diff --git a/contrib/forms/body_composition/new.php b/contrib/forms/body_composition/new.php
index a6413188829..90e94122ed5 100644
--- a/contrib/forms/body_composition/new.php
+++ b/contrib/forms/body_composition/new.php
@@ -32,7 +32,7 @@
// encode a string from a form field for database writing.
function form2db($fldval) {
$fldval = trim($fldval);
- if (!get_magic_quotes_gpc()) $fldval = addslashes($fldval);
+ $fldval = formDataCore($fldval);
return $fldval;
}
diff --git a/contrib/forms/body_composition/view.php b/contrib/forms/body_composition/view.php
index a6413188829..90e94122ed5 100644
--- a/contrib/forms/body_composition/view.php
+++ b/contrib/forms/body_composition/view.php
@@ -32,7 +32,7 @@
// encode a string from a form field for database writing.
function form2db($fldval) {
$fldval = trim($fldval);
- if (!get_magic_quotes_gpc()) $fldval = addslashes($fldval);
+ $fldval = formDataCore($fldval);
return $fldval;
}
diff --git a/contrib/forms/evaluation/C_FormEvaluation.class.php b/contrib/forms/evaluation/C_FormEvaluation.class.php
index 8c970f49958..306dc3f1aef 100644
--- a/contrib/forms/evaluation/C_FormEvaluation.class.php
+++ b/contrib/forms/evaluation/C_FormEvaluation.class.php
@@ -52,7 +52,7 @@ function default_action_process() {
addForm($GLOBALS['encounter'], "Evaluation Form", $this->evaluation->id, "evaluation", $GLOBALS['pid'], $_SESSION['userauthorized']);
if (!empty($_POST['cpt_code'])) {
- $sql = "select * from codes where code ='" . mysql_real_escape_string($_POST['cpt_code']) . "' order by id";
+ $sql = "select * from codes where code ='" . add_escape_custom($_POST['cpt_code']) . "' order by id";
$results = sqlQ($sql);
diff --git a/contrib/forms/evaluation/FormEvaluation.class.php b/contrib/forms/evaluation/FormEvaluation.class.php
index cdfccd4463d..e902d2413e4 100644
--- a/contrib/forms/evaluation/FormEvaluation.class.php
+++ b/contrib/forms/evaluation/FormEvaluation.class.php
@@ -60,7 +60,7 @@ function FormEvaluation($id= "", $_prefix = "") {
function populate() {
parent::populate();
- $sql = "SELECT name from form_evaluation_checks where foreign_id = '" . mysql_real_escape_string($this->id) . "'";
+ $sql = "SELECT name from form_evaluation_checks where foreign_id = '" . add_escape_custom($this->id) . "'";
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
@@ -245,7 +245,7 @@ function persist() {
sqlQuery($sql);
foreach ($this->checks as $check) {
if (!empty($check)) {
- $sql = "INSERT INTO form_evaluation_checks set foreign_id='" . mysql_real_escape_string($this->id) . "', name = '" . mysql_real_escape_string($check) . "'";
+ $sql = "INSERT INTO form_evaluation_checks set foreign_id='" . add_escape_custom($this->id) . "', name = '" . add_escape_custom($check) . "'";
sqlQuery($sql);
//echo "$sql
";
}
diff --git a/contrib/forms/evaluation/report.php b/contrib/forms/evaluation/report.php
index 8a5d5316aa8..760e2395fc9 100644
--- a/contrib/forms/evaluation/report.php
+++ b/contrib/forms/evaluation/report.php
@@ -6,7 +6,7 @@
function evaluation_report( $pid, $encounter, $cols, $id) {
$count = 0;
$data = formFetch("form_evaluation", $id);
-$sql = "SELECT name from form_evaluation_checks where foreign_id = '" . mysql_real_escape_string($id) . "'";
+$sql = "SELECT name from form_evaluation_checks where foreign_id = '" . add_escape_custom($id) . "'";
$results = sqlQ($sql);
$data2 = array();
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
diff --git a/contrib/forms/hp_tje_primary/FormHpTjePrimary.class.php b/contrib/forms/hp_tje_primary/FormHpTjePrimary.class.php
index 231ded32cd7..e0bcdfdcc27 100644
--- a/contrib/forms/hp_tje_primary/FormHpTjePrimary.class.php
+++ b/contrib/forms/hp_tje_primary/FormHpTjePrimary.class.php
@@ -76,7 +76,7 @@ function FormHpTjePrimary($id= "", $_prefix = "") {
function populate() {
parent::populate();
- $sql = "SELECT name from form_hp_tje_checks where foreign_id = '" . mysql_real_escape_string($this->id) . "'";
+ $sql = "SELECT name from form_hp_tje_checks where foreign_id = '" . add_escape_custom($this->id) . "'";
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
@@ -84,14 +84,14 @@ function populate() {
}
- $sql = "SELECT doctor,specialty,tx_rendered,effectiveness,date from form_hp_tje_history where foreign_id = '" . mysql_real_escape_string($this->id) . "'";
+ $sql = "SELECT doctor,specialty,tx_rendered,effectiveness,date from form_hp_tje_history where foreign_id = '" . add_escape_custom($this->id) . "'";
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
$this->history[] = $row;
}
- $sql = "SELECT nature_of_accident,injuries,date from form_hp_tje_previous_accidents where foreign_id = '" . mysql_real_escape_string($this->id) . "'";
+ $sql = "SELECT nature_of_accident,injuries,date from form_hp_tje_previous_accidents where foreign_id = '" . add_escape_custom($this->id) . "'";
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
@@ -318,7 +318,7 @@ function persist() {
sqlQuery($sql);
foreach ($this->checks as $check) {
if (!empty($check)) {
- $sql = "INSERT INTO form_hp_tje_checks set foreign_id='" . mysql_real_escape_string($this->id) . "', name = '" . mysql_real_escape_string($check) . "'";
+ $sql = "INSERT INTO form_hp_tje_checks set foreign_id='" . add_escape_custom($this->id) . "', name = '" . add_escape_custom($check) . "'";
sqlQuery($sql);
//echo "$sql
";
}
@@ -329,12 +329,12 @@ function persist() {
sqlQuery($sql);
foreach ($this->history as $history) {
if (!empty($history)) {
- $sql = "INSERT INTO form_hp_tje_history set foreign_id='" . mysql_real_escape_string($this->id) ."'"
