From 74def328c8d6ebaa6c46011b8dc9692be4900e7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A1bor=20Hojtsy?= <gabor@hojtsy.hu>
Date: Thu, 27 Sep 2007 16:52:00 +0000
Subject: #167284 by Heine and pwolanin: proper field type placeholders in IN()
 queries, setting a best practice to avoid vulnerabilities

---
 includes/database.inc | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

(limited to 'includes')

diff --git a/includes/database.inc b/includes/database.inc
index e5cefded6..d82f94d00 100644
--- a/includes/database.inc
+++ b/includes/database.inc
@@ -187,6 +187,22 @@ function _db_query_callback($match, $init = FALSE) {
   }
 }
 
+/**
+ * Generate placeholders for an array of query arguments of a single type.
+ *
+ * Given a Schema API field type, return correct %-placeholders to
+ * embed in a query
+ *
+ * @param $arguments
+ *  An array with at least one element.
+ * @param $type
+ *   The Schema API type of a field (e.g. 'int', 'text', or 'varchar').
+ */
+function db_placeholders($arguments, $type = 'int') {
+  $placeholder = _db_type_placeholder($type);
+  return implode(',', array_fill(0, count($arguments), $placeholder));
+}
+
 /**
  * Indicates the place holders that should be replaced in _db_query_callback().
  */
@@ -437,10 +453,10 @@ function db_create_table(&$ret, $name, $table) {
 }
 
 /**
- * Return an array of field names from an array of key/index column
- * specifiers.  This is usually an identity function but if a
- * key/index uses a column prefix specification, this function
- * extracts just the name.
+ * Return an array of field names from an array of key/index column specifiers.
+ *
+ * This is usually an identity function but if a key/index uses a column prefix
+ * specification, this function extracts just the name.
  *
  * @param $fields
  *   An array of key/index column specifiers.
@@ -461,9 +477,10 @@ function db_field_names($fields) {
 }
 
 /**
- * Given a Schema API field type, return the correct %-placeholder to
- * embed in a query to be passed to db_query along with a value from a
- * column of the specified type.
+ * Given a Schema API field type, return the correct %-placeholder.
+ *
+ * Embed the placeholder in a query to be passed to db_query and and pass as an
+ * argument to db_query a value of the specified type.
  *
  * @param $type
  *   The Schema API type of a field.
-- 
cgit v1.2.3