adoralaura/shopping-list
1
0
Fork 0
mirror of https://github.com/tim-krehan/shopping-list.git synced 2024-11-23 22:30:41 +01:00
Code Issues Projects Releases Packages Wiki Activity

sql sanitizing

Browse source
This commit is contained in:
Tim Krehan 2019-05-22 10:16:13 +02:00
parent 04c9776a65
commit 543b9aafef
5 changed files with 92 additions and 2013 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
cont/recipe.php
View file

@ -1,7 +1,6 @@
<script src="/bin/recipe.js" charset="utf-8"></script> <script src="/bin/recipe.js" charset="utf-8"></script>
<?php <?php
include $_SESSION["docroot"].'/php/classes.recipe.php'; include $_SESSION["docroot"].'/php/classes.recipe.php';
include $_SESSION["docroot"].'/php/classes.parsedown.php';
$book = new cookbook; $book = new cookbook;
$book->getRecipe($_GET["number"]); $book->getRecipe($_GET["number"]);
$recipe = $book->sites[0]; $recipe = $book->sites[0];

5
php/auth.php
View file

@ -13,7 +13,10 @@
$token = "-1"; $token = "-1";
} }
$result = $mysqli->query('SELECT * FROM `sessions` WHERE `session_id` = \''.$token.'\';'); $selectQuery = $mysqli->prepare('SELECT * FROM `sessions` WHERE `session_id` = ?;');
$selectQuery->bind_param("s", $token);
$selectQuery->execute();
$result = $selectQuery->get_result();
if(($result->num_rows) == 0 && (!(in_array("site", array_keys($_GET))) || $_GET["site"]!="login")) if(($result->num_rows) == 0 && (!(in_array("site", array_keys($_GET))) || $_GET["site"]!="login"))
{ {

18
php/classes.list.php
View file

@ -19,7 +19,7 @@
function shopping(){ function shopping(){
include $_SESSION["docroot"].'/config/config.php'; include $_SESSION["docroot"].'/config/config.php';
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$result = $mysqli->query("SELECT * FROM `ViewEinkauf` ORDER BY `ViewEinkauf`.`Name` ASC"); $result = $mysqli->query("SELECT * FROM `ViewEinkauf` ORDER BY `ViewEinkauf`.`Name` ASC;");
while($item = $result->fetch_assoc()){ while($item = $result->fetch_assoc()){
$this->addItem($item["ID"], $item["Anzahl"], $item["Einheit"], $item["Name"], $item["Erledigt"]); $this->addItem($item["ID"], $item["Anzahl"], $item["Einheit"], $item["Name"], $item["Erledigt"]);
} }
@ -30,15 +30,15 @@
include $_SESSION["docroot"].'/config/config.php'; include $_SESSION["docroot"].'/config/config.php';
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
if(!is_int($einheit)){ if(!is_int($einheit)){
$unit_query = $mysqli->prepare("SELECT * FROM `Einheit` WHERE `Name` = ?"); $selectQuery = $mysqli->prepare("SELECT * FROM `Einheit` WHERE `Name` = ?;");
$unit_query->bind_param("s", $einheit); $selectQuery->bind_param("s", $einheit);
$unit_query->execute(); $selectQuery->execute();
$result = $unit_query->get_result(); $result = $selectQuery->get_result();
while($row = $result->fetch_assoc()){ while($row = $result->fetch_assoc()){
$einheit = $row["ID"]; $einheit = $row["ID"];
} }
} }
$insertQuery = $mysqli->prepare("INSERT INTO `Einkauf` (`Anzahl`, `Einheit`, `Name`, `Erledigt`) VALUES (?, ?, ?, 0)"); $insertQuery = $mysqli->prepare("INSERT INTO `Einkauf` (`Anzahl`, `Einheit`, `Name`, `Erledigt`) VALUES (?, ?, ?, 0);");
$insertQuery->bind_param("sss", $anzahl, $einheit, $name); $insertQuery->bind_param("sss", $anzahl, $einheit, $name);
$result = $insertQuery->execute(); $result = $insertQuery->execute();
$mysqli->close(); $mysqli->close();
@ -53,14 +53,14 @@
function removeChecked(){ function removeChecked(){
include $_SESSION["docroot"].'/config/config.php'; include $_SESSION["docroot"].'/config/config.php';
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$mysqli->query("DELETE FROM `Einkauf` WHERE `Erledigt`=1"); $mysqli->query("DELETE FROM `Einkauf` WHERE `Erledigt`=1;");
$mysqli->close(); $mysqli->close();
} }
function check($id, $status){ function check($id, $status){
include $_SESSION["docroot"].'/config/config.php'; include $_SESSION["docroot"].'/config/config.php';
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$updateQuery = $mysqli->prepare("UPDATE `Einkauf` SET `Erledigt` = $status WHERE `Einkauf`.`ID` = ?"); $updateQuery = $mysqli->prepare("UPDATE `Einkauf` SET `Erledigt` = $status WHERE `Einkauf`.`ID` = ?;");
$updateQuery->bind_param("s", $id); $updateQuery->bind_param("s", $id);
$updateQuery->execute(); $updateQuery->execute();
$mysqli->close(); $mysqli->close();
@ -94,7 +94,7 @@
function units(){ function units(){
include $_SESSION["docroot"].'/config/config.php'; include $_SESSION["docroot"].'/config/config.php';
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$result = $mysqli->query("SELECT * FROM `Einheit`"); $result = $mysqli->query("SELECT * FROM `Einheit`;");
while($item = $result->fetch_assoc()){ while($item = $result->fetch_assoc()){
$this->addItem($item["ID"], $item["Name"], $item["Standard"]); $this->addItem($item["ID"], $item["Name"], $item["Standard"]);
} }

