From c39562ae036f303f77767f438b89be88a23fe277 Mon Sep 17 00:00:00 2001
From: Dries Buytaert <dries@buytaert.net>
Date: Mon, 21 Jul 2003 15:36:05 +0000
Subject: - Fixed node_save() and user_save() bug introduced by table prefix
 changes.   Modified patches from Gerhard.

- Changed the order of the checks in node_teaser().  Patch from Kobus.
---
 modules/node/node.module | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

(limited to 'modules/node/node.module')

diff --git a/modules/node/node.module b/modules/node/node.module
index e1b93cdd3..329f6c3f6 100644
--- a/modules/node/node.module
+++ b/modules/node/node.module
@@ -126,14 +126,6 @@ function node_teaser($body) {
     return $body;
   }
 
-  /*
-  ** If we have a short body, return the entire body:
-  */
-
-  if (strlen($body) < $size) {
-    return $body;
-  }
-
   /*
   ** If a valid delimiter has been specified, use it to
   ** chop of the teaser.  The delimiter can be outside
@@ -145,6 +137,14 @@ function node_teaser($body) {
     return substr($body, 0, $delimiter);
   }
 
+  /*
+  ** If we have a short body, return the entire body:
+  */
+
+  if (strlen($body) < $size) {
+    return $body;
+  }
+
   /*
   ** In some cases no delimiter has been specified (eg.
   ** when posting using the Blogger API) in which case
@@ -302,12 +302,17 @@ function node_save($node) {
     foreach ($node as $key => $value) {
       if (in_array($key, $fields)) {
         $k[] = check_query($key);
-        $v[] = "'". check_query($value) ."'";
+        $v[] = $value;
+        $s[] = "'%s'";
       }
     }
 
+    $keysfmt = implode(", ", $s);
+    // need to quote the placeholders for the values
+    $valsfmt = "'". implode("', '", $s) ."'";
+
     // Insert the node into the database:
-    db_query("INSERT INTO {node} (". implode(", ", $k) .") VALUES (". implode(", ", $v) .")");
+    db_query("INSERT INTO {node} (". implode(", ", $k) .") VALUES(". implode(", ", $s) .")", $v);
 
     // Call the node specific callback (if any):
     node_invoke($node, "insert");
@@ -325,12 +330,13 @@ function node_save($node) {
     // Prepare the query:
     foreach ($node as $key => $value) {
       if (in_array($key, $fields)) {
-        $q[] = check_query($key) ." = '". check_query($value) ."'";
+        $q[] = check_query($key) ." = '%s'";
+        $v[] = $value;
       }
     }
 
     // Update the node in the database:
-    db_query("UPDATE {node} SET ". implode(", ", $q) ." WHERE nid = '$node->nid'");
+    db_query("UPDATE {node} SET ". implode(", ", $q) ." WHERE nid = '$node->nid'", $v);
 
     // Call the node specific callback (if any):
     node_invoke($node, "update");
-- 
cgit v1.2.3