CVE-2018-17552 (published 2018-10-03T20:29Z)

SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/NavigateCMS/Navigate-CMS
commit_details: repo_url: https://github.com/NavigateCMS/Navigate-CMS
author: Navigate CMS
author_date: 2018-09-24 10:29:24+02:00
msg: * security fix: replace string filtering by parameterization in almost all queries
repository: repo_url: https://github.com/NavigateCMS/Navigate-CMS
repo_name: NavigateCMS/Navigate-CMS
description: Navigate CMS, a very powerful open source content management system for everybody.
repo_language: PHP
owner: NavigateCMS
file_changes: filename: core.php
change_type: ModificationType.MODIFY
diff: @@ -184,15 +184,22 @@ function core_load_function($fid)
             break;
 
         default:
+            $query_params = NULL;
             if(is_numeric($fid))
+            {
                 $where = 'id = '.intval($fid);
+            }
             else
-                $where = 'codename = '.protect($fid);
+            {
+                $where = 'codename = :codename';
+                $query_params = array(':codename' => $fid);
+            }
 
-            $DB->query('SELECT *
-                          FROM nv_functions
-                         WHERE '.$where.'
-                           AND enabled = 1');
+            $DB->query(
+                'SELECT * FROM nv_functions WHERE '.$where.' AND enabled = 1',
+                'object',
+                $query_params
+            );
 
             $func = $DB->first();
 
@@ -1179,9 +1186,9 @@ function navigate_compose_email($data, $style=array())
         $title_color = '#595959';
         $text_color = '#595959';
 
-        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.background_color") . ' AND website = ' . protect($website->id), 'id DESC');
-        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.text_color") . ' AND website = ' . protect($website->id), 'id DESC');
-        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = ' . protect("nvweb.comments.titles_color") . ' AND website = ' . protect($website->id), 'id DESC');
+        $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.background_color" AND website = ' . intval($website->id), 'id DESC');
+        $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.text_color" AND website = ' . intval($website->id), 'id DESC');
+        $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.comments.titles_color" AND website = ' . intval($website->id), 'id DESC');
 
         if (!empty($background_color_db))
             $background_color = str_replace('"', '', $background_color_db);

programming_language: PHP
filename: database.class.php
change_type: ModificationType.MODIFY
diff: @@ -92,10 +92,11 @@ class database
 	 * in the current active language.
 	 *
 	 * @param string $sql The complete SQL query
-	 * @param string $fetch_mode How to retrieve the data: "object" or "array" 
+	 * @param string $fetch_mode How to retrieve the data: "object" or "array"
+     * @param array $parameters SQL query parameters associative array
 	 * @return boolean True if the query was executed without errors
 	 */	
-	public function query($sql, $fetch_mode='object')
+	public function query($sql, $fetch_mode='object', $parameters=array())
 	{
 		$this->lastError = '';
 		$this->lastResult = '';
@@ -114,7 +115,15 @@ class database
 
 		try
 		{
-			$statement = $this->db->query($sql);
+		    if(empty($parameters))
+            {
+			    $statement = $this->db->query($sql);
+            }
+            else
+            {
+                $statement = $this->db->prepare($sql);
+                $statement->execute($parameters);
+            }
 			$this->queries_count++;
 
 			// avoid firing a fatal error exception when the result is NULL
@@ -146,17 +155,28 @@ class database
 	 * @param string $table Table name to get the data from
 	 * @param string $where SQL conditions in the WHERE clause
 	 * @param string $order SQL order conditions in the ORDER BY clause
+     * @param array $parameters SQL query parameters associative array
 	 * @return string|integer Value of the first column of the first row of the resultset
 	 */		
-	public function query_single($column, $table, $where = '1=1', $order = '')
+	public function query_single($column, $table, $where = '1=1', $order = '', $parameters=array())
 	{
 	    $rs = null;
         if(!empty($order))
             $order = ' ORDER BY '.$order;
 
+        $sql = 'SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1';
+
         try
         {
-            $stm = $this->db->query('SELECT ' . $column . ' FROM ' . $table . ' WHERE ' . $where . $order . ' LIMIT 1');
+            if(empty($parameters))
+            {
+                $stm = $this->db->query($sql);
+            }
+            else
+            {
+                $stm = $this->db->prepare($sql);
+                $stm->execute($parameters);
+            }
             $this->queries_count++;
             $stm->setFetchMode(PDO::FETCH_NUM);
             $rs = $stm->fetchAll();
@@ -168,8 +188,14 @@ class database
             return NULL;
         }
 
