Use unique parameters for SQL query, like in #464

Also save IDs as string, like in #520
parent 5be0cc12
...@@ -48,15 +48,15 @@ class ConversationDB extends DB ...@@ -48,15 +48,15 @@ class ConversationDB extends DB
$query .= 'AND `chat_id` = :chat_id '; $query .= 'AND `chat_id` = :chat_id ';
$query .= 'AND `user_id` = :user_id '; $query .= 'AND `user_id` = :user_id ';
if (!is_null($limit)) { if ($limit !== null) {
$query .= ' LIMIT :limit'; $query .= ' LIMIT :limit';
} }
$sth = self::$pdo->prepare($query); $sth = self::$pdo->prepare($query);
$active = 'active'; $status = 'active';
$sth->bindParam(':status', $active, PDO::PARAM_STR); $sth->bindParam(':status', $status);
$sth->bindParam(':user_id', $user_id, PDO::PARAM_INT); $sth->bindParam(':user_id', $user_id);
$sth->bindParam(':chat_id', $chat_id, PDO::PARAM_INT); $sth->bindParam(':chat_id', $chat_id);
$sth->bindParam(':limit', $limit, PDO::PARAM_INT); $sth->bindParam(':limit', $limit, PDO::PARAM_INT);
$sth->execute(); $sth->execute();
...@@ -84,24 +84,26 @@ class ConversationDB extends DB ...@@ -84,24 +84,26 @@ class ConversationDB extends DB
} }
try { try {
$sth = self::$pdo->prepare('INSERT INTO `' . TB_CONVERSATION . '` $sth = self::$pdo->prepare('INSERT INTO `' . TB_CONVERSATION . '`
( (
`status`, `user_id`, `chat_id`, `command`, `notes`, `created_at`, `updated_at` `status`, `user_id`, `chat_id`, `command`, `notes`, `created_at`, `updated_at`
) )
VALUES ( VALUES (
:status, :user_id, :chat_id, :command, :notes, :date, :date :status, :user_id, :chat_id, :command, :notes, :created_at, :updated_at
) )
'); ');
$active = 'active';
$status = 'active';
$notes = '[]'; $notes = '[]';
$created_at = self::getTimestamp(); $date = self::getTimestamp();
$sth->bindParam(':status', $active); $sth->bindParam(':status', $status);
$sth->bindParam(':command', $command); $sth->bindParam(':command', $command);
$sth->bindParam(':user_id', $user_id); $sth->bindParam(':user_id', $user_id);
$sth->bindParam(':chat_id', $chat_id); $sth->bindParam(':chat_id', $chat_id);
$sth->bindParam(':notes', $notes); $sth->bindParam(':notes', $notes);
$sth->bindParam(':date', $created_at); $sth->bindParam(':created_at', $date);
$sth->bindParam(':updated_at', $date);
$status = $sth->execute(); $status = $sth->execute();
} catch (Exception $e) { } catch (Exception $e) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment