www: url_helpers: Convert set_custom_field_names() to IS_SET()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_helpers: Convert do_update_user() to IS_SET()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_helpers: Convert do_edit_user() to IS_SET()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: Move the file_info structure into common.h

Due to struct file_info being needed elsewhere than utils.c, move it
into common.h with the other structure definitions.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: common: Remove extern from the structure declarations

Seeing as common.h is included everywhere needed, the extern keyword for
the structures is redundant.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Remove redundant structure declarations

The user_session and env_vars structures are declared in common.h which
is included here.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: common: Make user_session match other structure declarations

Use user_session instead of session. This matches with how the other
structures are declared.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: Create a wrapper around mysql_real_escape_string()

The purpose of mysql_real_escape_string() is to make safe any strings
that come from user input or are under outside control etc that will be
used in a mysql query, to help prevent SQL injection attacks. It does
this by escaping various characters like  ", ' and some others. e.g

    'Tom's Garage'

would become

    'Tom\'s Garage'

mysql_real_escape_string can be a little unwieldy to use at times with
its four function arguments. So create a simple wrapper around it,
reducing the number of arguments to two, the mysql connection and the
string to make safe.

The string it returns is the string that is safe to pass to mysql and
must be free'd.

I made this a static inline function rather than a macro due to inline
functions seeming to be prefereable to macros and also because of the
somewhat sensitive nature of it, in making sure we pass safe data to
mysql, I thought we'd maybe benefit from the type checking and general
robustness you get with a function.

While this doesn't reduce the number of lines of code needed, it does
make for a bit less typing and less code split across lines. e.g

    safe_string = alloca(strlen(dangerous_string) * 2 + 1);
    mysql_real_escape_string(conn, safe_string, dangerous_string,
			     strlen(dangerous_string));
    /* use safe_string in mysql query */

would now be written as

    safe_string = make_mysql_safe_string(conn, dangerous_string);
    /* use safe_string in mysql query */
    free(safe_string);

Note: We can't use alloca(3) in an inline function.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: audit: Convert log_login() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert delete_image() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert activate_user() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert generate_new_key() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert forgotten_password() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert process_receipt_approval() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert receipt_info() to make_mysql_safe_string()

We also fix a potential memory leak from not freeing the mysql result if
we got 0 rows returned.

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Convert process_receipt() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_handlers: Remove the alloca include

The use of alloca(3) has been removed from url_handlers.c due to the use
of make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_helpers: Convert username_to_name() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_helpers: Convert check_auth() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>
www: url_helpers: Convert is_users_receipt() to make_mysql_safe_string()

Signed-off-by: Andrew Clayton <andrew@opentechlabs.co.uk>