1980
php/classes.parsedown.php
View file

File diff suppressed because it is too large Load diff

101
php/classes.recipe.php
View file

@ -14,7 +14,7 @@
} }
function unitList(){ function unitList(){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$result = $mysqli->query("SELECT * FROM `Einheit`"); $result = $mysqli->query("SELECT * FROM `Einheit`;");
while($item = $result->fetch_assoc()){ while($item = $result->fetch_assoc()){
$this->addItem($item["ID"], $item["Name"], $item["Standard"]); $this->addItem($item["ID"], $item["Name"], $item["Standard"]);
} }
@ -22,7 +22,10 @@
} }
function getID($Name){ function getID($Name){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$result = $mysqli->query("SELECT `ID` FROM `Einheit` WHERE `Name` = '$Name'"); $selectQuery = $mysqli->prepare("SELECT `ID` FROM `Einheit` WHERE `Name` = ?;");
$selectQuery->bind_param("s", "$Name");
$selectQuery->execute();
$result = $selectQuery->get_result();
$ID = $result->fetch_assoc(); $ID = $result->fetch_assoc();
return $ID["ID"]; return $ID["ID"];
} }
@ -57,16 +60,28 @@
public $sites = array(); public $sites = array();
function getRecipe($ID){ function getRecipe($ID){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$recipes = $mysqli->query("SELECT * FROM `Rezept` WHERE `ID` = $ID ORDER BY Name ASC"); $selectQuery = $mysqli->prepare("SELECT * FROM `Rezept` WHERE `ID` = ? ORDER BY Name ASC;");
$selectQuery->bind_param("s", $ID);
$selectQuery->execute();
$recipes = $selectQuery->get_result();
while($recipe = $recipes->fetch_assoc()){ while($recipe = $recipes->fetch_assoc()){
$current = new recipe($RID = $recipe["ID"], $RName = $recipe["Name"], $RDuration = $recipe["Dauer"], $RDescription = $recipe["Beschreibung"]); $current = new recipe($RID = $recipe["ID"], $RName = $recipe["Name"], $RDuration = $recipe["Dauer"], $RDescription = $recipe["Beschreibung"]);
$recepieIngredients = $mysqli->query("SELECT * FROM `RezeptZutat` WHERE `Rezept` = $RID"); $selectIngredientsQuery = $mysqli->prepare("SELECT * FROM `RezeptZutat` WHERE `Rezept` = ?;");
$selectIngredientsQuery->bind_param("s", $RID);
$selectIngredientsQuery->execute();
$recepieIngredients = $selectIngredientsQuery->get_result();
while($recepieIngredient = $recepieIngredients->fetch_assoc()){ while($recepieIngredient = $recepieIngredients->fetch_assoc()){
$IID = $recepieIngredient["Zutat"]; $IID = $recepieIngredient["Zutat"];
$IAmount = $recepieIngredient["Menge"]; $IAmount = $recepieIngredient["Menge"];
$units = $mysqli->query("SELECT `Name` FROM `Einheit` WHERE `ID` = ".$recepieIngredient["Einheit"]); $selectUnitQuery = $mysqli->prepare("SELECT `Name` FROM `Einheit` WHERE `ID` = ?;");
$selectUnitQuery->bind_param("s", $recepieIngredient["Einheit"]);
$selectUnitQuery->execute();
$units = $selectUnitQuery->get_result();
while($unit = $units->fetch_assoc()){$IUnit = $unit["Name"];} while($unit = $units->fetch_assoc()){$IUnit = $unit["Name"];}