-		if(empty($rs)) 	return NULL;
-		else			return $rs[0][0];
+		if(empty($rs))
+		{
+            return NULL;
+        }
+		else
+        {
+            return $rs[0][0];
+        }
 	}
 
 
@@ -184,7 +210,7 @@ class database
 	 * @param integer $max How many rows will be returned of the resultset (after applying offset)
 	 * @return boolean True if the query could be executed without errors
 	 */	
-	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100)
+	public function	queryLimit($cols, $table, $where="1=1", $order="", $offset=0, $max=100, $parameters=array())
 	{		
 		$this->lastError = '';
 		$this->lastResult = '';	
@@ -199,7 +225,16 @@ class database
 					  LIMIT '.$max.'
 					 OFFSET '.$offset;
 
-			$statement = $this->db->query($sql);
+			if(empty($parameters))
+            {
+                $statement = $this->db->query($sql);
+            }
+            else
+            {
+                $statement = $this->db->prepare($sql);
+                $statement->execute($parameters);
+            }
+
             $this->queries_count++;
 			$statement->setFetchMode($fetch);
 			$this->lastResult = $statement->fetchAll();

programming_language: PHP
filename: language.class.php
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,11 @@ class language
 	{
 		global $DB;
 
-		$DB->query('SELECT * FROM nv_languages WHERE code = '.protect($code));
+		$DB->query(
+		    'SELECT * FROM nv_languages WHERE code = :code',
+            'object',
+            array(':code' => $code)
+        );
 		$data = $DB->first();
 
 		if(empty($data->id))

programming_language: PHP
filename: user.class.php
change_type: ModificationType.MODIFY
diff: @@ -51,10 +51,13 @@ class user
 		$user = mb_strtolower($user);
 		
 		$A1 = md5($user.':'.APP_REALM.':'.$pass);	
-		
-		if($DB->query('SELECT * 
-						 FROM nv_users 
-						WHERE LOWER(username) = '.protect($user)))
+        $found = $DB->query(
+            'SELECT * FROM nv_users WHERE LOWER(username) = :username',
+            'object',
+            array(':username' => $user)
+        );
+
+		if(!empty($found))
 		{		
 			$data = $DB->result();	
 							
@@ -336,9 +339,15 @@ class user
             'SELECT * 
              FROM nv_settings 
              WHERE  type = "user" AND 
-                    user = '.protect($this->id).' AND
-                    website = '.protect($website->id).' AND 
-                    name = '.protect($name)
+                    user = :user AND
+                    website = :website AND 
+                    name = :name',
+            'object',
+            array(
+                ':user' => $this->id,
+                ':website' => $website->id,
+                ':name' => $name
+            )
         );
 
         $setting = $DB->first();

programming_language: PHP
filename: layout.class.php
change_type: ModificationType.MODIFY
diff: @@ -563,7 +563,13 @@ class layout
 		if(empty($fid))
 			$fid = 'dashboard';
 
-		$user_profile_name = $DB->query_single('name', 'nv_profiles', 'id='.protect($user->profile));
+		$user_profile_name = $DB->query_single(
+		    'name',
+            'nv_profiles',
+            'id = :user_profile',
+            'NULL',
+            array(':user_profile' => $user->profile)
+        );
 
 		$this->add_content(
 			'<div class="navigate-help">'.
@@ -753,6 +759,7 @@ class layout
                 92: "'.t(92, 'Close').'",
                 141: "'.t(141, 'Folder').'",
                 152: "'.t(152, 'Continue').'",
+                159: "'.t(159, 'Name').'",
                 170: "'.t(170, 'Edit').'",
                 171: "'.t(171, 'Order').'",
                 185: "'.t(185, 'Searching elements').'",

