move SQL to use external joe libraries

[sql-web.git] / lib / security.lib.php

diff --git a/lib/security.lib.php b/lib/security.lib.php
index 0fc8a91365cbd4f7386fb3fa0516fba65a565922..bb32be66c55a1d1ed3bda5186532a296699ae589 100644 (file)
--- a/lib/security.lib.php
+++ b/lib/security.lib.php
@@ -1,4 +1,7 @@
 <?php
+/*
+       (c) 2005 Joe Presbrey
+*/
 
 require_once('mitsql.lib.php');
 
@@ -11,7 +14,7 @@ class Login {
                $this->p = $p;
                if (is_numeric($u)) {
                        $this->id = $u;
-                       $opt = sprintf(" UserId = '%s'", mysql_escape_string($u));
+                       $opt = sprintf(" Username = '%s' OR UserId = '%s'", mysql_escape_string($u), mysql_escape_string($u));
                } else {
                        $opt = sprintf(" Username = '%s'", mysql_escape_string($u));
                        $opt .= (is_null($p)?'':sprintf(" AND Password='%s'", mysql_escape_string(base64_encode($p))));
@@ -70,7 +73,7 @@ class Login {
         is_null($name) || $arr['Name'] = $name;
         is_null($email) || $arr['Email'] = $email;
                $upd = buildSQLSet($arr);
-        $sql = sprintf("UPDATE User %s WHERE UserId = '%s'",
+        $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
                         $upd, mysql_escape_string($this->getUserId()));
                if (!empty($upd) && $upd != 'SET')
                        DBUpdate($sql);
@@ -133,7 +136,7 @@ class User {
     }
        function setPassword($pwd) {
                $arr['Password'] = base64_encode($pwd);
-        $sql = sprintf("UPDATE User %s WHERE UserId = '%s'",
+        $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
                         buildSQLSet($arr), mysql_escape_string($this->getUserId()));
         DBUpdate($sql);
                $sql = sprintf('SET PASSWORD FOR \'%s\'@\'%%\'=PASSWORD(\'%s\')',
@@ -146,7 +149,7 @@ class User {
                $arr['Password'] = base64_encode($pwd);
                $arr['bEnabled'] = 1;
                $arr['dSignup'] = 'NOW()';
-        $sql = sprintf("UPDATE User %s WHERE UserId = '%s'",
+        $sql = sprintf("UPDATE User SET %s WHERE UserId = '%s'",
                         buildSQLSet($arr), mysql_escape_string($this->getUserId()));
         DBUpdate($sql);
 
@@ -337,6 +340,7 @@ function addDB($dbname,$userid) {
        global $_NEW_DB, $_NEW_DBQUOTA, $_NEW_DBOWNER;
 
        DBCreate(sprintf('CREATE DATABASE `%s`', mysql_escape_string($dbname)));
+       if (mysql_error()) return false;
 
        $newdb['Name'] = $dbname;
        $arr = array_merge($newdb, $_NEW_DB);
@@ -354,27 +358,29 @@ function addDB($dbname,$userid) {
                } else {
                        return false;
                }
-               $sql = sprintf("UPDATE DB %s WHERE DB.DatabaseId = '%s'",
+               $sql = sprintf("UPDATE DB SET %s WHERE DB.DatabaseId = '%s'",
                                                buildSQLSet($arr),
                                                $DBId);
                DBUpdate($sql);
-               return $DBId;
-       } else {
-               $arr = $_NEW_DBQUOTA;
-               $arr['DatabaseId'] = $DBId;
-               $sql = sprintf("INSERT IGNORE INTO DBQuota %s",
-                                               buildSQLInsert($arr));
-               DBInsert($sql);
-
-               $arr = $_NEW_DBOWNER;
-               $arr['DatabaseId'] = $DBId;
-               $arr['UserId'] = $userid;
-               $sql = sprintf("INSERT IGNORE INTO DBOwner %s",
-                                               buildSQLInsert($arr));
-               DBInsert($sql);
-
-               return $DBId;
        }
+
+       DBDelete(sprintf("DELETE FROM DBOwner WHERE DatabaseId = '%s'", mysql_escape_string($DBId)));
+       DBDelete(sprintf("DELETE FROM DBQuota WHERE DatabaseId = '%s'", mysql_escape_string($DBId)));
+       
+       $arr = $_NEW_DBQUOTA;
+       $arr['DatabaseId'] = $DBId;
+       $sql = sprintf("INSERT IGNORE INTO DBQuota %s",
+                                       buildSQLInsert($arr));
+       DBInsert($sql);
+
+       $arr = $_NEW_DBOWNER;
+       $arr['DatabaseId'] = $DBId;
+       $arr['UserId'] = $userid;
+       $sql = sprintf("INSERT IGNORE INTO DBOwner %s",
+                                       buildSQLInsert($arr));
+       DBInsert($sql);
+
+       return $DBId;
 }
 
 function delDB($dbname) {
@@ -383,7 +389,7 @@ function delDB($dbname) {
        DBCreate(sprintf('DROP DATABASE `%s`', mysql_escape_string($dbname)));
 
        $arr['bEnabled'] = 0;
-       $sql = sprintf("UPDATE DB %s WHERE DB.Name = '%s'",
+       $sql = sprintf("UPDATE DB SET %s WHERE DB.Name = '%s'",
                                        buildSQLSet($arr),
                                        $dbname);
        DBUpdate($sql);