From a6a46ec556288f9e65ffa31a03c90026ccd56826 Mon Sep 17 00:00:00 2001 From: patrick Date: Sun, 9 Feb 2025 17:24:37 +0000 Subject: [PATCH] Refactor SQL queries --- admin/award_awardcreatedivisional.php | 72 +- admin/award_awards.php | 86 +- admin/award_download.php | 131 +- admin/award_upload.php | 93 +- admin/awards.inc.php | 28 +- admin/cms.php | 30 +- admin/committees.php | 34 +- admin/communication.php | 194 +- admin/documentdownloader.php | 4 +- admin/donations.php | 8 +- admin/donors.php | 173 +- admin/donors_search.php | 8 +- admin/exhibithall_sa.php | 24 +- admin/export_checkin.php | 18 +- admin/fair_stats.php | 36 +- admin/fair_stats_select.php | 8 +- admin/fundraising.php | 40 +- admin/fundraising_campaigns.php | 110 +- admin/fundraising_campaigns_prospecting.php | 24 +- admin/fundraising_common.inc.php | 4 +- admin/fundraising_goals_handler.inc.php | 28 +- admin/fundraising_main.inc.php | 33 +- admin/fundraising_reports.php | 4 +- admin/fundraising_reports_std.php | 32 +- admin/fundraising_setup.php | 124 +- admin/fundraising_sponsorship.php | 4 +- admin/fundraising_sponsorship_handler.inc.php | 32 +- admin/fundraising_types.php | 4 +- admin/gettranslation.php | 4 +- admin/judges.inc.php | 48 +- admin/judges_info.php | 20 +- admin/judges_jdiv.php | 48 +- admin/judges_sa.php | 150 +- admin/judges_schedulerconfig_check.inc.php | 50 +- admin/judges_teams.php | 119 +- admin/judges_teams_members.php | 68 +- admin/judges_teams_projects.php | 42 +- admin/judges_teams_timeslots.php | 28 +- admin/judges_timeslots.php | 90 +- admin/judging_score_edit.php | 24 +- admin/judging_score_entry.php | 30 +- admin/project_editor.php | 126 +- admin/registration_list.php | 93 +- admin/registration_receivedforms.php | 62 +- admin/registration_stats.php | 15 +- admin/registration_webconsent.php | 18 +- admin/reports.inc.php | 48 +- admin/reports.php | 31 +- admin/reports_acscript.php | 26 +- admin/reports_appeal_letters.php | 7 +- admin/reports_ceremony.php | 8 +- admin/reports_gen.php | 16 +- admin/reports_judges.inc.php | 34 +- admin/reports_judges.php | 20 +- admin/reports_judges_allyears.php | 8 +- admin/reports_judges_teams_projects.php | 24 +- admin/reports_mailinglabels_generator.php | 8 +- admin/reports_program_awards.php | 16 +- admin/reports_projects_details.php | 15 +- admin/reports_projects_judges_teams.php | 22 +- admin/reports_students.inc.php | 28 +- admin/rerollprizes.php | 154 +- admin/schools.php | 105 +- admin/schoolsimport.php | 47 +- admin/send_emailqueue.php | 28 +- admin/settranslation.php | 16 +- admin/sponsor_contacts.php | 18 +- admin/student_editor.php | 215 ++- admin/tours_assignments.php | 50 +- admin/tours_manager.php | 8 +- admin/tours_sa.php | 31 +- admin/tours_sa_config.php | 10 +- admin/translations.php | 11 +- admin/user_editor_window.php | 8 +- admin/user_list.php | 20 +- admin/winners.php | 72 +- app/projectinfo.php | 17 +- app/projectlist.php | 12 +- app/projects.php | 12 +- committees.php | 2 +- common.inc.php | 1585 +++++++++-------- config/backuprestore.php | 20 +- config/categories.php | 55 +- config/dates.php | 18 +- config/divisions.php | 75 +- config/divisions_cwsf.php | 8 +- config/languagepacks.php | 4 +- config/pagetexts.php | 43 +- config/rollover.php | 207 +-- config/rolloverfiscal.php | 28 +- config/safetyquestions.php | 38 +- config/signaturepage.php | 8 +- config/subdivisions.php | 44 +- config/variables.php | 21 +- config_editor.inc.php | 27 +- confirmed_participants.php | 16 +- contact.php | 9 +- db/db.update.111.php | 8 +- db/db.update.116.php | 112 +- db/db.update.117.php | 12 +- db/db.update.118.php | 34 +- db/db.update.122.php | 20 +- db/db.update.129.php | 12 +- db/db.update.129.user.inc.php | 104 +- db/db.update.131.php | 20 +- db/db.update.136.php | 6 +- db/db.update.142.php | 4 +- db/db.update.146.php | 12 +- db/db.update.146.user.inc.php | 100 +- db/db.update.149.user.inc.php | 104 +- db/db.update.155.php | 8 +- db/db.update.174.php | 6 +- db/db.update.62.php | 42 +- db/db.update.75.php | 45 +- db/db.update.76.php | 16 +- db/db.update.81.php | 4 +- db/db.update.87.php | 4 +- db/db_update.php | 8 +- fair_additional_materials.inc.php | 6 +- fair_info.php | 18 +- fair_stats.php | 4 +- judge.inc.php | 24 +- judge_availability.php | 20 +- judge_expertise.php | 12 +- judge_main.php | 8 +- judge_project_summary.php | 12 +- judge_schedule.php | 26 +- judge_special_awards.php | 18 +- lpdf.php | 4 +- projects.inc.php | 68 +- questions.inc.php | 95 +- register_participants.inc.php | 92 +- register_participants.php | 84 +- register_participants_emergencycontact.php | 47 +- register_participants_isefforms.php | 40 +- register_participants_main.php | 24 +- register_participants_mentor.php | 78 +- register_participants_namecheck.php | 11 +- register_participants_project.php | 81 +- ..._participants_project_divisionselector.php | 20 +- register_participants_safety.php | 28 +- register_participants_signature.php | 50 +- register_participants_signature_tcpdf.php | 49 +- register_participants_spawards.php | 34 +- register_participants_students.php | 204 ++- register_participants_tours.php | 62 +- remote.php | 143 +- schoolaccess.php | 40 +- schoolinvite.php | 110 +- scripts/assignprojectnumbers.php | 12 +- scripts/assigntourrankings.php | 4 +- scripts/judges_fake.php | 32 +- scripts/populate_fake.php | 12 +- scripts/rolloverschools.php | 12 +- sponsor_main.php | 16 +- tableeditor.class.php | 36 +- tours.class.php | 16 +- user.inc.php | 88 +- user_invite.php | 8 +- user_new.php | 4 +- user_personal.php | 4 +- volunteer.inc.php | 6 +- volunteer_position.php | 24 +- winners.php | 26 +- 164 files changed, 4208 insertions(+), 4059 deletions(-) diff --git a/admin/award_awardcreatedivisional.php b/admin/award_awardcreatedivisional.php index 449619a2..4e5faf60 100644 --- a/admin/award_awardcreatedivisional.php +++ b/admin/award_awardcreatedivisional.php @@ -44,19 +44,19 @@ else if (get_value_from_array($_POST, 'award_types_id')) // first, we can only do this if we dont have any type=divisional awards created yet -$q = $pdo->prepare("SELECT COUNT(id) AS num FROM award_awards WHERE award_types_id='1' AND year='{$config['FAIRYEAR']}'"); -$q->execute(); +$q = $pdo->prepare("SELECT COUNT(id) AS num FROM award_awards WHERE award_types_id='1' AND year=?"); +$q->execute([$config['FAIRYEAR']]); $r = $q->fetch(PDO::FETCH_OBJ); if ($r->num) { echo error(i18n('%1 Divisional awards already exist. There must not be any divisional awards in order to run this wizard', array($r->num))); } else { - $q = $pdo->prepare("SELECT * FROM projectdivisions WHERE year='" . $config['FAIRYEAR'] . "' ORDER BY id"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM projectdivisions WHERE year=? ORDER BY id"); + $q->execute([$config['FAIRYEAR']]); while ($r = $q->fetch(PDO::FETCH_OBJ)) $div[$r->id] = $r->division; - $q = $pdo->prepare("SELECT * FROM projectcategories WHERE year='" . $config['FAIRYEAR'] . "' ORDER BY id"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM projectcategories WHERE year=? ORDER BY id"); + $q->execute([$config['FAIRYEAR']]); while ($r = $q->fetch(PDO::FETCH_OBJ)) $cat[$r->id] = $r->category; @@ -64,8 +64,8 @@ if ($r->num) { $ckeys = array_keys($cat); if ($config['filterdivisionbycategory'] == 'yes') { - $q = $pdo->prepare("SELECT * FROM projectcategoriesdivisions_link WHERE year='" . $config['FAIRYEAR'] . "' ORDER BY projectdivisions_id,projectcategories_id"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM projectcategoriesdivisions_link WHERE year=? ORDER BY projectdivisions_id,projectcategories_id"); + $q->execute([$config['FAIRYEAR']]); $divcat = array(); while ($r = $q->fetch(PDO::FETCH_OBJ)) { $divcat[] = array('c' => $r->projectcategories_id, 'd' => $r->projectdivisions_id); @@ -109,44 +109,42 @@ if ($r->num) { echo i18n('Creating %1 - %2', array($c_category, $d_division)) . '
