" . htmlspecialchars($error) . "
\n"; + echo "$error
\n"; } } diff --git a/functions.inc.php b/functions.inc.php index 76ea8eee..2a24d66f 100644 --- a/functions.inc.php +++ b/functions.inc.php @@ -195,12 +195,17 @@ function redirect($location, $message = null) { exit; } -function query_redirect($query, $location, $message) { +function query_redirect($query, $location, $message, $redirect = true, $execute = true) { global $mysql, $error, $SELF; - if ($mysql->query($query)) { - redirect($location, $message . "" . htmlspecialchars($query) . ' - ' . lang('edit') . '');
+ $sql = ' ' . lang('SQL command') . "";
+ if ($execute && !$mysql->query($query)) {
+ $error = htmlspecialchars($mysql->error) . $sql;
+ return false;
}
- $error = $mysql->error;
+ if ($redirect) {
+ redirect($location, $message . $sql);
+ }
+ return true;
}
function remove_from_uri($param = "") {
diff --git a/procedure.inc.php b/procedure.inc.php
index 25724be4..26d5e114 100644
--- a/procedure.inc.php
+++ b/procedure.inc.php
@@ -3,13 +3,9 @@ $routine = (isset($_GET["function"]) ? "FUNCTION" : "PROCEDURE");
$dropped = false;
if ($_POST && !$error && !$_POST["add"] && !$_POST["drop_col"] && !$_POST["up"] && !$_POST["down"]) {
- if (strlen($_GET["procedure"]) && ($_POST["dropped"] || $mysql->query("DROP $routine " . idf_escape($_GET["procedure"])))) {
- if ($_POST["drop"]) {
- redirect(substr($SELF, 0, -1), lang('Routine has been dropped.'));
- }
- $dropped = true;
+ if (strlen($_GET["procedure"])) {
+ $dropped = query_redirect("DROP $routine " . idf_escape($_GET["procedure"]), substr($SELF, 0, -1), lang('Routine has been dropped.'), $_POST["drop"], !$_POST["dropped"]);
}
- $error = $mysql->error;
if (!$_POST["drop"]) {
$set = array();
$fields = array_filter((array) $_POST["fields"], 'strlen');
diff --git a/processlist.inc.php b/processlist.inc.php
index 913e773e..4175f151 100644
--- a/processlist.inc.php
+++ b/processlist.inc.php
@@ -9,7 +9,7 @@ if ($_POST && !$error) {
if ($killed || !$_POST["kill"]) {
redirect($SELF . "processlist=", lang('%d process(es) has been killed.', $killed));
}
- $error = $mysql->error;
+ $error = htmlspecialchars($mysql->error);
}
page_header(lang('Process list'), $error);
?>
diff --git a/select.inc.php b/select.inc.php
index ad6d738e..cc353d6b 100644
--- a/select.inc.php
+++ b/select.inc.php
@@ -105,7 +105,7 @@ if ($_POST && !$error) {
if ($result) {
redirect(remove_from_uri("page"), lang('%d item(s) have been deleted.', $deleted));
}
- $error = $mysql->error;
+ $error = htmlspecialchars($mysql->error);
}
page_header(lang('Select') . ": " . htmlspecialchars($_GET["select"]), ($error ? lang('Error during deleting') . ": $error" : ""));
diff --git a/table.inc.php b/table.inc.php
index be90bba5..caaba99c 100644
--- a/table.inc.php
+++ b/table.inc.php
@@ -1,7 +1,7 @@
query("SHOW COLUMNS FROM " . idf_escape($_GET["table"]));
if (!$result) {
- $error = $mysql->error;
+ $error = htmlspecialchars($mysql->error);
}
page_header(lang('Table') . ": " . htmlspecialchars($_GET["table"]), $error);
diff --git a/todo.txt b/todo.txt
index 67366683..7b31013e 100644
--- a/todo.txt
+++ b/todo.txt
@@ -11,6 +11,6 @@ Transactions in export
Compress export and import
Partitioning (MySQL 5.1)
Create view options
-Utilize query_redirect - createv, database, procedure, trigger, select
+Utilize query_redirect - select
? Execution time in sql.inc.php
? Save token also to cookie - for session expiration and login in other window
diff --git a/trigger.inc.php b/trigger.inc.php
index 7b742303..425ecffa 100644
--- a/trigger.inc.php
+++ b/trigger.inc.php
@@ -4,13 +4,9 @@ $trigger_event = array("INSERT", "UPDATE", "DELETE");
$dropped = false;
if ($_POST && !$error) {
- if (strlen($_GET["name"]) && ($_POST["dropped"] || $mysql->query("DROP TRIGGER " . idf_escape($_GET["name"])))) {
- if ($_POST["drop"]) {
- redirect($SELF . "table=" . urlencode($_GET["trigger"]), lang('Trigger has been dropped.'));
- }
- $dropped = true;
+ if (strlen($_GET["name"])) {
+ $dropped = query_redirect("DROP TRIGGER " . idf_escape($_GET["name"]), $SELF . "table=" . urlencode($_GET["trigger"]), lang('Trigger has been dropped.'), $_POST["drop"], !$_POST["dropped"]);
}
- $error = $mysql->error;
if (!$_POST["drop"]) {
if (in_array($_POST["Timing"], $trigger_time) && in_array($_POST["Event"], $trigger_event)) {
query_redirect("CREATE TRIGGER " . idf_escape($_POST["Trigger"]) . " $_POST[Timing] $_POST[Event] ON " . idf_escape($_GET["trigger"]) . " FOR EACH ROW $_POST[Statement]", $SELF . "table=" . urlencode($_GET["trigger"]), (strlen($_GET["name"]) ? lang('Trigger has been altered.') : lang('Trigger has been created.')));
diff --git a/user.inc.php b/user.inc.php
index 10f56a50..ca54b0fa 100644
--- a/user.inc.php
+++ b/user.inc.php
@@ -91,7 +91,7 @@ if ($_POST && !$error) {
($grant && !$mysql->query("GRANT " . implode("$match[2], ", $grant) . "$match[2] ON $match[1] TO '$new_user'")) //! SQL injection
|| ($revoke && !$mysql->query("REVOKE " . implode("$match[2], ", $revoke) . "$match[2] ON $match[1] FROM '$new_user'"))
)) {
- $error = $mysql->error;
+ $error = htmlspecialchars($mysql->error);
if ($old_user != $new_user) {
$mysql->query("DROP USER '$new_user'");
}
@@ -112,7 +112,7 @@ if ($_POST && !$error) {
}
}
if (!$error) {
- $error = $mysql->error;
+ $error = htmlspecialchars($mysql->error);
}
}
page_header((isset($_GET["host"]) ? lang('Username') . ": " . htmlspecialchars("$_GET[user]@$_GET[host]") : lang('Create user')), $error, array("privileges" => lang('Privileges')));