- . ", doctor = '" . mysql_real_escape_string($history['doctor']) . "'"
- . ", specialty = '" . mysql_real_escape_string($history['specialty']) . "'"
- . ", tx_rendered = '" . mysql_real_escape_string($history['tx_rendered']) . "'"
- . ", effectiveness = '" . mysql_real_escape_string($history['effectiveness']) . "'"
- . ", date = '" . mysql_real_escape_string($history['date']) . "'";
+ $sql = "INSERT INTO form_hp_tje_history set foreign_id='" . add_escape_custom($this->id) ."'"
+ . ", doctor = '" . add_escape_custom($history['doctor']) . "'"
+ . ", specialty = '" . add_escape_custom($history['specialty']) . "'"
+ . ", tx_rendered = '" . add_escape_custom($history['tx_rendered']) . "'"
+ . ", effectiveness = '" . add_escape_custom($history['effectiveness']) . "'"
+ . ", date = '" . add_escape_custom($history['date']) . "'";
sqlQuery($sql);
//echo "$sql
";
}
@@ -347,10 +347,10 @@ function persist() {
foreach ($this->previous_accidents as $pa) {
if (!empty($pa)) {
- $sql = "INSERT INTO form_hp_tje_previous_accidents set foreign_id='" . mysql_real_escape_string($this->id) .
- "', nature_of_accident = '" . mysql_real_escape_string($pa['nature_of_accident']) . "'"
- . ", injuries = '" . mysql_real_escape_string($pa['injuries']) . "'"
- . ", date = '" . mysql_real_escape_string($pa['date']) . "'";
+ $sql = "INSERT INTO form_hp_tje_previous_accidents set foreign_id='" . add_escape_custom($this->id) .
+ "', nature_of_accident = '" . add_escape_custom($pa['nature_of_accident']) . "'"
+ . ", injuries = '" . add_escape_custom($pa['injuries']) . "'"
+ . ", date = '" . add_escape_custom($pa['date']) . "'";
sqlQuery($sql);
//echo "$sql
";
diff --git a/contrib/forms/prosthesis/C_FormProsthesis.class.php b/contrib/forms/prosthesis/C_FormProsthesis.class.php
index 0dbe33829b4..dbe6b69cb62 100644
--- a/contrib/forms/prosthesis/C_FormProsthesis.class.php
+++ b/contrib/forms/prosthesis/C_FormProsthesis.class.php
@@ -51,7 +51,7 @@ function default_action_process() {
addForm($GLOBALS['encounter'], "Prosthesis & Orthotics Form", $this->prosthesis->id, "prosthesis", $GLOBALS['pid'], $_SESSION['userauthorized']);
if (!empty($_POST['cpt_code'])) {
- $sql = "select * from codes where code ='" . mysql_real_escape_string($_POST['cpt_code']) . "' order by id";
+ $sql = "select * from codes where code ='" . add_escape_custom($_POST['cpt_code']) . "' order by id";
$results = sqlQ($sql);
diff --git a/contrib/forms/psychiatrySet/brief_aan_verwijzer/autosave.php b/contrib/forms/psychiatrySet/brief_aan_verwijzer/autosave.php
index 3af0aa2f126..faf0b37a7d4 100644
--- a/contrib/forms/psychiatrySet/brief_aan_verwijzer/autosave.php
+++ b/contrib/forms/psychiatrySet/brief_aan_verwijzer/autosave.php
@@ -15,7 +15,7 @@
// escape the strings
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/psychiatrySet/brief_aan_verwijzer/save.php b/contrib/forms/psychiatrySet/brief_aan_verwijzer/save.php
index e4c4bfbd396..19f97ff3148 100644
--- a/contrib/forms/psychiatrySet/brief_aan_verwijzer/save.php
+++ b/contrib/forms/psychiatrySet/brief_aan_verwijzer/save.php
@@ -12,7 +12,7 @@
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/psychiatrySet/intakeverslag/autosave.php b/contrib/forms/psychiatrySet/intakeverslag/autosave.php
index d3c1efc0df0..e4d5a3a9425 100644
--- a/contrib/forms/psychiatrySet/intakeverslag/autosave.php
+++ b/contrib/forms/psychiatrySet/intakeverslag/autosave.php
@@ -17,7 +17,7 @@
// escape the strings
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/psychiatrySet/intakeverslag/save.php b/contrib/forms/psychiatrySet/intakeverslag/save.php
index 0949ccd5d83..ee33181f57c 100644
--- a/contrib/forms/psychiatrySet/intakeverslag/save.php
+++ b/contrib/forms/psychiatrySet/intakeverslag/save.php
@@ -12,7 +12,7 @@
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/autosave.php b/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/autosave.php
index 25f2d041a11..7c90fa11b4f 100644
--- a/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/autosave.php
+++ b/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/autosave.php
@@ -15,7 +15,7 @@
// escape the strings
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/save.php b/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/save.php
index ebe72829b03..86c6ea5320d 100644
--- a/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/save.php
+++ b/contrib/forms/psychiatrySet/psychiatrisch_onderzoek/save.php
@@ -12,7 +12,7 @@
foreach ($_POST as $k => $var)
{
- $_POST[$k] = mysql_real_escape_string($var);
+ $_POST[$k] = add_escape_custom($var);
// echo "$var\n";
}
diff --git a/contrib/forms/review_of_systems/C_FormReviewOfSystems.class.php b/contrib/forms/review_of_systems/C_FormReviewOfSystems.class.php
index 6c90d40c750..b4d53c12401 100644
--- a/contrib/forms/review_of_systems/C_FormReviewOfSystems.class.php
+++ b/contrib/forms/review_of_systems/C_FormReviewOfSystems.class.php
@@ -51,7 +51,7 @@ function default_action_process() {
addForm($GLOBALS['encounter'], "Review Of Systems", $this->review_of_systems->id, "review_of_systems", $GLOBALS['pid'], $_SESSION['userauthorized']);
if (!empty($_POST['cpt_code'])) {
- $sql = "select * from codes where code ='" . mysql_real_escape_string($_POST['cpt_code']) . "' order by id";
+ $sql = "select * from codes where code ='" . add_escape_custom($_POST['cpt_code']) . "' order by id";
$results = sqlQ($sql);
diff --git a/contrib/forms/review_of_systems/FormReviewOfSystems.class.php b/contrib/forms/review_of_systems/FormReviewOfSystems.class.php
index 18206bd7785..9821caa58e3 100644
--- a/contrib/forms/review_of_systems/FormReviewOfSystems.class.php
+++ b/contrib/forms/review_of_systems/FormReviewOfSystems.class.php
@@ -75,7 +75,7 @@ function toString($html = false) {
function populate() {
parent::populate();
- $sql = "SELECT name from form_review_of_systems_checks where foreign_id = '" . mysql_real_escape_string($this->id) . "'";
+ $sql = "SELECT name from form_review_of_systems_checks where foreign_id = '" . add_escape_custom($this->id) . "'";
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
@@ -91,7 +91,7 @@ function persist() {
sqlQuery($sql);
foreach ($this->checks as $check) {
if (!empty($check)) {
- $sql = "INSERT INTO form_review_of_systems_checks set foreign_id='" . mysql_real_escape_string($this->id) . "', name = '" . mysql_real_escape_string($check) . "'";
+ $sql = "INSERT INTO form_review_of_systems_checks set foreign_id='" . add_escape_custom($this->id) . "', name = '" . add_escape_custom($check) . "'";
sqlQuery($sql);
//echo "$sql
";
}
diff --git a/contrib/forms/review_of_systems/report.php b/contrib/forms/review_of_systems/report.php
index 5e608fcaf29..4d7684306a2 100644
--- a/contrib/forms/review_of_systems/report.php
+++ b/contrib/forms/review_of_systems/report.php
@@ -5,7 +5,7 @@
function review_of_systems_report( $pid, $encounter, $cols, $id) {
$count = 0;
$data = formFetch("form_review_of_systems", $id);
-$sql = "SELECT name from form_review_of_systems_checks where foreign_id = '" . mysql_real_escape_string($id) . "'";
+$sql = "SELECT name from form_review_of_systems_checks where foreign_id = '" . add_escape_custom($id) . "'";
$results = sqlQ($sql);
$data2 = array();
while ($row = mysql_fetch_array($results, MYSQL_ASSOC)) {
diff --git a/contrib/util/de_identification_upgrade.php b/contrib/util/de_identification_upgrade.php
index 5a95fdd42d1..f4bf6cbbb47 100644
--- a/contrib/util/de_identification_upgrade.php
+++ b/contrib/util/de_identification_upgrade.php
@@ -126,11 +126,14 @@ function upgradeFromSqlFile_de($filename) {
if (!empty($_POST['form_submit'])) {
upgradeFromSqlFile_de("database_de_identification.sql");
- // grant file privilege to user
- if ($sqlconf["host"] == "localhost")
- $dbh = mysql_connect($sqlconf['host'],$_POST['root_user_name'],$_POST['root_user_pass'],$sqlconf['host']) or die(mysql_error());
- else
- $dbh = mysql_connect($sqlconf['host'].":".$sqlconf['port'],$_POST['root_user_name'],$_POST['root_user_pass']) or die(mysql_error());
+// grant file privilege to user
+// if ($sqlconf["host"] == "localhost")
+// $dbh = mysql_connect($sqlconf['host'],$_POST['root_user_name'],$_POST['root_user_pass'],$sqlconf['host']) or die(mysql_error());
+// else
+// $dbh = mysql_connect($sqlconf['host'].":".$sqlconf['port'],$_POST['root_user_name'],$_POST['root_user_pass']) or die(mysql_error());
+
+ $dbh = $GLOBALS['dbh'];
+
if ($dbh == FALSE) {
echo "\n";
echo "
".mysql_error()." (#".mysql_errno().")\n";
diff --git a/contrib/util/import_mi2xml.php b/contrib/util/import_mi2xml.php
index 99cd543dd87..df75cbf7378 100644
--- a/contrib/util/import_mi2xml.php
+++ b/contrib/util/import_mi2xml.php
@@ -739,7 +739,7 @@ function get_patientid( $medics ) {
//
function form2db($fldval) {
$fldval = trim($fldval);
- if (!get_magic_quotes_gpc()) $fldval = addslashes($fldval);
+ $fldval = formDataCore($fldval);
return $fldval;
}
diff --git a/controllers/C_PatientFinder.class.php b/controllers/C_PatientFinder.class.php
index a185465b658..8eb11b0e7a6 100644
--- a/controllers/C_PatientFinder.class.php
+++ b/controllers/C_PatientFinder.class.php
@@ -35,9 +35,9 @@ function find_action($form_id, $form_name,$pid) {
$isPid = false;
//fix any magic quotes meddling
- if (get_magic_quotes_gpc()) {$form_id = stripslashes($form_id);}
- if (get_magic_quotes_gpc()) {$form_name = stripslashes($form_name);}
- if (get_magic_quotes_gpc()) {$pid = stripslashes($pid);}
+ $form_id = strip_escape_custom($form_id);
+ $form_name = strip_escape_custom($form_name);
+ $pid = strip_escape_custom($pid);
//prevent javascript injection, whitespace and semi-colons are the worry
$form_id = preg_replace("/[^A-Za-z0-9\[\]\_\']/iS","",urldecode($form_id));