'; - $q = $pdo->prepare("INSERT INTO award_awards (sponsors_id,award_types_id,name,criteria,`order`,year) VALUES ( - '{$_GET['sponsors_id']}', - '1', - '$c_category - $d_division', - '" . i18n('Best %1 projects in the %2 division', array($c_category, $d_division)) . "', - '$ord', - '{$config['FAIRYEAR']}' - )"); - $q->execute(); + $q = $pdo->prepare("INSERT INTO award_awards (sponsors_id, award_types_id, name, criteria, `order`, year) + VALUES (?, '1', ?, ?, ?, ?)"); + $q->execute([$_GET['sponsors_id'], i18n('Best %1 projects in the %2 division', [$c_category, $d_division]), + $c_category, $ord, $config['FAIRYEAR']]); + show_pdo_errors_if_any($pdo); $award_awards_id = $pdo->lastInsertId(); - $q = $pdo->prepare("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) VALUES ('$award_awards_id','$c_id','{$config['FAIRYEAR']}')"); - $q->execute(); + $q = $pdo->prepare("INSERT INTO award_awards_projectcategories (award_awards_id,projectcategories_id,year) VALUES (?,?,?"); + $q->execute([$award_awards_id,$c_id,$config['FAIRYEAR']]); - $q = $pdo->prepare("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) VALUES ('$award_awards_id','$d_id','{$config['FAIRYEAR']}')"); - $q->execute(); + $q = $pdo->prepare("INSERT INTO award_awards_projectdivisions (award_awards_id,projectdivisions_id,year) VALUES (?,?,?)"); + $q->execute([$award_awards_id,$d_id,$config['FAIRYEAR']]); $ord++; echo '  ' . i18n('Prizes: '); foreach ($prizes AS $prize) { - $q = $pdo->prepare("INSERT INTO award_prizes (award_awards_id,cash,scholarship,value,prize,number,`order`,excludefromac,trophystudentkeeper,trophystudentreturn,trophyschoolkeeper,trophyschoolreturn,year) VALUES ( - '$award_awards_id', - '{$prize['cash']}', - '{$prize['scholarship']}', - '{$prize['value']}', - '{$prize['prize']}', - '{$prize['number']}', - '{$prize['order']}', - '{$prize['excludefromac']}', - '{$prize['trophystudentkeeper']}', - '{$prize['trophystudentreturn']}', - '{$prize['trophyschoolkeeper']}', - '{$prize['trophyschoolreturn']}', - '{$config['FAIRYEAR']}' - )"); + $q = $pdo->prepare("INSERT INTO award_prizes (award_awards_id, cash, scholarship, value, prize, number, `order`, excludefromac, trophystudentkeeper, trophystudentreturn, trophyschoolkeeper, trophyschoolreturn, year) + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); + + $q->execute([ + $award_awards_id, + $prize['cash'], + $prize['scholarship'], + $prize['value'], + $prize['prize'], + $prize['number'], + $prize['order'], + $prize['excludefromac'], + $prize['trophystudentkeeper'], + $prize['trophystudentreturn'], + $prize['trophyschoolkeeper'], + $prize['trophyschoolreturn'], + $config['FAIRYEAR'] + ]); - $q->execute(); echo $prize['prize'] . ','; } diff --git a/admin/award_awards.php b/admin/award_awards.php index 08028650..2ec8f925 100644 --- a/admin/award_awards.php +++ b/admin/award_awards.php @@ -33,8 +33,8 @@ $_GET['action'] = $_GET['action'] ?? ''; switch ($_GET['action']) { case 'awardinfo_load': $id = intval(get_value_from_array($_GET, 'id')); - $q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$id'"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM award_awards WHERE id=?"); + $q->execute([$id]); $ret = $q->fetch(PDO::FETCH_ASSOC); // json_encode NEEDS UTF8 DATA, but we store it in the database as ISO :( @@ -57,8 +57,8 @@ switch ($_GET['action']) { if ($id == -1) { $q = $pdo->prepare("INSERT INTO award_awards (year,self_nominate,schedule_judges) - VALUES ('{$config['FAIRYEAR']}','yes','yes')"); - $q->execute(); + VALUES (?,'yes','yes')"); + $q->execute([$config['FAIRYEAR']]); $id = $pdo->lastInsertId(); happy_('Award Created'); /* Set the award_id in the client */ @@ -83,9 +83,9 @@ switch ($_GET['action']) { criteria='" . iconv('UTF-8', 'ISO-8859-1', stripslashes($_POST['criteria'])) . "', sponsors_id='" . intval($_POST['sponsors_id']) . "' "; } - $q .