programming_language: PHP
filename: navibars.class.php
change_type: ModificationType.MODIFY
diff: @@ -33,7 +33,7 @@ class navibars
 				{
                     // we are displaying a list
 					$actions[$search_form_pos][] = '<img onclick="$(this).next().triggerHandler(\'submit\');" height="16" align="absmiddle" width="16" src="img/icons/silk/zoom.png"></a>';
-					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false;">';
+					$actions[$search_form_pos][] = '<form method="GET" action="#" onsubmit=" if(typeof(navitable_quicksearch)==\'function\') { navitable_quicksearch($(\'#navigate-quicksearch\').val()); return false; } else return true;">';
 				}
 				else // other screen than a list
 				{

programming_language: PHP
filename: naviforms.class.php
change_type: ModificationType.MODIFY
diff: @@ -263,6 +263,7 @@ class naviforms
                 $("a[data-action=create_custom_value][data-uid='.$uid.']").on("click", function()
                 {
                     var text = prompt(navigate_t(159, "Name"));
+                    if(!text) return;
                     text = text.trim();
                     if(text != "")
                     {

programming_language: PHP
filename: about.php
change_type: ModificationType.MODIFY
diff: @@ -54,7 +54,7 @@ function about_layout()
 	$navibars->add_tab_content_row(
 		array(
 			'<label>'.t(218, 'Third party libraries').'</label>',
-			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.0c</a><br />'
+			'<a href="http://www.tinymce.com" target="_blank">TinyMCE 4.8.3</a><br />'
 		)
 	);
 

programming_language: PHP
filename: block.class.php
change_type: ModificationType.MODIFY
diff: @@ -610,8 +610,12 @@ class block
                 $theme_blocks[$b]['count'] = $DB->query_single(
                     'COUNT(*) AS total',
                     'nv_blocks',
-                    ' website = '.$website->id.' AND 
-                      type = '.protect($theme_blocks[$b]['id'])
+                    ' website = :wid AND type = :type',
+                    NULL,
+                     array(
+                        ':wid' => $website->id,
+                        ':type' => $theme_blocks[$b]['id']
+                     )
                 );
             }
         }
@@ -671,11 +675,15 @@ class block
         sort($array);
 
 		$array = serialize($array);
-				
+
 		$ok = $DB->execute('
 		    UPDATE nv_websites
-               SET block_types = '.protect($array).'
-			 WHERE id = '.$website->id
+               SET block_types = :block_types
+			 WHERE id = :wid',
+            array(
+                ':wid' => $website->id,
+                ':block_types' => $array
+            )
         );
 					
 		if(!$ok)
@@ -939,7 +947,7 @@ class block
         $DB->query('
             SELECT *
             FROM nv_blocks
-            WHERE website = '.protect($website->id),
+            WHERE website = '.intval($website->id),
             'object'
         );
 

programming_language: PHP
filename: block_group.class.php
change_type: ModificationType.MODIFY
diff: @@ -27,9 +27,17 @@ class block_group
 		global $DB;
 		global $website;
 
-		if($DB->query('SELECT * FROM nv_block_groups
-						WHERE code = '.protect($code).'
-						  AND website = '.$website->id))
+        $found = $DB->query(
+            'SELECT * FROM nv_block_groups
+                  WHERE code = :code
+                    AND website = '.$website->id,
+            'object',
+            array(
+                ':code' => $code
+            )
+        );
+
+		if($found)
 		{
 			$data = $DB->result();
 			$this->load_from_resultset($data);
@@ -198,7 +206,7 @@ class block_group
         $DB->queryLimit(
             '*',
             'nv_block_groups',
-            'website = '.protect($website->id),
+            'website = '.intval($website->id),
             $order_by_field.' '.$order_by_ascdesc,
             $offset,
             $limit
@@ -235,7 +243,7 @@ class block_group
         $DB->query('
             SELECT *
               FROM nv_block_groups
-             WHERE website = '.protect($website->id),
+             WHERE website = '.intval($website->id),
             'object'
         );
         $out = $DB->result();

programming_language: PHP
filename: blocks.php
change_type: ModificationType.MODIFY
diff: @@ -274,13 +274,17 @@ function run()
 
         case 'path':
 		case 5:	// search an existing path
-			$DB->query('SELECT path as id, path as label, path as value
+			$DB->query(
+			    'SELECT path as id, path as label, path as value
 						  FROM nv_paths
-						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').' 
+						 WHERE path LIKE :path 
 						   AND website = '.$website->id.'
 				      ORDER BY path ASC
 					     LIMIT 10',
-						'array');
+                'array',
+                array(
+                    ':path' => '%' . $_REQUEST['term'] . '%'
+                ));
 						
 			echo json_encode($DB->result());
 							  

programming_language: PHP
filename: brand.class.php
change_type: ModificationType.MODIFY
diff: @@ -134,7 +134,7 @@ class brand
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_brands WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_brands WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: comment.class.php
change_type: ModificationType.MODIFY
diff: @@ -279,7 +279,7 @@ class comment
 
