Projekt

Allgemein

Profil

« Zurück | Weiter » 

Revision 08aa44f6

Von Sven Schöling vor mehr als 17 Jahren hinzugefügt

  • ID 08aa44f677181c9009e4d0bd02621e9703f60277
  • Vorgänger 04c85293
  • Nachfolger b8b43236

get_part - sql quoting

Unterschiede anzeigen:

SL/IC.pm
34 34

  
35 35
package IC;
36 36
use Data::Dumper;
37
use SL::DBUtils;
37 38

  
38 39
sub get_part {
39 40
  $main::lxdebug->enter_sub();
......
53 54
		 LEFT JOIN chart c2 ON (p.income_accno_id = c2.id)
54 55
		 LEFT JOIN chart c3 ON (p.expense_accno_id = c3.id)
55 56
		 LEFT JOIN partsgroup pg ON (p.partsgroup_id = pg.id)
56
                 WHERE p.id = $form->{id}|;
57
                 WHERE p.id = ? |;
58
  my @vars = ($form->{id});
57 59
  my $sth = $dbh->prepare($query);
58
  $sth->execute || $form->dberror($query);
60
  $sth->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
59 61
  my $ref = $sth->fetchrow_hashref(NAME_lc);
60 62

  
61 63
  # copy to $form variables
......
78 80
                FROM parts p
79 81
		JOIN assembly a ON (a.parts_id = p.id)
80 82
		LEFT JOIN partsgroup pg ON (p.partsgroup_id = pg.id)
81
		WHERE a.id = $form->{id}
82
		ORDER BY $oid{$myconfig->{dbdriver}}|;
83

  
83
		WHERE a.id = ?
84
		ORDER BY ?|;
85
    @vars = ($form->{id}, $oid{$myconfig->{dbdriver}});
84 86
    $sth = $dbh->prepare($query);
85
    $sth->execute || $form->dberror($query);
86

  
87
    $sth->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
88
    
87 89
    $form->{assembly_rows} = 0;
88 90
    while (my $ref = $sth->fetchrow_hashref(NAME_lc)) {
89 91
      $form->{assembly_rows}++;
......
105 107
  # get prices
106 108
  $query =
107 109
    qq|SELECT p.parts_id, p.pricegroup_id, p.price, (SELECT pg.pricegroup FROM pricegroup pg WHERE pg.id=p.pricegroup_id) AS pricegroup FROM prices p
108
              WHERE parts_id = $form->{id}
110
              WHERE parts_id = ? 
109 111
              ORDER by pricegroup|;
110 112

  
113
  @vars = ($form->{id});
111 114
  $sth = $dbh->prepare($query);
112
  $sth->execute || $form->dberror($query);
115
  $sth->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
113 116

  
114 117
  @pricegroups          = ();
115 118
  @pricegroups_not_used = ();
......
177 180
    # get makes
178 181
    if ($form->{makemodel}) {
179 182
      $query = qq|SELECT m.make, m.model FROM makemodel m
180
                  WHERE m.parts_id = $form->{id}|;
181

  
183
                  WHERE m.parts_id = ?|;
184
      @vars = ($form->{id});
182 185
      $sth = $dbh->prepare($query);
183
      $sth->execute || $form->dberror($query);
186
      $sth->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
184 187

  
185 188
      my $i = 1;
186 189
      while (($form->{"make_$i"}, $form->{"model_$i"}) = $sth->fetchrow_array)
......
195 198

  
196 199
  # get translations
197 200
  $form->{language_values} = "";
198
  $query = qq|SELECT language_id, translation FROM translation WHERE parts_id = $form->{id}|;
201
  $query = qq|SELECT language_id, translation FROM translation WHERE parts_id = ?|;
202
  @vars = ($form->{id});
199 203
  $trq = $dbh->prepare($query);
200
  $trq->execute || $form->dberror($query);
204
  $trq->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
201 205
  while ($tr = $trq->fetchrow_hashref(NAME_lc)) {
202 206
    $form->{language_values} .= "---+++---".$tr->{language_id}."--++--".$tr->{translation};
203 207
  }
......
1854 1858
    "WHERE t.id IN " .
1855 1859
    "  (SELECT tk.tax_id " .
1856 1860
    "   FROM taxkeys tk " .
1857
    "   WHERE tk.chart_id = $accno_id AND startdate <= $transdate " .
1861
    "   WHERE tk.chart_id = ? AND startdate <= " . quote_db_date($transdate) .
1858 1862
    "   ORDER BY startdate DESC LIMIT 1) ";
1863
  @vars = ($accno_id);
1859 1864
  $sth = $dbh->prepare($query);
1860
  $sth->execute() || $form->dberror($query);
1865
  $sth->execute(@vars) || $form->dberror("$query (" . join(', ', @vars) . ")");
1861 1866
  $ref = $sth->fetchrow_hashref();
1862 1867
  $sth->finish();
1863 1868
  $dbh->disconnect();

Auch abrufbar als: Unified diff