Changeset 492

Timestamp:

09/23/10 20:47:50 (14 years ago)

Author:

Kris Deugau

Message:

/branches/htmlform

Fix allocation update execution to use DBI ? substitutions. See #34.

File:

• branches/htmlform/cgi-bin/main.cgi (modified) (2 diffs)

branches/htmlform/cgi-bin/main.cgi

@@ -1070 +1070 @@
     my $sql;
     if (my $pooltype = ($webvar{alloctype} =~ /^(.)i$/) ) {
-      $sql = "update poolips set custid='$webvar{custid}',notes='$webvar{notes}',".
-        "circuitid='$webvar{circid}',description='$webvar{desc}',city='$webvar{city}'".
+      $sql = "UPDATE poolips SET custid='$webvar{custid}',".
+        "city=?,description=?,notes=?,".
+        "circuitid='$webvar{circid}',".
         "$privdata where ip='$webvar{block}'";
     } else {
-      $sql = "update allocations set custid='$webvar{custid}',".
-        "description='$webvar{desc}',notes='$webvar{notes}',city='$webvar{city}',".
-        "type='$webvar{alloctype}',circuitid='$webvar{circid}'$privdata,".
+      $sql = "UPDATE allocations SET custid='$webvar{custid}',".
+        "city=?,description=?,notes=?,".
+        "circuitid='$webvar{circid}'$privdata,".
+        "type='$webvar{alloctype}',".
         "swip='".($webvar{swip} eq 'on' ? 'y' : 'n')."' ".
         "where cidr='$webvar{block}'";
@@ -1083 +1085 @@
     syslog "debug", $sql;
     $sth = $ip_dbh->prepare($sql);
-    $sth->execute;
+    $sth->execute($webvar{city}, $webvar{desc}, $webvar{notes});
 ## node hack
     if ($webvar{node}) {
+      # done with delete/insert so we don't have to worry about funkyness updating a node ref that isn't there
       $ip_dbh->do("DELETE FROM noderef WHERE block='$webvar{block}'");
       $sth = $ip_dbh->prepare("INSERT INTO noderef (block,node_id) VALUES (?,?)");