         $DB->query('
 			SELECT * FROM nv_comments
-			 WHERE website = '.protect($website->id),
+			 WHERE website = '.intval($website->id),
 	        'object'
         );
         $out = $DB->result();
@@ -298,7 +298,7 @@ class comment
         $pending_comments = $DB->query_single(
             'COUNT(*)',
             'nv_comments',
-            ' website = '.protect($website->id).' AND
+            ' website = '.intval($website->id).' AND
               status = -1'
         );
 
@@ -313,12 +313,12 @@ class comment
         $count = $DB->query_single(
 	        'count(*) as total',
 	        'nv_comments',
-	        'website = '.protect($website->id).' AND status = 3'
+	        'website = '.intval($website->id).' AND status = 3'
         );
 
         $ok = $DB->execute('
 			DELETE FROM nv_comments
-             WHERE website = '.protect($website->id).'
+             WHERE website = '.intval($website->id).'
                AND status = 3
         ');
 
@@ -521,11 +521,16 @@ class comment
             $DB->query('
                 SELECT id, user, email 
                  FROM nv_comments
-                WHERE website = ' . $this->website . '
-                  AND object_type = ' . protect($this->object_type) . '
-                  AND object_id = ' . protect($this->object_id) . '
-                  AND subscribed = 1
-            ');
+                WHERE website = :wid
+                  AND object_type = :otype
+                  AND object_id = :oid
+                  AND subscribed = 1',
+                'object',
+                array(
+                    ':wid' => $this->website,
+                    ':otype' => $this->object_type,
+                    ':oid' => $this->object_id
+                ));
 
             $subscribers = $DB->result();
 
@@ -706,8 +711,8 @@ class comment
         $DB->query('  
             SELECT COUNT(*) AS total 
             FROM nv_comments 
-            WHERE website = '.protect($website->id).' 
-            AND user = '.protect($webuser_id).'
+            WHERE website = '.intval($website->id).' 
+            AND user = '.intval($webuser_id).'
             AND status = 0'
         );
 

programming_language: PHP
filename: comments.php
change_type: ModificationType.MODIFY
diff: @@ -177,13 +177,19 @@ function run()
             break;
 
         case 'json_find_webuser': // json find webuser by name (for "user" autocomplete)
-            $DB->query('SELECT id, username as text
-						  FROM nv_webusers
-						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
-						 AND website = '.$website->id.'
-				      ORDER BY username ASC
-					     LIMIT 30',
-                'array');
+            $DB->query(
+                'SELECT id, username as text
+                      FROM nv_webusers
+                     WHERE username LIKE :username
+                     AND website = :wid
+                  ORDER BY username ASC
+                     LIMIT 30',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':username' => '%' . $_REQUEST['username'] . '%'
+                )
+            );
 
             $rows = $DB->result();
             $total = $DB->foundRows();
@@ -193,22 +199,32 @@ function run()
             break;
 
