WebSVN – computer_asset_manager_v1 – Diff – /modules/license/functions.php

  * Othewise, Adds key and assigns to machine
  * returns "Added"
  * NOTE: $device_id may be null which indicates license owned by client but unassigned
  */
 function updateLicense ( $client_id, $device_id, $license_product_id, $license ) {
-   /*$client_id = makeSafeSQLValue( $client_id );
+   $client_id = makeSafeSQLConstant( $client_id, 'I' );
-   $device_id = makeSafeSQLValue( $device_id );
+   $device_id = makeSafeSQLConstant( $device_id, 'I', 'null' );
-   $license_product_id = makeSafeSQLValue( $license_product_id );
+   $license_product_id = makeSafeSQLConstant( $license_product_id, 'I' );
-   $license = makeSafeSQLValue( $license );
+   $license = makeSafeSQLConstant( $license );
-    */
    // see if the entry already exists
-   $results = queryDatabaseExtended( "select * from license where license_product_id = $license_product_id and license = '$license' and removed_date is null" );
+   $results = queryDatabaseExtended( "select * from license where license_product_id = $license_product_id and license = $license and removed_date is null" );
    //print "<pre>"; print_r( $results ); print "</pre>"; die;
    $db_license_id = $results['data'][0]['license_id'];
    $db_client_id = $results['data'][0]['client_id'];
-   $db_device_id = $results['data'][0]['device_id'];
+   $db_device_id = $results['data'][0]['device_id'] ? $results['data'][0]['device_id'] : 'null';
-   // SQL does not understand an empty string, so we replace it with the keyword null for queries
-   $queryDeviceID = $device_id ? $device_id : 'null';
    if ( ! $results ) { # this was not found, so just add it
-      doSQL( "insert into license (client_id,device_id,license_product_id,license, added_date, removed_date) values ( $client_id, $queryDeviceID, $license_product_id, '$license', $now(), null )" );
+      doSQL( "insert into license (client_id,device_id,license_product_id,license, added_date, removed_date) values ( $client_id, $device_id, $license_product_id, $license, now(), null )" );
       return "Added";
+   }
    if ( $client_id == $db_client_id && $device_id == $db_device_id or $db_device_id  ) { // already done, so just leave alone
       return "Already Set";
+   }
       doSQL( "update license set device_id = $queryDeviceID,added_date = now() where license_id = $db_license_id" );
       return "Assigned";
+   }
    // at this point, there is already an entry, but it is for a different machine, so we need to update it, ie remove the old, add the new
    doSQL( "update license set removed_date = now() where license_id = $db_license_id" );
-   doSQL( "insert into license (client_id,device_id,license_product_id,license, added_date, removed_date) values ( $client_id, $queryDeviceID, $license_product_id, '$license', $added_date, $removed_date )" );
+   doSQL( "insert into license (client_id,device_id,license_product_id,license, added_date, removed_date) values ( $client_id, $device_id, $license_product_id, $license, $added_date, $removed_date )" );
    return "Reassigned";
+}
 /*
  * Simply overwrites a license record. Only used for the edit.html page
  */
 function overwriteLicense ( $license_id,$client_id, $device_id, $license_product_id, $license, $added_date, $removed_date ) {
    $added_date = makeSafeSQLConstant( $added_date, 'D', 'now()' );
    $removed_date = makeSafeSQLConstant( $removed_date, 'D', 'null' );
+   $license = makeSafeSQLConstant( $license );
    $device_id = $device_id == '-1' ? 'null' : makeSafeSQLConstant( $device_id, 'I', 'null' );
+   print "Added: $added_date<br>Removed: $removed_date<br>license: $license<br>Device: $device_id<br>";
+   if ( $license_id == 'null' ) {
+      queryDatabaseExtended(
+         "insert into license (client_id,device_id,license_product_id,license,added_date,removed_date)
+          values ( $client_id, $device_id, $license_product_id, $license, $added_date, $removed_date )" );
+   } else {
-   doSQL( "update license set
+      doSQL( "update license set
-               client_id=$client_id,
+                  client_id=$client_id,
-               device_id=$device_id,
+                  device_id=$device_id,
-               license_product_id=$license_product_id,
+                  license_product_id=$license_product_id,
-               license='$license',
+                  license=$license,
-               added_date=$added_date,
+                  added_date=$added_date,
-               removed_date=$removed_date
+                  removed_date=$removed_date
