From ed0effc74a0e49f5a2b2b1742dbb197446e2e364 Mon Sep 17 00:00:00 2001
From: Armel Fauveau <armel.fauveau@globalis-ms.com>
Date: Wed, 1 Aug 2001 18:26:47 +0000
Subject: [PATCH] Update bookmark section

---
 lib.inc.php3 | 33 +++++++++++++++++++++++----------
 sql.php3     |  2 +-
 2 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/lib.inc.php3 b/lib.inc.php3
index ca3b4bcea..4efe08527 100755
--- a/lib.inc.php3
+++ b/lib.inc.php3
@@ -1580,8 +1580,9 @@ var errorMsg2 = '<?php echo(str_replace('\'', '\\\'', $GLOBALS['strNotValidNumbe
     	global $dbh;
     	
         $query ='SELECT label, id FROM '.backquote($cfgBookmark['db']).'.'.backquote($cfgBookmark['table'])
-               .' WHERE dbase=\'' . str_replace('\'', '\\\'', $db) . '\''.' AND user=\''.backquote($cfgBookmark['user']).'\'';
-                       
+			.' WHERE dbase=\'' . str_replace('\'', '\\\'', $db) . '\''
+			.' AND user = \'' . str_replace('\'', '\\\'', $cfgBookmark['user']) . '\'';
+
         if(isset($dbh))
             $result=mysql_query($query,$dbh);
         else
@@ -1621,13 +1622,19 @@ var errorMsg2 = '<?php echo(str_replace('\'', '\\\'', $GLOBALS['strNotValidNumbe
         global $dbh;
         
         $query ='SELECT query FROM '.backquote($cfgBookmark['db']).'.'.backquote($cfgBookmark['table'])
-	       .' WHERE dbase=\'' . str_replace('\'', '\\\'', $db) . '\''.' AND id = ' . $id .' AND user=\''.backquote($cfgBookmark['user']).'\'';
-
+			.' WHERE dbase=\'' . str_replace('\'', '\\\'', $db) . '\''
+			.' AND user = \'' . str_replace('\'', '\\\'', $cfgBookmark['user']) . '\''
+			.' AND id = '.$id;
+		   
         if(isset($dbh))
 	    	$result=mysql_query($query,$dbh);
-	else
+		else
 	        $result=mysql_query($query);
-	$bookmark_query=mysql_result($result,0,"query");
+		
+		$bookmark_query=mysql_result($result,0,"query");
+		$bookmark_query=urldecode($bookmark_query);
+		$bookmark_query=str_replace('\'', '\\\'', $bookmark_query);
+
     	return $bookmark_query;
     } // end of the 'query_bookmarks()' function
     
@@ -1644,9 +1651,14 @@ var errorMsg2 = '<?php echo(str_replace('\'', '\\\'', $GLOBALS['strNotValidNumbe
     function add_bookmarks($fields, $cfgBookmark)
     {
      	global $dbh;
-     	
+   
      	$query ='INSERT INTO '.backquote($cfgBookmark['db']).'.'.backquote($cfgBookmark['table'])
-	       .' (id, dbase, user, query, label) VALUES (\'\',\''.backquote($fields['dbase']).'\',\''.backquote($fields['user']).'\',\''.backquote($fields['query']).'\',\''.backquote($fields['label']).'\')';
+			.' (id, dbase, user, query, label) VALUES ('
+			.' \'\','
+			.' \''.str_replace('\'', '\\\'', $fields['dbase']).'\','
+			.' \''.str_replace('\'', '\\\'', $fields['user']).'\','
+			.' \''.str_replace('\'', '\\\'', $fields['query']).'\','
+			.' \''.str_replace('\'', '\\\'', $fields['label']).'\' )';
 
        	if(isset($dbh))
     		$result=mysql_query($query,$dbh);
@@ -1669,8 +1681,9 @@ var errorMsg2 = '<?php echo(str_replace('\'', '\\\'', $GLOBALS['strNotValidNumbe
     	global $dbh;
     	
     	$query ='DELETE FROM '.backquote($cfgBookmark['db']).'.'.backquote($cfgBookmark['table'])
-    	       .' WHERE id = ' . $id .' AND user=\''.backquote($cfgBookmark['user']).'\'';
-
+    	       .' WHERE user = \'' . str_replace('\'', '\\\'', $cfgBookmark['user']) . '\''
+			   .' AND id = '.$id;
+                
         if(isset($dbh))
         	$result=mysql_query($query,$dbh);
         else
diff --git a/sql.php3 b/sql.php3
index e89ebd8bc..a5809d747 100755
--- a/sql.php3
+++ b/sql.php3
@@ -230,7 +230,7 @@ else {
     <input type="hidden" name="bookmarkthis" value="true" />
     <input type="hidden" name="fields[dbase]" value="<?php echo $db;?>" />
     <input type="hidden" name="fields[user]" value="<?php echo $cfgBookmark['user'];?>" />
-    <input type="hidden" name="fields[query]" value="<?php echo isset($sql_query) ? $sql_query : "";?>" />
+    <input type="hidden" name="fields[query]" value="<?php echo isset($sql_query) ? urlencode($sql_query)  : "";?>" />
     <input type="text"   name="fields[label]" value="">
     <input type="submit" name="store_bkm" value="<?php echo $strBookmarkThis; ?>" />
 </form>