$names = $mysqli->query("SELECT `Name` FROM `Zutat` WHERE `ID` = ".$recepieIngredient["Zutat"]); $selectNamesQuery = $mysqli->prepare("SELECT `Name` FROM `Zutat` WHERE `ID` = ?;");
$selectNamesQuery->bind_param("s", $recepieIngredient["Zutat"]);
$selectNamesQuery->execute();
$names = $selectNamesQuery->get_result();
while($name = $names->fetch_assoc()){$IName = $name["Name"];} while($name = $names->fetch_assoc()){$IName = $name["Name"];}
$current->addIngredient($IID, $IAmount, $IUnit, $IName); $current->addIngredient($IID, $IAmount, $IUnit, $IName);
} }
@ -80,13 +95,22 @@
$recipes = $mysqli->query("SELECT * FROM `Rezept` ORDER BY Name ASC"); $recipes = $mysqli->query("SELECT * FROM `Rezept` ORDER BY Name ASC");
while($recipe = $recipes->fetch_assoc()){ while($recipe = $recipes->fetch_assoc()){
$current = new recipe($RID = $recipe["ID"], $RName = $recipe["Name"], $RDuration = $recipe["Dauer"], $RDescription = $recipe["Beschreibung"]); $current = new recipe($RID = $recipe["ID"], $RName = $recipe["Name"], $RDuration = $recipe["Dauer"], $RDescription = $recipe["Beschreibung"]);
$recepieIngredients = $mysqli->query("SELECT * FROM `RezeptZutat` WHERE `Rezept` = $RID"); $selectIngredientsQuery = $mysqli->prepare("SELECT * FROM `RezeptZutat` WHERE `Rezept` = ?;");
$selectIngredientsQuery->bind_param("s", $RID);
$selectIngredientsQuery->execute();
$recepieIngredients = $selectIngredientsQuery->get_result();
while($recepieIngredient = $recepieIngredients->fetch_assoc()){ while($recepieIngredient = $recepieIngredients->fetch_assoc()){
$IID = $recepieIngredient["Zutat"]; $IID = $recepieIngredient["Zutat"];
$IAmount = $recepieIngredient["Menge"]; $IAmount = $recepieIngredient["Menge"];
$units = $mysqli->query("SELECT `Name` FROM `Einheit` WHERE `ID` = ".$recepieIngredient["Einheit"]); $selectUnitQuery = $mysqli->prepare("SELECT `Name` FROM `Einheit` WHERE `ID` = ?;");
$selectUnitQuery->bind_param("s", $recepieIngredient["Einheit"]);
$selectUnitQuery->execute();
$units = $selectUnitQuery->get_result();
while($unit = $units->fetch_assoc()){$IUnit = $unit["Name"];} while($unit = $units->fetch_assoc()){$IUnit = $unit["Name"];}
$names = $mysqli->query("SELECT `Name` FROM `Zutat` WHERE `ID` = ".$recepieIngredient["Zutat"]); $selectNamesQuery = $mysqli->prepare("SELECT `Name` FROM `Zutat` WHERE `ID` = ?;");
$selectNamesQuery->bind_param("s", $recepieIngredient["Zutat"]);
$selectNamesQuery->execute();
$names = $selectNamesQuery->get_result();
while($name = $names->fetch_assoc()){$IName = $name["Name"];} while($name = $names->fetch_assoc()){$IName = $name["Name"];}
$current->addIngredient($IID, $IAmount, $IUnit, $IName); $current->addIngredient($IID, $IAmount, $IUnit, $IName);
} }
@ -103,7 +127,10 @@
$import = json_decode($_POST["content"]); $import = json_decode($_POST["content"]);
if($import->sites!=null){ if($import->sites!=null){
