diff --git a/lib/classes/Database.php b/lib/classes/Database.php index 8c1f6e36c..426a3ea16 100644 --- a/lib/classes/Database.php +++ b/lib/classes/Database.php @@ -339,7 +339,7 @@ class Database extends Util\Singleton { $char = '`'; - return $char.str_replace($char, '', $string).$char; + return $char.str_replace([$char, '#'], '', $string).$char; } /** @@ -372,7 +372,7 @@ class Database extends Util\Singleton $inserts = []; foreach ($array as $values) { foreach ($values as $key => $value) { - $values[$key] = $this->getValue($value); + $values[$key] = $this->prepareValue($key, $value); } $inserts[] = '('.implode(array_values($values), ', ').')'; @@ -407,12 +407,12 @@ class Database extends Util\Singleton $update = []; foreach ($array as $key => $value) { - $update[] = $this->quote($key).' = '.$this->getValue($value); + $update[] = $this->quote($key).' = '.$this->prepareValue($key, $value); } $where = []; foreach ($conditions as $key => $value) { - $where[] = $this->quote($key).' = '.$this->getValue($value); + $where[] = $this->quote($key).' = '.$this->prepareValue($key, $value); } $query = 'UPDATE '.$this->quote($table).' SET '.implode($update, ', ').' WHERE '.implode($where, ' AND '); @@ -568,15 +568,15 @@ class Database extends Util\Singleton * * @return string */ - protected function getValue($value) + protected function prepareValue($field, $value) { $value = (is_null($value)) ? 'NULL' : $value; $value = is_bool($value) ? intval($value) : $value; - if (starts_with($value, '#') && ends_with($value, '#')) { - $value = substr($value, 1, -1); - } elseif ($value != 'NULL') { - $value = $this->prepare($value); + if (!starts_with($field, '#')) { + if ($value != 'NULL') { + $value = $this->prepare($value); + } } return $value; @@ -606,12 +606,12 @@ class Database extends Util\Singleton } elseif (starts_with($value, '#') && ends_with($value, '#')) { $result[] = substr($value, 1, -1); } elseif (starts_with($value, '%') || ends_with($value, '%')) { - $result[] = $this->quote($key).' LIKE '.$this->getValue($value); + $result[] = $this->quote($key).' LIKE '.$this->prepareValue($key, $value); } elseif (str_contains($value, '|')) { $pieces = explode('|', $value); - $result[] = $this->quote($key).' BETWEEN '.$this->getValue($pieces[0]).' AND '.$this->getValue($pieces[1]); + $result[] = $this->quote($key).' BETWEEN '.$this->prepareValue($key, $pieces[0]).' AND '.$this->prepareValue($key, $pieces[1]); } else { - $result[] = $this->quote($key).' = '.$this->getValue($value); + $result[] = $this->quote($key).' = '.$this->prepareValue($key, $value); } } } else { diff --git a/modules/articoli/modutil.php b/modules/articoli/modutil.php index ec9ed76b3..cbb4677a5 100644 --- a/modules/articoli/modutil.php +++ b/modules/articoli/modutil.php @@ -85,10 +85,10 @@ function add_movimento_magazzino($idarticolo, $qta, $array = [], $descrizone = ' // Registrazione della movimentazione $dbo->insert('mg_movimenti', array_merge($array, [ 'idarticolo' => $idarticolo, - 'descrizione_articolo' => '#(SELECT descrizione FROM mg_articoli WHERE id='.prepare($idarticolo).')#', + '#descrizione_articolo' => '(SELECT descrizione FROM mg_articoli WHERE id='.prepare($idarticolo).')', 'qta' => $qta, 'movimento' => $movimento, - 'data' => '#NOW()#', + '#data' => 'NOW()', ])); return true; diff --git a/modules/fatture/actions.php b/modules/fatture/actions.php index 176d6435a..742dd8ef6 100644 --- a/modules/fatture/actions.php +++ b/modules/fatture/actions.php @@ -463,8 +463,8 @@ switch (post('op')) { 'qta' => $riga['qta'], 'sconto' => $riga['sconto'], 'sconto_unitario' => $riga['sconto_unitario'], - 'order' => '#(SELECT IFNULL(MAX(`order`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')#', - 'idgruppo' => '#(SELECT IFNULL(MAX(`idgruppo`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')#', + '#order' => '(SELECT IFNULL(MAX(`order`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')', + '#idgruppo' => '(SELECT IFNULL(MAX(`idgruppo`) + 1, 0) FROM co_righe_documenti AS t WHERE iddocumento='.prepare($id_record).')', 'idritenutaacconto' => get_var("Percentuale ritenuta d'acconto"), 'ritenutaacconto' => $ritenutaacconto, 'idrivalsainps' => get_var('Percentuale rivalsa INPS'), diff --git a/modules/viste/actions.php b/modules/viste/actions.php index 20672e031..e38f53638 100644 --- a/modules/viste/actions.php +++ b/modules/viste/actions.php @@ -62,7 +62,7 @@ switch (filter('op')) { $dbo->update('zz_views', $array, ['id' => $id]); } elseif (!empty($post['query'][$c])) { - $array['order'] = '#(SELECT IFNULL(MAX(`order`) + 1, 0) FROM zz_views AS t WHERE id_module='.prepare($id_record).')#'; + $array['#order'] = '(SELECT IFNULL(MAX(`order`) + 1, 0) FROM zz_views AS t WHERE id_module='.prepare($id_record).')'; $dbo->insert('zz_views', $array);