= "WHERE id='$id'"; + $q .= "WHERE id=?"; $q = $pdo->prepare($q); - $q->execute(); + $q->execute([$id]); print_r($_POST); echo $q; show_pdo_errors_if_any($pdo); @@ -97,15 +97,15 @@ switch ($_GET['action']) { // select the current categories that this award is linked to $ret = array('categories' => array(), 'divisions' => array()); - $q = $pdo->prepare("SELECT * FROM award_awards_projectcategories WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM award_awards_projectcategories WHERE award_awards_id=?"); + $q->execute([$id]); while ($r = $q->fetch(PDO::FETCH_ASSOC)) { $ret['categories'][] = $r['projectcategories_id']; } // select the current categories that this award is linked to - $q = $pdo->$prepare("SELECT * FROM award_awards_projectdivisions WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->$prepare("SELECT * FROM award_awards_projectdivisions WHERE award_awards_id=?"); + $q->execute([$id]); while ($r = $q->fetch(PDO::FETCH_ASSOC)) { $ret['divisions'][] = $r['projectdivisions_id']; } @@ -122,8 +122,8 @@ switch ($_GET['action']) { } // wipe out any old award-category links - $q = $pdo->prepare("DELETE FROM award_awards_projectcategories WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->prepare("DELETE FROM award_awards_projectcategories WHERE award_awards_id=?"); + $q->execute([$id]); foreach ($_POST['categories'] AS $key => $cat) { $c = intval($cat); $q = $pdo->prepare('INSERT INTO award_awards_projectcategories (award_awards_id, projectcategories_id, year) @@ -138,8 +138,8 @@ switch ($_GET['action']) { // wipe out any old award-divisions links - $q = $pdo->prepare("DELETE FROM award_awards_projectdivisions WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->prepare("DELETE FROM award_awards_projectdivisions WHERE award_awards_id=?"); + $q->execute([$id]); // now add the new ones foreach ($_POST['divisions'] AS $key => $div) { @@ -165,8 +165,8 @@ switch ($_GET['action']) { continue; $order++; - $q = $pdo->prepare("UPDATE `award_prizes` SET `order`='$order' WHERE `id`='$id'"); - $q->execute(); + $q = $pdo->prepare("UPDATE `award_prizes` SET `order`=? WHERE `id`=?"); + $q->execute([$order, $id]); } // print_r($_GET); happy_('Order Updated.'); @@ -179,8 +179,8 @@ switch ($_GET['action']) { continue; $order++; - $q = $pdo->prepare("UPDATE `award_awards` SET `order`='$order' WHERE `id`='$id'"); - $q->execute(); + $q = $pdo->prepare("UPDATE `award_awards` SET `order`=? WHERE `id`=?"); + $q->execute([$order, $id]); } happy_('Order updated'); exit; @@ -191,8 +191,8 @@ switch ($_GET['action']) { $q = $pdo->prepare("SELECT * FROM award_prizes WHERE year='-1' AND award_awards_id='0' ORDER BY `order`"); $q->execute(); } else { - $q = $pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id='$id' ORDER BY `order`"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM award_prizes WHERE award_awards_id=? ORDER BY `order`"); + $q->execute([$id]); } while ($r = $q->fetch(PDO::FETCH_ASSOC)) { foreach ($r AS $k => $v) { @@ -205,8 +205,8 @@ switch ($_GET['action']) { case 'prize_load': $id = intval($_GET['id']); - $q = $pdo->prepare("SELECT * FROM award_prizes WHERE id='$id'"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM award_prizes WHERE id=?"); + $q->execute([$id]); $ret = $q->fetch(PDO::FETCH_ASSOC); foreach ($ret AS $k => $v) { $ret[$k] = iconv('ISO-8859-1', 'UTF-8', $v); @@ -276,8 +276,8 @@ switch ($_GET['action']) { $id = intval($_GET['id']); /* Prepare two lists of fair IDs, for which fairs can upload and download this award */ - $q = $pdo->prepare("SELECT * FROM fairs_awards_link WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM fairs_awards_link WHERE award_awards_id=?"); + $q->execute([$id]); $ul = array(); $dl = array(); while ($r = $q->fetch(PDO::FETCH_ASSOC)) { @@ -287,8 +287,8 @@ switch ($_GET['action']) { $dl[$r['fairs_id']] = true; } - $q = $pdo->prepare("SELECT * FROM award_awards WHERE id='$id'"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM award_awards WHERE id=?"); + $q->execute([$id]); $a = $q->fetch(PDO::FETCH_ASSOC); ?>

@@ -354,16 +354,16 @@ switch ($_GET['action']) { /* Now save each one */ - $q = $pdo->prepare("DELETE FROM fairs_awards_link WHERE award_awards_id='$id'"); - $q->execute(); + $q = $pdo->prepare("DELETE FROM fairs_awards_link WHERE award_awards_id=?"); + $q->execute([$id]); show_pdo_errors_if_any($pdo); foreach ($data as $fairs_id => $f) { $dl = ($f['dl'] == true) ? 'yes' : 'no'; $ul = ($f['ul'] == true) ? 'yes' : 'no'; $q = $pdo->prepare("INSERT INTO fairs_awards_link (award_awards_id,fairs_id,download_award,upload_winners) - VALUES ('$id','$fairs_id','$dl','$ul')"); - $q->execute(); + VALUES (?,?,?,?)"); + $q->execute([$id,$fairs_id,$dl,$ul]); show_pdo_errors_if_any($pdo); } $ident = stripslashes($_POST['identifier']); @@ -371,12 +371,12 @@ switch ($_GET['action']) { $mat = intval($_POST['additional_materials']); $w = intval($_POST['register_winners']); - $q = $pdo->prepare("UPDATE award_awards SET external_identifier='$ident', - external_additional_materials='$mat', - external_register_winners='$w', - per_fair='$per_fair' - WHERE id='$id'"); - $q->execute(); + $q = $pdo->prepare("UPDATE award_awards SET external_identifier=?, + external_additional_materials=?, + external_register_winners=?, + per_fair=? + WHERE id=?"); + $q->execute([[$ident, $mat,$w],$per_fair,$id]); happy_('Feeder Fair information saved'); exit; @@ -729,8 +729,8 @@ while ($sr = $sq->fetch(PDO::FETCH_OBJ)) { : prepare("SELECT id,type FROM award_types WHERE year='{$config['FAIRYEAR']}' ORDER BY type"); -$tq->execute(); +$tq = $pdo->prepare("SELECT id,type FROM award_types WHERE year=? ORDER BY type"); +$tq->execute([$config['FAIRYEAR']]); echo ''; echo '\n"; @@ -255,10 +260,10 @@ switch (get_value_from_array($_GET, 'action')) { if (count($uids)) { $tq = $pdo->prepare("SELECT * FROM fundraising_campaigns_users_link - WHERE fundraising_campaigns_id='$r->id' + WHERE fundraising_campaigns_id=? AND users_uid IN (" . implode(',', $uids) . ') '); - $tq->execute(); + $tq->execute([$r->id]); if ($tq->rowCount()) { $incampaign = i18n('*In Appeal*') . ': '; } else @@ -284,8 +289,8 @@ switch (get_value_from_array($_GET, 'action')) { echo '\n"; // FIXME: only show campaigns that they were included as part of // we need a campaigns_users_link or campaigns_sponsors_link or something - $q = $pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear='{$config['FISCALYEAR']}' ORDER BY name"); - $q->execute(); + $q = $pdo->prepare("SELECT * FROM fundraising_goals WHERE fiscalyear=? ORDER BY name"); + $q->execute([$config['FISCALYEAR']]); while ($r = $q->fetch(PDO::FETCH_OBJ)) { echo "\n"; } @@ -365,8 +370,8 @@ switch (get_value_from_array($_GET, 'action')) { case 'newcontactsearch': if ($_POST['email']) - $q = $pdo->prepare("SELECT *,MAX(year) FROM users WHERE email='" . trim($_POST['email']) . "' GROUP BY uid HAVING deleted='no'"); - $q->execute(); + $q = $pdo->prepare("SELECT *,MAX(year) FROM users WHERE email=? GROUP BY uid HAVING deleted='no'"); + $q->execute([trim($_POST['email'])]); if ($r = $q->fetch(PDO::FETCH_OBJ)) { echo i18n('There is an exact email address match for %1', array($_POST['email'])); echo '