foreach ($import->sites as $site) { foreach ($import->sites as $site) {
$result = $mysqli->query("SELECT * FROM `Rezept` WHERE `Name`='$site->Name'"); $selectQuery = $mysqli->prepare("SELECT * FROM `Rezept` WHERE `Name`=?;");
$selectQuery->bind_param("s", $site->Name);
$selectQuery->execute();
$result = $selectQuery->get_result();
if($result->num_rows>0){ if($result->num_rows>0){
array_push($failed_sites, $site); array_push($failed_sites, $site);
} }
@ -132,53 +159,83 @@
function newRecipe($Name, $Dauer, $Beschreibung, $Zutaten){ function newRecipe($Name, $Dauer, $Beschreibung, $Zutaten){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$mysqli->query("INSERT INTO `Rezept` (`Name`, `Dauer`, `Beschreibung`) VALUES ('$Name', '$Dauer', '$Beschreibung')"); $insertQuery = $mysqli->prepare("INSERT INTO `Rezept` (`Name`, `Dauer`, `Beschreibung`) VALUES (?, ?, ?);");
$insertQuery->bind_param("sss", $Name, $Dauer, $Beschreibung);
$insertQuery->execute();
$RezeptID = $mysqli->insert_id; $RezeptID = $mysqli->insert_id;
foreach ($Zutaten as $Zutat) { foreach ($Zutaten as $Zutat) {
$ZutatID = null; $ZutatID = null;
$result = $mysqli->query("SELECT ID FROM `Zutat` WHERE `Name` LIKE '".$Zutat["Name"]."'"); $selectIngredientsQuery = $mysqli->prepare("SELECT ID FROM `Zutat` WHERE `Name` LIKE ?;");
$selectIngredientsQuery->bind_param("s", $Zutat["Name"]);
$selectIngredientsQuery->execute();
$result = $selectIngredientsQuery->get_result();
if($result->num_rows>0){ if($result->num_rows>0){
$item = $result->fetch_assoc(); $item = $result->fetch_assoc();
$ZutatID = $item["ID"]; $ZutatID = $item["ID"];
} }
else{ else{
$mysqli->query("INSERT INTO `Zutat` (`Name`) VALUES ('".ucwords($Zutat["Name"])."')"); $UppercaseName = ucwords($Zutat["Name"]);
$insertIngredientsQuery = $mysqli->prepare("INSERT INTO `Zutat` (`Name`) VALUES (?);");
$insertIngredientsQuery->bind_param("s", $UppercaseName);
$insertIngredientsQuery->execute();
$ZutatID = $mysqli->insert_id; $ZutatID = $mysqli->insert_id;
} }
$mysqli->query("INSERT INTO `RezeptZutat` (`Rezept`,`Menge`,`Einheit`,`Zutat`) VALUES ('{$RezeptID}','{$Zutat["Amount"]}','{$Zutat["Unit"]}','{$ZutatID}');"); $inserRecipeQuery = $mysqli->prepare("INSERT INTO `RezeptZutat` (`Rezept`,`Menge`,`Einheit`,`Zutat`) VALUES (?,?,?,?);");
$inserRecipeQuery->bind_param("ssss", $RezeptID, $Zutat["Amount"], $Zutat["Unit"], $ZutatID);
$inserRecipeQuery->execute();
} }
$mysqli->close(); $mysqli->close();
} }
function updateRecipe($ID, $Name, $Dauer, $Beschreibung, $Zutaten){ function updateRecipe($ID, $Name, $Dauer, $Beschreibung, $Zutaten){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$mysqli->query("UPDATE `Rezept` SET `Name` = '$Name', `Dauer` = '$Dauer', `Beschreibung` = '$Beschreibung' WHERE `Rezept`.`ID` = $ID;"); $updateQuery = $mysqli->prepare("UPDATE `Rezept` SET `Name` = ?, `Dauer` = ?, `Beschreibung` = ? WHERE `Rezept`.`ID` = ?;");
