Add some codes from 3.61. Currently files under /nucleus/libs and /nucleus/libs/sql...

[nucleus-jp/nucleus-jp-ancient.git] / utf8 / nucleus / upgrades / upgrade2.5.php

diff --git a/utf8/nucleus/upgrades/upgrade2.5.php b/utf8/nucleus/upgrades/upgrade2.5.php
index 0a1d510..28947fe 100755 (executable)
--- a/utf8/nucleus/upgrades/upgrade2.5.php
+++ b/utf8/nucleus/upgrades/upgrade2.5.php
@@ -55,11 +55,11 @@ function upgrade_do250() {
                                $query = 'INSERT INTO ' . sql_table('plugin_option_desc')
                                           .' (opid, oname, ocontext, odesc, otype)'
                                           ." VALUES ("
-                                                       ."'".addslashes($o->opid)."',"
-                                                       ."'".addslashes($o->oname) ."',"
+                                                       ."'".sql_real_escape_string($o->opid)."',"
+                                                       ."'".sql_real_escape_string($o->oname) ."',"
                                                        ."'global',"
-                                                       ."'".addslashes($o->odesc) ."',"
-                                                       ."'".addslashes($o->otype) ."')";
+                                                       ."'".sql_real_escape_string($o->odesc) ."',"
+                                                       ."'".sql_real_escape_string($o->otype) ."')";
                                upgrade_query('Moving option description for '.htmlspecialchars($o->oname).' to ' . sql_table('plugin_option_desc'), $query);
        
                                // store new id
@@ -92,7 +92,7 @@ function upgrade_do250() {
                                foreach ($aValues as $aInfo) {
                                        $query = 'INSERT INTO ' . sql_table('plugin_option') 
                                                   .' (oid, ocontextid, ovalue)'
-                                                  ." VALUES (".$aInfo['id'].",'0','".addslashes($aInfo['value'])."')";
+                                                  ." VALUES (".$aInfo['id'].",'0','".sql_real_escape_string($aInfo['value'])."')";
                                        upgrade_query('Re-filling ' . sql_table('plugin_option') . ' ('.$aInfo['id'].')', $query);
                                }
                        }