@@ -100,7 +100,7 @@ function find_action_process() {
* @-param string $search_string parsed for last name
*/
function search_by_lName($sql, $search_string) {
- $lName = mysql_real_escape_string($search_string);
+ $lName = add_escape_custom($search_string);
$sql .= " WHERE lname LIKE '$lName%' ORDER BY lname, fname";
//print "SQL is $sql \n";
$result_array = $this->_db->GetAll($sql);
@@ -116,7 +116,7 @@ function search_by_lName($sql, $search_string) {
*/
function search_by_fName($sql, $search_string) {
$name_array = split(",", $search_string);
- $fName = mysql_real_escape_string( trim($name_array[1]) );
+ $fName = add_escape_custom( trim($name_array[1]) );
$sql .= " WHERE fname LIKE '$fName%' ORDER BY lname, fname";
$result_array = $this->_db->GetAll($sql);
return $result_array;
@@ -130,8 +130,8 @@ function search_by_fName($sql, $search_string) {
*/
function search_by_FullName($sql, $search_string) {
$name_array = split(",", $search_string);
- $lName = mysql_real_escape_string($name_array[0]);
- $fName = mysql_real_escape_string( trim($name_array[1]) );
+ $lName = add_escape_custom($name_array[0]);
+ $fName = add_escape_custom( trim($name_array[1]) );
$sql .= " WHERE fname LIKE '%$fName%' AND lname LIKE '$lName%' ORDER BY lname, fname";
//print "SQL is $sql \n";
$result_array = $this->_db->GetAll($sql);
diff --git a/controllers/C_Prescription.class.php b/controllers/C_Prescription.class.php
index 72f3b0f6cc2..4ba21b89edb 100644
--- a/controllers/C_Prescription.class.php
+++ b/controllers/C_Prescription.class.php
@@ -249,7 +249,7 @@ function multiprint_header(& $pdf, $p) {
$pdf->ezImage($GLOBALS['oer_config']['prescriptions']['logo'],'','50','','center','');
$pdf->ezColumnsStart(array('num'=>2, 'gap'=>10));
$res = sqlQuery("SELECT concat('',f.name,'\n',f.street,'\n',f.city,', ',f.state,' ',f.postal_code,'\nTel:',f.phone,if(f.fax != '',concat('\nFax: ',f.fax),'')) addr FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" .
- mysql_real_escape_string($p->provider->id) . "'");
+ add_escape_custom($p->provider->id) . "'");
$pdf->ezText($res['addr'],12);
$my_y = $pdf->y;
$pdf->ezNewPage();
@@ -295,7 +295,7 @@ function multiprint_header(& $pdf, $p) {
$pdf->line($pdf->ez['leftMargin'],$pdf->y,$pdf->ez['pageWidth']-$pdf->ez['rightMargin'],$pdf->y);
$pdf->ezText('' . xl('Patient Name & Address') . '',6);
$pdf->ezText($p->patient->get_name_display(),10);
- $res = sqlQuery("SELECT concat(street,'\n',city,', ',state,' ',postal_code,'\n',if(phone_home!='',phone_home,if(phone_cell!='',phone_cell,if(phone_biz!='',phone_biz,'')))) addr from patient_data where pid =". mysql_real_escape_string ($p->patient->id));
+ $res = sqlQuery("SELECT concat(street,'\n',city,', ',state,' ',postal_code,'\n',if(phone_home!='',phone_home,if(phone_cell!='',phone_cell,if(phone_biz!='',phone_biz,'')))) addr from patient_data where pid =". add_escape_custom($p->patient->id));
$pdf->ezText($res['addr']);
$my_y = $pdf->y;
$pdf->ezNewPage();
@@ -328,7 +328,7 @@ function multiprintcss_header($p) {
echo ("\n");
echo ("
\n");
echo ("\n");
- $res = sqlQuery("SELECT concat('',f.name,'\n',f.street,'\n',f.city,', ',f.state,' ',f.postal_code,'\nTel:',f.phone,if(f.fax != '',concat('\nFax: ',f.fax),'')) addr FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" . mysql_real_escape_string($p->provider->id) . "'");
+ $res = sqlQuery("SELECT concat('',f.name,'\n',f.street,'\n',f.city,', ',f.state,' ',f.postal_code,'\nTel:',f.phone,if(f.fax != '',concat('\nFax: ',f.fax),'')) addr FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" . add_escape_custom($p->provider->id) . "'");
$patterns = array ('/\n/','/Tel:/','/Fax:/');
$replace = array (' ', xl('Tel').':', xl('Fax').':');
$res = preg_replace($patterns, $replace, $res);
@@ -367,7 +367,7 @@ function multiprintcss_header($p) {
echo (" | \n");
echo ('' . xl('Patient Name & Address') . ''. ' ');
echo ($p->patient->get_name_display() . ' ');
- $res = sqlQuery("SELECT concat(street,'\n',city,', ',state,' ',postal_code,'\n',if(phone_home!='',phone_home,if(phone_cell!='',phone_cell,if(phone_biz!='',phone_biz,'')))) addr from patient_data where pid =". mysql_real_escape_string ($p->patient->id));
+ $res = sqlQuery("SELECT concat(street,'\n',city,', ',state,' ',postal_code,'\n',if(phone_home!='',phone_home,if(phone_cell!='',phone_cell,if(phone_biz!='',phone_biz,'')))) addr from patient_data where pid =". add_escape_custom($p->patient->id));
$patterns = array ('/\n/');
$replace = array (' ');
$res = preg_replace($patterns, $replace, $res);
diff --git a/interface/fax/fax_dispatch.php b/interface/fax/fax_dispatch.php
index 901d79517e7..7d75e092374 100644
--- a/interface/fax/fax_dispatch.php
+++ b/interface/fax/fax_dispatch.php
@@ -38,7 +38,7 @@
$info_msg = "";
// This function builds an array of document categories recursively.