-            where license_id=$license_id");
+               where license_id=$license_id");
+   }
 } // overwriteLicense
 /*
  * function will attempt to make a constant ($value) safe for SQL depending on the type.
  *    $falsetrue, with the first char denoting false and the second denoting true
  */
 function makeSafeSQLConstant ( $value, $type='S', $default='null', $falsetrue='10' ) {
    if (strlen($value) == 0) // simply set any empty values to null
       return $default;
-   if ( get_magic_quotes_gpc() )
-      $value = stripslashes($value);
-   $value = mysql_real_escape_string( $value );
+   // print "Processing $value as $type with default $default<br>\n";
    switch ( strtolower( $type ) ) {
       case 'string' :
+      case 's' :
+               if ( get_magic_quotes_gpc() )
+                  $value = stripslashes($value);
+               $value = mysql_real_escape_string( $value );
-      case 's' : $value = strlen( $value ) > 0 ? "'$value'" : $default;
+               $value = strlen( $value ) > 0 ? "'$value'" : $default;
-                 break;
+               break;
       case 'date' :
-      case 'd' : if ( $result = strtotime( $value ) ) {
+      case 'd' :
-                    $value = Date( 'Y-m-d', $result);
+               if ( $value != 'null' ) {
-                 } else {
+                  $result = strtotime( $value );
-                     $value = $default;
+                  $value = ( $result === false ) ? $default : "'" . Date( 'Y-m-d', $result) . "'";
-                 }
+               }
-                 if ( $value != $default ) $value = "'$value'";
-                 break;
+               break;
       case 'datetime':
       case 'timestamp':
-      case 'dt': if ( $result = strtotime( $value ) ) {
+      case 'dt':
-                     $value = Date( 'Y-m-d H:i:s', $result);
+               if ( $value != 'null' ) {
-                  } else {
+                  $result = strtotime( $value );
-                     $value = $default;
+                  $value = ( $result === false ) ? $default : "'" . Date( 'Y-m-d H:i:s', $result) . "'";
-                  }
+               }
-                  if ( $value != $default ) $value = "'$value'";
-                  break;
+               break;
       case 'integer':
+      case 'i' :
-      case 'i' :  $value = intval( $value );
+               $value = intval( $value );
-                  break;
+               break;
       case 'float':
+      case 'f' :
-      case 'f' :  $value = floatval( $value );
+               $value = floatval( $value );
-                  break;
+               break;
       case 'bool':
       case 'boolean':
       case 'b' :  // note, because of the way strpos works, you can not
                   // simply set $value based on the output; you MUST do
                   // as below; specifically check for false, then set the result
  * returns $column from the result (or '' if it does not exist)
  * Used mainly to get an index from a table with matching value
  */
 function getValue ( $table, $column, $match, $value, $add = false ) {
-   $value = makeSafeSQLValue( $value );
+   $value = makeSafeSQLConstant( $value );
    $return = getOneDBValue( "select $column from $table where $match = $value" );
    if ( $return === null ) {
       if ( $add ) {
          $return = doSQL( "insert into $table ( $match ) values ( $value )" );
          return $return['insert_id'];
    } // if
    return $return;
 } // function getValue
 function getDescription( $license_id ) {
-   //$license_id = makeSafeSQLValue( $license_id );
+   $license_id = makeSafeSQLConstant( $license_id, 'I' );
    $result = queryDatabaseExtended(
            "select
                license_product.name 'Product',
                license.license 'License',
                device.name 'Machine',
  * by setting removed_date in the origin, then duplicating that record
  * to a new one
  */
 function moveLicense( $license_id, $machine_id = '' ) {
-   $machine_id = makeSafeSQLValue( $machine_id );
+   $machine_id = makeSafeSQLConstant( $machine_id, 'I' );
-   //$license_id = makeSafeSQLValue( $license_id );
+   $license_id = makeSafeSQLConstant( $license_id, 'I' );
    doSQL(
       "insert into license
          ( client_id, device_id,license,license_product_id,added_date,removed_date )
          select client_id, $machine_id,license,license_product_id,now(),null
          from license

Subversion Repositories computer_asset_manager_v1

(root)/modules/license/functions.php – Rev 47 → 51