From 8835ba38c7a6f297cf353017dff62749260d3fd5 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Mon, 21 Mar 2011 11:21:49 +1300 Subject: [PATCH 2/2] Bug 5905 : Follow up fixing sql to use placeholders --- C4/Accounts.pm | 29 +++++++++-------------------- 1 files changed, 9 insertions(+), 20 deletions(-) diff --git a/C4/Accounts.pm b/C4/Accounts.pm index 8f4b26e..1ab7c21 100644 --- a/C4/Accounts.pm +++ b/C4/Accounts.pm @@ -179,31 +179,20 @@ sub makepayment { $finalamount = $partpaymentamount; $descriptionpayment="Part Payment for account n°".$accountno.",thanks - ".$user." : ".$data->{'description'}; } - $dbh->do( + $sth = $dbh->prepare( "UPDATE accountlines - SET amountoutstanding = $newamountoutstanding - WHERE id = $accountlineid - " - ); + SET amountoutstanding = ? + WHERE id = ? + "); + $sth->execute($newamountoutstanding,$accountlineid); - # print $updquery; - # $dbh->do( " - # INSERT INTO accountoffsets - # (borrowernumber, accountno, offsetaccount, - # offsetamount) - # VALUES ($borrowernumber, $accountno, $nextaccntno, $newamtos) - # " ); - - # create new line - - - $dbh->do( " + $sth = $dbh->prepare( " INSERT INTO accountlines (borrowernumber, accountno, date, time, amount, description, accounttype, amountoutstanding, note, meansofpayment, manager_id) - VALUES ($borrowernumber, $nextaccntno, now(), CURRENT_TIME, $payment, - '$descriptionpayment', 'Pay', 0, '$note', '$meansofpayment', '$manager_id') + VALUES (?,?, now(), CURRENT_TIME, ?, ?, 'Pay', 0, ?, ?, ?) " ); + $sth->execute($borrowernumber, $nextaccntno, $payment, $descriptionpayment, $note, $meansofpayment, $manager_id) # FIXME - The second argument to &UpdateStats is supposed to be the # branch code. @@ -216,7 +205,7 @@ sub makepayment { returnlost( $borrowernumber, $data->{'itemnumber'} ); } - my $sth = $dbh->prepare("SELECT max(id) AS lastinsertid FROM accountlines"); + $sth = $dbh->prepare("SELECT max(id) AS lastinsertid FROM accountlines"); $sth->execute(); my $datalastinsertid = $sth->fetchrow_hashref; $sth->finish; -- 1.7.1