-// Kittens are the children of cats, you know. :-)
+// Kittens are the children of cats, you know. :-)getKittens
//
function getKittens($catid, $catstring, &$categories) {
$cres = sqlStatement("SELECT id, name FROM categories " .
@@ -149,7 +149,7 @@ function mergeTiffs() {
}
$note = "New scanned document $newid: $note";
$form_note_message = trim($_POST['form_note_message']);
- if (get_magic_quotes_gpc()) $form_note_message = stripslashes($form_note_message);
+ $form_note_message = strip_escape_custom($form_note_message);
if ($form_note_message) $note .= "\n" . $form_note_message;
// addPnote() will do its own addslashes().
$noteid = addPnote($_POST['form_pid'], $note, $userauthorized, '1',
@@ -208,7 +208,7 @@ function mergeTiffs() {
if ($_POST['form_cb_note'] && !$info_msg) {
$note = "New scanned encounter note for visit on " . substr($erow['date'], 0, 10);
$form_note_message = trim($_POST['form_note_message']);
- if (get_magic_quotes_gpc()) $form_note_message = stripslashes($form_note_message);
+ $form_note_message = strip_escape_custom($form_note_message);
if ($form_note_message) $note .= "\n" . $form_note_message;
// addPnote() will do its own addslashes().
addPnote($patient_id, $note, $userauthorized, '1',
@@ -227,11 +227,9 @@ function mergeTiffs() {
$form_message = trim($_POST['form_message']);
$form_finemode = $_POST['form_finemode'] ? '-m' : '-l';
- if (get_magic_quotes_gpc()) {
- $form_from = stripslashes($form_from);
- $form_to = stripslashes($form_to);
- $form_message = stripslashes($form_message);
- }
+ $form_from = strip_escape_custom($form_from);
+ $form_to = strip_escape_custom($form_to);
+ $form_message = strip_escape_custom($form_message);
// Generate a cover page using enscript. This can be a cool thing
// to do, as enscript is very powerful.
diff --git a/interface/forms/ankleinjury/save.php b/interface/forms/ankleinjury/save.php
index bc8508a2c2d..65a9f8b0875 100755
--- a/interface/forms/ankleinjury/save.php
+++ b/interface/forms/ankleinjury/save.php
@@ -4,7 +4,7 @@
include_once("$srcdir/api.inc");
include_once("$srcdir/forms.inc");
foreach ($_POST as $k => $var) {
-$_POST[$k] = mysql_escape_string($var);
+$_POST[$k] = add_escape_custom($var);
//echo "$var\n";
}
if ($encounter == "")
diff --git a/interface/forms/bronchitis/save.php b/interface/forms/bronchitis/save.php
index d33dc782b8a..aa4bc23d83b 100644
--- a/interface/forms/bronchitis/save.php
+++ b/interface/forms/bronchitis/save.php
@@ -4,7 +4,7 @@
include_once("$srcdir/api.inc");
include_once("$srcdir/forms.inc");
foreach ($_POST as $k => $var) {
-$_POST[$k] = mysql_escape_string($var);
+$_POST[$k] = add_escape_custom($var);
echo "$var\n";
}
if ($encounter == "")
diff --git a/interface/forms/reviewofs/save.php b/interface/forms/reviewofs/save.php
index 433525b5a57..46878ac5def 100644
--- a/interface/forms/reviewofs/save.php
+++ b/interface/forms/reviewofs/save.php
@@ -24,7 +24,7 @@
include_once("$srcdir/api.inc");
include_once("$srcdir/forms.inc");
foreach ($_POST as $k => $var) {
-$_POST[$k] = mysql_escape_string($var);
+$_POST[$k] = add_escape_custom($var);
echo attr($var);
echo "\n";
}
diff --git a/interface/main/calendar/add_edit_event.php b/interface/main/calendar/add_edit_event.php
index d4821508897..edc41046758 100644
--- a/interface/main/calendar/add_edit_event.php
+++ b/interface/main/calendar/add_edit_event.php
@@ -38,7 +38,6 @@
require_once($GLOBALS['srcdir'].'/patient.inc');
require_once($GLOBALS['srcdir'].'/forms.inc');
require_once($GLOBALS['srcdir'].'/calendar.inc');
-require_once($GLOBALS['srcdir'].'/formdata.inc.php');
require_once($GLOBALS['srcdir'].'/options.inc.php');
require_once($GLOBALS['srcdir'].'/encounter_events.inc.php');
require_once($GLOBALS['srcdir'].'/acl.inc');
diff --git a/interface/main/calendar/find_patient.php b/interface/main/calendar/find_patient.php
index 5aca22c466c..05eebad0fb1 100644
--- a/interface/main/calendar/find_patient.php
+++ b/interface/main/calendar/find_patient.php
@@ -9,6 +9,7 @@
//
include_once("../../globals.php");
+require_once($GLOBALS['srcdir'].'/formdata.inc.php');
include_once("$srcdir/calendar.inc");
include_once("$srcdir/patient.inc");
diff --git a/interface/main/calendar/findfirstapp.php b/interface/main/calendar/findfirstapp.php
index 606bebb61e3..3c71b912fff 100644
--- a/interface/main/calendar/findfirstapp.php
+++ b/interface/main/calendar/findfirstapp.php
@@ -1,5 +1,6 @@
diff --git a/interface/main/calendar/includes/pnAPI.php b/interface/main/calendar/includes/pnAPI.php
index bc1282a08f9..44e9ecf0c00 100644
--- a/interface/main/calendar/includes/pnAPI.php
+++ b/interface/main/calendar/includes/pnAPI.php
@@ -579,7 +579,7 @@ function pnVarCleanFromInput()
}
// Clean var
- if (get_magic_quotes_gpc()) {
+ if (check_magic_quotes()) {
pnStripslashes($ourvar);
}
if (!pnSecAuthAction(0, '::', '::', ACCESS_ADMIN)) {
diff --git a/interface/main/calendar/modules/PostCalendar/pnuser.php b/interface/main/calendar/modules/PostCalendar/pnuser.php
index dfaf318ad8d..f0ce7e135b2 100644
--- a/interface/main/calendar/modules/PostCalendar/pnuser.php
+++ b/interface/main/calendar/modules/PostCalendar/pnuser.php
@@ -685,7 +685,7 @@ function postcalendar_user_submit($args)
$old_dur_hours = $eventdata['event_dur_hours'];
$old_dur_min = $eventdata['event_dur_minutes'];
$old_duration = $eventdata['event_duration'];
- $eventdata['event_subject'] = mysql_real_escape_string($ekey);
+ $eventdata['event_subject'] = add_escape_custom($ekey);
$eventdata['event_status'] = _EVENT_TEMPORARY;
if (!pnModAPIFunc(__POSTCALENDAR__,'user','submitEvent',$eventdata)) {
diff --git a/interface/modules/zend_modules/vendor/dompdf/dompdf/www/demo.php b/interface/modules/zend_modules/vendor/dompdf/dompdf/www/demo.php
index 6d07acc29e5..02030318972 100644
--- a/interface/modules/zend_modules/vendor/dompdf/dompdf/www/demo.php
+++ b/interface/modules/zend_modules/vendor/dompdf/dompdf/www/demo.php
@@ -81,4 +81,4 @@
-
\ No newline at end of file
+
diff --git a/interface/patient_file/encounter/diagnosis.php b/interface/patient_file/encounter/diagnosis.php
index 0aeefe04196..0a846f527d6 100644
--- a/interface/patient_file/encounter/diagnosis.php
+++ b/interface/patient_file/encounter/diagnosis.php
@@ -79,7 +79,7 @@
foreach ($diags as $diag) {
$justify_string .= $diag . ":";
}
- $sql[] = "UPDATE billing set justify = concat(justify,'" . mysql_real_escape_string($justify_string) ."') where encounter = '" . mysql_real_escape_string($_POST['encounter_id']) . "' and pid = '" . mysql_real_escape_string($_POST['patient_id']) . "' and code = '" . mysql_real_escape_string($proc) . "'";
+ $sql[] = "UPDATE billing set justify = concat(justify,'" . add_escape_custom($justify_string) ."') where encounter = '" . add_escape_custom($_POST['encounter_id']) . "' and pid = '" . add_escape_custom($_POST['patient_id']) . "' and code = '" . add_escape_custom($proc) . "'";
}
}
@@ -99,9 +99,9 @@
trim($ndc['ndcqty']);
}
sqlStatement("UPDATE billing SET ndc_info = '$ndc_info' WHERE " .
- "encounter = '" . mysql_real_escape_string($_POST['encounter_id']) . "' AND " .
- "pid = '" . mysql_real_escape_string($_POST['patient_id']) . "' AND " .
- "code = '" . mysql_real_escape_string($ndc['code']) . "'");
+ "encounter = '" . add_escape_custom($_POST['encounter_id']) . "' AND " .
+ "pid = '" . add_escape_custom($_POST['patient_id']) . "' AND " .
+ "code = '" . add_escape_custom($ndc['code']) . "'");
}
}
diff --git a/interface/patient_file/encounter/forms.php b/interface/patient_file/encounter/forms.php
index e0f56c830e5..9d0b63a1e31 100644
--- a/interface/patient_file/encounter/forms.php
+++ b/interface/patient_file/encounter/forms.php
@@ -7,6 +7,7 @@
require_once("../../globals.php");
require_once("$srcdir/forms.inc");
+require_once("$srcdir/formdata.inc.php");
require_once("$srcdir/calendar.inc");
require_once("$srcdir/acl.inc");
require_once("$srcdir/formatting.inc.php");
diff --git a/interface/patient_file/summary/summary_title.php b/interface/patient_file/summary/summary_title.php
index 79b67630b09..1c8d164d943 100644
--- a/interface/patient_file/summary/summary_title.php
+++ b/interface/patient_file/summary/summary_title.php
@@ -1,5 +1,6 @@
_table . " WHERE foreign_id " .$foreign_id ;
diff --git a/library/classes/Company.class.php b/library/classes/Company.class.php
index f7fa68e8aef..a1af1d18298 100644
--- a/library/classes/Company.class.php
+++ b/library/classes/Company.class.php
@@ -51,7 +51,7 @@ function factory_company($foreign_id = "") {
$foreign_id= "like '%'";
}
else {
- $foreign_id= " = '" . mysql_real_escape_string(strval($foreign_id)) . "'";
+ $foreign_id= " = '" . add_escape_custom(strval($foreign_id)) . "'";
}
$a = new Address();
$sql = "SELECT id FROM " . $a->_table . " WHERE foreign_id " .$foreign_id ;
diff --git a/library/classes/Document.class.php b/library/classes/Document.class.php
index 642ef761814..e5dd18f5e25 100644
--- a/library/classes/Document.class.php
+++ b/library/classes/Document.class.php
@@ -154,7 +154,7 @@ function documents_factory($foreign_id = "") {
$foreign_id= "like '%'";
}
else {
- $foreign_id= " = '" . mysql_real_escape_string(strval($foreign_id)) . "'";
+ $foreign_id= " = '" . add_escape_custom(strval($foreign_id)) . "'";
}
$d = new Document();
@@ -185,7 +185,7 @@ function document_factory_url($url) {
die("An invalid URL was specified to crete a new document, this would only be caused if files are being deleted as you are working through the queue. '$filename'\n");