         case 'json_find_comment': // json find comment by text search (for "in reply to" autocomplete)
-            $DB->query('SELECT c.id, c.date_created, c.name, u.username, c.message
-						  FROM nv_comments c
-						  LEFT JOIN nv_webusers u ON c.user = u.id
-						 WHERE
-						    c.website = '.$website->id.' AND
-						    c.object_type = '.protect($_REQUEST['object_type']).' AND
-						    c.object_id = '.protect($_REQUEST['object_id']).' AND
-						    c.date_created <= '.$_REQUEST['maxdate'].' AND
-						    c.id <> '.$_REQUEST['exclude'].' AND						     
-						    (   c.name LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
-						        c.message LIKE ' . protect('%' . $_REQUEST['search'] . '%') . ' OR
-						        u.username LIKE ' . protect('%' . $_REQUEST['search'] . '%') . '
-                            )                          
-				      ORDER BY c.date_created DESC
-					     LIMIT 30',
-                'array');
+            $DB->query(
+                'SELECT c.id, c.date_created, c.name, u.username, c.message
+                      FROM nv_comments c
+                      LEFT JOIN nv_webusers u ON c.user = u.id
+                     WHERE
+                        c.website = :wid AND
+                        c.object_type = :object_type AND
+                        c.object_id = :object_id AND
+                        c.date_created <= :maxdate AND
+                        c.id <> :exclude AND						     
+                        (   c.name LIKE :text OR
+                            c.message LIKE :text OR
+                            u.username LIKE :text
+                        )                          
+                  ORDER BY c.date_created DESC
+                     LIMIT 30',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':object_type' => $_REQUEST['object_type'],
+                    ':object_id' => $_REQUEST['object_id'],
+                    ':date_created' => $_REQUEST['maxdate'],
+                    ':exclude' => $_REQUEST['exclude'],
+                    ':text' => '%' . $_REQUEST['search'] . '%'
+                )
+            );
 
             $rows = $DB->result();
             $total = $DB->foundRows();
@@ -222,12 +238,14 @@ function run()
             break;
 
         case 'json_get_comment': // json get comment by ID
-            $DB->query('SELECT c.*
-						  FROM nv_comments c
-						  LEFT JOIN nv_webusers u ON c.user = u.id
-						 WHERE
-						    c.website = '.$website->id.' AND
-						    c.id = '.protect($_REQUEST['id']));
+            $DB->query(
+                'SELECT c.*
+                      FROM nv_comments c
+                      LEFT JOIN nv_webusers u ON c.user = u.id
+                     WHERE
+                        c.website = '.$website->id.' AND
+                        c.id = '.intval($_REQUEST['id'])
+            );
 
             $comment = $DB->first();
 
@@ -238,15 +256,21 @@ function run()
 
         case "find_object_titles":
             // json search title request (for "item" autocomplete)
-			$DB->query('SELECT DISTINCT node_id as id, text as label, text as value
-						  FROM nv_webdictionary
-						 WHERE node_type = '.protect($_REQUEST['object_type']).'
-						   AND subtype = "title"
-						   AND website = '.$website->id.' 
-						   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
-				      ORDER BY text ASC
-					     LIMIT 30',
-						'array'
+			$DB->query(
+			    'SELECT DISTINCT node_id as id, text as label, text as value
+                      FROM nv_webdictionary
+                      WHERE node_type = :object_type
+                       AND subtype = "title"
+                       AND website = :wid 
+                       AND text LIKE :text
+                      ORDER BY text ASC
+                      LIMIT 30',
+                    'array',
+                    array(
+                        ':object_type' => $_REQUEST['object_type'],
+                        ':wid' => $website->id,
+                        ':text' => '%'.$_REQUEST['title'].'%'
+                    )
                     // AND lang = '.protect($_REQUEST['lang']).'
             );
 						

programming_language: PHP
filename: coupon.class.php
change_type: ModificationType.MODIFY
diff: @@ -211,7 +211,7 @@ class coupon
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_coupons WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_coupons WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')
@@ -256,9 +256,9 @@ class coupon
                 'COUNT(*)',
                 'nv_orders',
                 ' 
-                    website = '.protect($website->id).' AND
-                    webuser = '.protect($webuser).' AND 
-                    coupon = '.protect($this->id)
+                    website = '.intval($website->id).' AND
+                    webuser = '.intval($webuser).' AND 
+                    coupon = '.intval($this->id)
             );
 
             if($times_used_by_customer > $this->times_allowed_customer)
@@ -272,8 +272,8 @@ class coupon
                 'COUNT(*)',
                 'nv_orders',
                 ' 
-                    website = '.protect($website->id).' AND
-                    coupon = '.protect($this->id)
+                    website = '.intval($website->id).' AND
+                    coupon = '.intval($this->id)
             );
 
             if($times_used_globally > $this->times_allowed_globally)
@@ -291,9 +291,13 @@ class coupon
         $DB->query('
             SELECT * 
             FROM nv_coupons 
-            WHERE website = '.protect($website->id).' AND
-                  code = '.protect($code),
-            'object'
+            WHERE website = :wid AND
+                  code = :code',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':code' => $code
+            )
         );
 