$mysqli->query("DELETE FROM RezeptZutat WHERE Rezept = $ID"); $updateQuery->bind_param("ssss", $Name, $Dauer, $Beschreibung, $ID);
$updateQuery->execute();
$deleteQuery = $mysqli->prepare("DELETE FROM RezeptZutat WHERE Rezept = ?;");
$deleteQuery->bind_param("s", $ID);
$deleteQuery->execute();
foreach ($Zutaten as $Zutat) { foreach ($Zutaten as $Zutat) {
$ZutatID = null; $ZutatID = null;
$result = $mysqli->query("SELECT ID FROM `Zutat` WHERE `Name` LIKE '".$Zutat["Name"]."'"); $selectIngredientsQuery = $mysqli->prepare("SELECT ID FROM `Zutat` WHERE `Name` LIKE ?;");
$selectIngredientsQuery->bind_param("s", $Zutat["Name"]);
$selectIngredientsQuery->execute();
$result = $selectIngredientsQuery->get_result();
if($result->num_rows>0){ if($result->num_rows>0){
while($item = $result->fetch_assoc()){ $ZutatID = $item["ID"];} while($item = $result->fetch_assoc()){ $ZutatID = $item["ID"];}
} }
else{ else{
$mysqli->query("INSERT INTO `Zutat` (`Name`) VALUES ('".ucwords($Zutat["Name"])."')"); $uppercaseName = ucwords($Zutat["Name"]);
$insertIngredientsQuery = $mysqli->prepare("INSERT INTO `Zutat` (`Name`) VALUES (?);");
$insertIngredientsQuery->bind_param("s", $uppercaseName);
$insertIngredientsQuery->execute();
$ZutatID = $mysqli->insert_id; $ZutatID = $mysqli->insert_id;
} }
$mysqli->query("INSERT INTO `RezeptZutat` (`Rezept`,`Menge`,`Einheit`,`Zutat`) VALUES ('{$ID}','{$Zutat["Amount"]}','{$Zutat["Unit"]}','{$ZutatID}');"); $insertRecipeIngredientsQuery = $mysqli->prepare("INSERT INTO `RezeptZutat` (`Rezept`,`Menge`,`Einheit`,`Zutat`) VALUES (?,?,?,?);");
$insertRecipeIngredientsQuery->bind_param("ssss", $ID, $Zutat["Amount"], $Zutat["Unit"], $ZutatID);
$insertRecipeIngredientsQuery->execute();
} }
} }
function removeRecipe($ID){ function removeRecipe($ID){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$mysqli->query("DELETE FROM `RezeptZutat` WHERE `Rezept`=$ID"); $deleteQuery = $mysqli->prepare("DELETE FROM `RezeptZutat` WHERE `Rezept`=?;");
$mysqli->query("DELETE FROM Rezept WHERE ID=$ID"); $deleteQuery->bind_param("s", $ID);
$deleteQuery->execute();
$deleteQuery = $mysqli->prepare("DELETE FROM Rezept WHERE ID=?;");
$deleteQuery->bind_param("s", $ID);
$deleteQuery->execute();
$mysqli->close(); $mysqli->close();
} }
function getAllIngredientsContaining($q){ function getAllIngredientsContaining($q){
include $_SESSION["docroot"].'/php/connect.php'; include $_SESSION["docroot"].'/php/connect.php';
$values = array(); $values = array();
$result = $mysqli->query("SELECT Name FROM Zutat WHERE Name LIKE '%$q%' ORDER BY Name ASC"); $filterValue = "%$q%";
$selectQuery = $mysqli->prepare("SELECT Name FROM Zutat WHERE Name LIKE ? ORDER BY Name ASC");
$selectQuery->bind_param("s", $filterValue);
$selectQuery->execute();
$result = $selectQuery->get_result();
while($item = $result->fetch_assoc()){ while($item = $result->fetch_assoc()){
array_push($values, $item["Name"]); array_push($values, $item["Name"]);
} }