}
- $sql = "SELECT id FROM " . $d->_table . " WHERE url= '" . mysql_real_escape_string($url) ."'" ;
+ $sql = "SELECT id FROM " . $d->_table . " WHERE url= '" . add_escape_custom($url) ."'" ;
$result = $d->_db->Execute($sql);
if ($result && !$result->EOF) {
diff --git a/library/classes/InsuranceCompany.class.php b/library/classes/InsuranceCompany.class.php
index 25f66d23941..6d87d54ac23 100644
--- a/library/classes/InsuranceCompany.class.php
+++ b/library/classes/InsuranceCompany.class.php
@@ -305,11 +305,11 @@ function insurance_companies_factory ($city = "", $sort = "ORDER BY name, id") {
$city= "";
}
else {
- $city = " WHERE city = " . mysql_real_escape_string($foreign_id);
+ $city = " WHERE city = " . add_escape_custom($foreign_id);
}
$p = new InsuranceCompany();
$icompanies = array();
- $sql = "SELECT p.id, a.city FROM " . $p->_table . " as p INNER JOIN addresses as a on p.id = a.foreign_id " .$city . " " . mysql_real_escape_string($sort);
+ $sql = "SELECT p.id, a.city FROM " . $p->_table . " as p INNER JOIN addresses as a on p.id = a.foreign_id " .$city . " " . add_escape_custom($sort);
//echo $sql . " ";
$results = sqlQ($sql);
diff --git a/library/classes/Note.class.php b/library/classes/Note.class.php
index 99e1ed9683a..7d288b81c6e 100644
--- a/library/classes/Note.class.php
+++ b/library/classes/Note.class.php
@@ -79,7 +79,7 @@ function notes_factory($foreign_id = "") {
$foreign_id= "like '%'";
}
else {
- $foreign_id= " = '" . mysql_real_escape_string(strval($foreign_id)) . "'";
+ $foreign_id= " = '" . add_escape_custom(strval($foreign_id)) . "'";
}
$d = new note();
diff --git a/library/classes/Patient.class.php b/library/classes/Patient.class.php
index 589149d009c..699f73eef6e 100644
--- a/library/classes/Patient.class.php
+++ b/library/classes/Patient.class.php
@@ -45,7 +45,7 @@ function populate() {
$res = sqlQuery("SELECT providerID,fname,lname,mname ".
", DATE_FORMAT(DOB,'%m/%d/%Y') as date_of_birth ".
", pubpid ".
- " from " . $this->_table ." where pid =". mysql_real_escape_string($this->id));
+ " from " . $this->_table ." where pid =". add_escape_custom($this->id));
if (is_array($res)) {
$this->pubpid = $res['pubpid'];
$this->lname = $res['lname'];
diff --git a/library/classes/Pharmacy.class.php b/library/classes/Pharmacy.class.php
index abc2852dd4d..e0904cfc603 100644
--- a/library/classes/Pharmacy.class.php
+++ b/library/classes/Pharmacy.class.php
@@ -185,11 +185,11 @@ function pharmacies_factory ($city = "", $sort = "ORDER BY name") {
$city= "";
}
else {
- $city = " WHERE city = " . mysql_real_escape_string($foreign_id);
+ $city = " WHERE city = " . add_escape_custom($foreign_id);
}
$p = new Pharmacy();
$pharmacies = array();
- $sql = "SELECT p.id, a.city FROM " . $p->_table . " as p INNER JOIN addresses as a on p.id = a.foreign_id " .$city . " " . mysql_real_escape_string($sort);
+ $sql = "SELECT p.id, a.city FROM " . $p->_table . " as p INNER JOIN addresses as a on p.id = a.foreign_id " .$city . " " . add_escape_custom($sort);
//echo $sql . " ";
$results = sqlQ($sql);
diff --git a/library/classes/PhoneNumber.class.php b/library/classes/PhoneNumber.class.php
index 58257910af7..f2b810fac60 100644
--- a/library/classes/PhoneNumber.class.php
+++ b/library/classes/PhoneNumber.class.php
@@ -51,7 +51,7 @@ static function factory_phone_numbers($foreign_id = "") {
$foreign_id= "like '%'";
}
else {
- $foreign_id= " = '" . mysql_real_escape_string(strval($foreign_id)) . "'";
+ $foreign_id= " = '" . add_escape_custom(strval($foreign_id)) . "'";
}
$phone_numbers = array();
$p = new PhoneNumber();
diff --git a/library/classes/Prescription.class.php b/library/classes/Prescription.class.php
index 4980c2393fc..daf86297000 100644
--- a/library/classes/Prescription.class.php
+++ b/library/classes/Prescription.class.php
@@ -1,6 +1,7 @@
provider->id) . "'";
+ $sql = "SELECT * FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" . add_escape_custom($this->provider->id) . "'";
$db = get_db();
$results = $db->Execute($sql);
if (!$results->EOF) {
@@ -568,7 +569,7 @@ function get_prescription_florida_display() {
$string .= $gnd . $this->provider->federal_drug_id . "\n";
- $sql = "SELECT * FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" . mysql_real_escape_string($this->provider->id) . "'";
+ $sql = "SELECT * FROM users JOIN facility AS f ON f.name = users.facility where users.id ='" . add_escape_custom($this->provider->id) . "'";
$results = $db->Execute($sql);
if (!$results->EOF) {
@@ -622,8 +623,8 @@ static function prescriptions_factory($patient_id,
require_once (dirname(__FILE__) . "/../translation.inc.php");
$p = new Prescription();
$sql = "SELECT id FROM " . $p->_table . " WHERE patient_id = " .