         $rs = $DB->result();

programming_language: PHP
filename: dashboard.php
change_type: ModificationType.MODIFY
diff: @@ -258,7 +258,7 @@ function dashboard_panel_web_summary($params)
     $stats = &$params['statistics'];
     $navibars = &$params['navibars'];
 
-//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.protect($website->id).' GROUP BY object_id');
+//	$stats['pages_available'] = $DB->query_single('COUNT(DISTINCT object_id)', 'nv_paths', 'website = '.intval($website->id).' GROUP BY object_id');
 
     // count number of paths, ignoring extra languages (so if the item has 3 languages and 3 different paths, only one is counted)
     $DB->query('
@@ -267,7 +267,7 @@ function dashboard_panel_web_summary($params)
 	      (
                 SELECT DISTINCT p.object_id
                   FROM nv_paths p
-                 WHERE p.website = '.protect($website->id).'
+                 WHERE p.website = '.intval($website->id).'
               GROUP BY p.object_id
           ) c
     ');
@@ -278,7 +278,7 @@ function dashboard_panel_web_summary($params)
     $DB->query('
         SELECT COUNT(i.id) as total
           FROM nv_items i
-         WHERE i.website = '.protect($website->id).'
+         WHERE i.website = '.intval($website->id).'
            AND i.embedding = 0
            AND (
                 SELECT count(p.id)
@@ -289,16 +289,16 @@ function dashboard_panel_web_summary($params)
     $count = $DB->first();
     $stats['pages_available'] += $count->total;
 
-//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.protect($website->id));
-    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id));
-    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.protect($website->id).' AND status = -1');
+//	$stats['pages_viewed'] = $DB->query_single('SUM(i.views)', 'nv_items i', 'website = '.intval($website->id));
+    $stats['comments_count'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id));
+    $stats['comments_torevise'] = $DB->query_single('COUNT(*)', 'nv_comments', 'website = '.intval($website->id).' AND status = -1');
 
     $DB->query('
 		SELECT SUM(x.page_views) as pages_viewed FROM
 		(	
 			SELECT i.views as page_views, i.id as id_item 
 			  FROM nv_items i
-			 WHERE i.website = '.protect($website->id).'
+			 WHERE i.website = '.intval($website->id).'
 			   AND i.template > 0
 			   AND i.embedding = 0
 
@@ -306,7 +306,7 @@ function dashboard_panel_web_summary($params)
 
 			SELECT s.views as page_views, s.id as id_category
 			  FROM nv_structure s
-			 WHERE s.website = '.protect($website->id).'
+			 WHERE s.website = '.intval($website->id).'
 		) x
 	');
 
@@ -351,10 +351,10 @@ function dashboard_panel_top_pages($params)
     $sql = '
 	    SELECT i.views as page_views, i.id as id_item, i.category as id_category, p.views as path_views, p.path as path
           FROM nv_items i, nv_paths p
-         WHERE i.website = '.protect($website->id).'
+         WHERE i.website = '.intval($website->id).'
            AND i.template > 0
            AND i.embedding = 0
-           AND p.website = '.protect($website->id).'
+           AND p.website = '.intval($website->id).'
            AND p.type = "item"
            AND p.object_id = i.id
 
@@ -362,8 +362,8 @@ function dashboard_panel_top_pages($params)
 
         SELECT s.views as page_views, NULL as id_item, s.id as id_category, p.views as path_views, p.path as path
           FROM nv_structure s, nv_paths p
-         WHERE s.website = '.protect($website->id).'
-           AND p.website = '.protect($website->id).'
+         WHERE s.website = '.intval($website->id).'
+           AND p.website = '.intval($website->id).'
            AND p.type = "structure"
            AND p.object_id = s.id
 
@@ -425,14 +425,19 @@ function dashboard_panel_recent_comments($params)
                  nvwd.website = nvc.website AND
                  nvwd.node_type = nvc.object_type AND
                  nvwd.subtype = "title" AND
-                 nvwd.lang = '.protect($website->languages_published[0]).'
-      WHERE nvc.website = '.$website->id.'
-	  ORDER BY nvc.date_created DESC LIMIT '.$comments_limit
+                 nvwd.lang = :lang
+      WHERE nvc.website = :wid
+	  ORDER BY nvc.date_created DESC LIMIT '.intval($comments_limit),
+        'object',
+        array(
+            ':wid' => $website->id,
+            ':lang' => $website->languages_published[0]
+        )
     );
     // removed
     /*
         .. AND nvwu.website = nvc.website
-        .. WHERE nvc.website = '.protect($website->id).'
+        .. WHERE nvc.website = '.intval($website->id).'
 
