sqldata['category'] = $category; + } if ($text != "") - $terms[] = "(name LIKE '%$text%'" . - " OR description LIKE '%$text%')"; + { + $terms[] = "(name LIKE :text1" . + " OR description LIKE :text2)"; + + $text = "%$text%"; + $sqldata['text1'] = $text; + $sqldata['text2'] = $text; + } //Was there at least condition for the search? if (count($terms) > 0) @@ -458,14 +531,19 @@ function dir_classified_query ($method_name, $params, $app_data) else $where = ""; + //Prevent SQL injection by checking that $query_start is a number + if (!is_int($query_start)) + $query_start = 0; + $sql = "SELECT * FROM classifieds" . $where . " ORDER BY priceforlisting DESC" . - " LIMIT " . mysql_real_escape_string($query_start) . ",101"; + " LIMIT $query_start,101"; + $query = $db->prepare($sql); - $result = mysql_query($sql); + $result = $query->execute($sqldata); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $data[] = array( "classifiedid" => $row["classifieduuid"], @@ -493,17 +571,17 @@ xmlrpc_server_register_method($xmlrpc_server, "event_info_query", function event_info_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; $eventID = $req['eventID']; - $sql = "SELECT * FROM events WHERE eventID = " . - mysql_real_escape_string($eventID); - - $result = mysql_query($sql); + $query = $db->prepare("SELECT * FROM events WHERE eventID = ?"); + $result = $query->execute( array($eventID) ); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $date = strftime("%G-%m-%d %H:%M:%S", $row["dateUTC"]); @@ -553,17 +631,17 @@ xmlrpc_server_register_method($xmlrpc_server, "classifieds_info_query", function classifieds_info_query($method_name, $params, $app_data) { + global $db; + $req = $params[0]; - $classifiedID = $req['classifiedID']; + $classifiedID = $req['classifiedID']; - $sql = "SELECT * FROM classifieds WHERE classifieduuid = '" . - mysql_real_escape_string($classifiedID). "'"; - - $result = mysql_query($sql); + $query = $db->prepare("SELECT * FROM classifieds WHERE classifieduuid = ?"); + $result = $query->execute( array($classifiedID) ); $data = array(); - while (($row = mysql_fetch_assoc($result))) + while ($row = $query->fetch(PDO::FETCH_ASSOC)) { $data[] = array( "classifieduuid" => $row["classifieduuid"], @@ -599,4 +677,6 @@ $request_xml = file_get_contents("php://input"); xmlrpc_server_call_method($xmlrpc_server, $request_xml, ''); xmlrpc_server_destroy($xmlrpc_server); + +$db = NULL; ?> diff --git a/webroot/register.php b/webroot/register.php index e10b8bb..1844689 100644 --- a/webroot/register.php +++ b/webroot/register.php @@ -1,7 +1,6 @@ setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); +} +catch(PDOException $e) +{ + echo "Error connecting to database\n"; + file_put_contents('PDOErrors.txt', $e->getMessage() . "\n-----\n", FILE_APPEND); + exit; +} + +if ($service == "online") { // Check if there is already a database row for this host - $checkhost = mysql_query("SELECT register FROM hostsregister WHERE " . - "host = '" . mysql_real_escape_string($hostname) . "' AND " . - "port = '" . mysql_real_escape_string($port) . "'"); + $query = $db->prepare("SELECT register FROM hostsregister WHERE host = ? AND port = ?"); + $query->execute( array($hostname, $port) ); // Get the request time as a timestamp for later $timestamp = $_SERVER['REQUEST_TIME']; - // if greater than 1, check the nextcheck date - if (mysql_num_rows($checkhost) > 0) + // If a database row was returned check the nextcheck date + if ($query->rowCount() > 0) { - $update = "UPDATE hostsregister SET " . - "register = '" . mysql_real_escape_string($timestamp) . "', " . - "nextcheck = '0', checked = '0', " . - "failcounter = '0' " . - "WHERE host = '" . mysql_real_escape_string($hostname) . "' AND " . - "port = '" . mysql_real_escape_string($port) . "'"; - - $runupdate = mysql_query($update); + $query = $db->prepare("UPDATE hostsregister SET " . + "register = ?, " . + "nextcheck = 0, checked = 0, failcounter = 0 " . + "WHERE host = ? AND port = ?"); + $query->execute( array($timestamp, $hostname, $port) ); } else { - $register = "INSERT INTO hostsregister VALUES ". - "('" . mysql_real_escape_string($hostname) . "', " . - "'" . mysql_real_escape_string($port) . "', " . - "'" . mysql_real_escape_string($timestamp) . "', 0, 0, 0)"; - - $runupdate = mysql_query($register); + // The SELECT did not return a result. Insert a new record. + $query = $db->prepare("INSERT INTO hostsregister VALUES (?, ?, ?, 0, 0, 0)"); + $query->execute( array($hostname, $port, $timestamp) ); } } -elseif ($hostname != "" && $port != "" && $service = "offline") -{ - $delete = "DELETE FROM hostsregister " . - "WHERE host = '" . mysql_real_escape_string($hostname) . "' AND " . - "port = '" . mysql_real_escape_string($port) . "'"; - $rundelete = mysql_query($delete); +if ($service == "offline") +{ + $query = $db->prepare("DELETE FROM hostsregister WHERE host = ? AND port = ?"); + $query->execute( array($hostname, $port) ); } + +$db = NULL; ?>