- mysql_real_escape_string($patient_id) .
- " ORDER BY " . mysql_real_escape_string($order_by);
+ add_escape_custom($patient_id) .
+ " ORDER BY " . add_escape_custom($order_by);
$results = sqlQ($sql);
while ($row = mysql_fetch_array($results) ) {
$prescriptions[] = new Prescription($row['id']);
diff --git a/library/classes/Provider.class.php b/library/classes/Provider.class.php
index a497188ed48..93568739049 100644
--- a/library/classes/Provider.class.php
+++ b/library/classes/Provider.class.php
@@ -41,7 +41,7 @@ function Provider ($id = "", $prefix = "") {
}
function populate() {
- $res = sqlQuery("SELECT fname,lname,federaldrugid, specialty, npi, state_license_number FROM users where id =". mysql_real_escape_string($this->id));
+ $res = sqlQuery("SELECT fname,lname,federaldrugid, specialty, npi, state_license_number FROM users where id =". add_escape_custom($this->id));
if (is_array($res)) {
$this->lname = $res['lname'];
diff --git a/library/classes/Tree.class.php b/library/classes/Tree.class.php
index a76afc4e176..a65ef17425e 100644
--- a/library/classes/Tree.class.php
+++ b/library/classes/Tree.class.php
@@ -38,8 +38,8 @@ class Tree {
*/
function Tree($root,$root_type = ROOT_TYPE_ID) {
$this->_db = $GLOBALS['adodb']['db'];
- $this->_root = mysql_real_escape_string($root);
- $this->_root_type = mysql_real_escape_string($root_type);
+ $this->_root = add_escape_custom($root);
+ $this->_root_type = add_escape_custom($root_type);
$this->load_tree();
}
diff --git a/library/custom_template/ckeditor/_samples/assets/_posteddata.php b/library/custom_template/ckeditor/_samples/assets/_posteddata.php
index bb4b7eada16..0d052781cc6 100644
--- a/library/custom_template/ckeditor/_samples/assets/_posteddata.php
+++ b/library/custom_template/ckeditor/_samples/assets/_posteddata.php
@@ -32,10 +32,7 @@
foreach ( $postArray as $sForm => $value )
{
- if ( get_magic_quotes_gpc() )
- $postedValue = htmlspecialchars( stripslashes( $value ) ) ;
- else
- $postedValue = htmlspecialchars( $value ) ;
+ $postedValue = htmlspecialchars( $value ) ;
?>
|
diff --git a/library/formdata.inc.php b/library/formdata.inc.php
index a4f4e8e9208..125d8e38849 100644
--- a/library/formdata.inc.php
+++ b/library/formdata.inc.php
@@ -287,4 +287,13 @@ function strip_escape_custom($s) {
function formTrim($s) {
return formDataCore($s,true);
}
+
+/**
+ * Wrapper function for get_magic_quotes_gpc()
+ *
+ * @return int
+ */
+function check_magic_quotes() {
+ return get_magic_quotes_gpc();
+}
?>
diff --git a/library/patient.inc b/library/patient.inc
index e7b96520ec7..39519d05048 100644
--- a/library/patient.inc
+++ b/library/patient.inc
@@ -263,7 +263,7 @@ function getProviderInfo($providerID = "%", $providers_only = true, $facility =
}
$query = "select distinct id, username, lname, fname, authorized, info, facility " .
"from users where username != '' and active = 1 and id $command '" .
- mysql_real_escape_string($providerID) . "' " . $param1 . $param2;
+ add_escape_custom($providerID) . "' " . $param1 . $param2;
// sort by last name -- JRM June 2008
$query .= " ORDER BY lname, fname ";
$rez = sqlStatement($query);
@@ -294,7 +294,7 @@ function getCalendarProviderInfo($providerID = "%", $providers_only = true) {
}
$query = "select distinct id, username, lname, fname, authorized, info, facility " .
"from users where active = 1 and username != '' and id $command '" .
- mysql_real_escape_string($providerID) . "' " . $param1;
+ add_escape_custom($providerID) . "' " . $param1;
$rez = sqlStatement($query);
for($iter=0; $row=sqlFetchArray($rez); $iter++)
diff --git a/library/report.inc b/library/report.inc
index d6323eef22b..ed5e0ebbe99 100644
--- a/library/report.inc
+++ b/library/report.inc
@@ -295,8 +295,8 @@ function getPatientBillingEncounter($pid, $encounter) {
"LEFT JOIN users AS u ON " .
"( b.provider_id != 0 AND u.id = b.provider_id ) OR " .
"( b.provider_id = 0 AND u.id = $inv_provider ) " .
- "WHERE pid='" . mysql_real_escape_string($pid) . "' AND " .
- "encounter = '" . mysql_real_escape_string($encounter) .
+ "WHERE pid='" . add_escape_custom($pid) . "' AND " .
+ "encounter = '" . add_escape_custom($encounter) .
"' AND activity = '1' ORDER BY date";
/******************************************************************/
$res = sqlStatement($sql);
diff --git a/library/spreadsheet.inc.php b/library/spreadsheet.inc.php
index a954f997f85..711179f8dbb 100644
--- a/library/spreadsheet.inc.php
+++ b/library/spreadsheet.inc.php
@@ -22,7 +22,7 @@
// encode a string from a form field for database writing.
function form2db($fldval) {
$fldval = trim($fldval);
- if (!get_magic_quotes_gpc()) $fldval = addslashes($fldval);
+ $fldval = strip_escape_custom($fldval);
return $fldval;
}
@@ -34,7 +34,7 @@ function real2db($fldval) {
// Get the actual string from a form field.
function form2real($fldval) {
$fldval = trim($fldval);
- if (get_magic_quotes_gpc()) $fldval = stripslashes($fldval);
+ $fldval = strip_escape_custom($fldval);
return $fldval;
}