         to allow cross-website members
     */
@@ -773,11 +778,12 @@ function dashboard_panel_public_wall($params)
 
     $layout->navigate_notes_dialog('website', $website->id);
     $public_wall_notes = grid_notes::comments('website', $website->id);
+
     $elements_html = '
         <div class="navigate-panel-model-row hidden">
             <div class="navigate-panel-recent-comments-username ui-corner-all items-comment-status-public hide">
-                <span data-field="date"></span> 
-                <span data-field="username"><strong>'.$public_wall_notes[$e]['username'].'</strong></span>
+                <span data-field="date">date</span> 
+                <span data-field="username"><strong>username</strong></span>
             </div>
             <div data-field="note" class="navigate-panel-recent-comments-element"></div>
         </div>

programming_language: PHP
filename: extension.class.php
change_type: ModificationType.MODIFY
diff: @@ -34,9 +34,14 @@ class extension
 
         // now retrieve extension configuration for the active website
         $DB->query('
-          SELECT * FROM nv_extensions
-          WHERE website = '.protect($this->website).'
-            AND extension = '.protect($this->code)
+            SELECT * FROM nv_extensions
+            WHERE website = :wid
+              AND extension = :code',
+            'object',
+            array(
+                ':wid' => $this->website,
+                ':code' => $this->code
+            )
         );
 
         $row = $DB->first();
@@ -192,7 +197,7 @@ class extension
 
             $ok = $DB->execute('
                 DELETE FROM nv_extensions
-                 WHERE id = '.protect($this->id)
+                 WHERE id = '.intval($this->id)
             );
 
             if(method_exists($events, 'trigger'))
@@ -265,8 +270,13 @@ class extension
                     FROM nv_webdictionary
                    WHERE website = '.$website->id.'
                      AND node_type = "extension"
-                     AND lang = '.protect($current_language).'
-                     AND extension = '.protect($this->code)
+                     AND lang = :lang
+                     AND extension = :code',
+                    'object',
+                    array(
+                        ':lang' => $current_language,
+                        ':code' => $this->code
+                    )
                 );
                 $rs = $DB->result();
 
@@ -344,7 +354,7 @@ class extension
         $DB->query('
             SELECT extension, enabled
               FROM nv_extensions
-             WHERE website = '.protect($website->id),
+             WHERE website = '.intval($website->id),
             'array'
         );
 

programming_language: PHP
filename: extensions.php
change_type: ModificationType.MODIFY
diff: @@ -279,7 +279,7 @@ function extensions_grid($list)
 
         for($i=0; $i < count($list); $i++)
         {
-            $extension_has_options = empty($list[$i]['options']);
+            $extension_has_options = !empty($list[$i]['options']);
             // ignore options for extensions of type payment_method
             if($list[$i]['type']=='payment_method')
                 $extension_has_options = false;
@@ -481,9 +481,17 @@ function extensions_options($extension, $saved=null)
 
     $layout->navigate_media_browser();	// we can use media browser in this function
 
-    $navibars->add_actions(		array(	'<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'	));
-
-    $navibars->add_actions(	array(	'<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'	)    );
+    $navibars->add_actions(
+        array(
+            '<a href="#" onclick="javascript: navigate_media_browser();"><img height="16" align="absmiddle" width="16" src="img/icons/silk/images.png"> '.t(36, 'Media').'</a>'
+        )
+    );
+
+    $navibars->add_actions(
+        array(
+            '<a href="#" onclick="navigate_tabform_submit(0);"><img height="16" align="absmiddle" width="16" src="img/icons/silk/accept.png"> '.t(34, 'Save').'</a>'
+        )
+    );
 
     $navibars->form();
 

programming_language: PHP
filename: feed.class.php
change_type: ModificationType.MODIFY
diff: @@ -317,10 +317,15 @@ class feed
                            AND d.node_type = "item"
                            AND d.subtype = "title"
                            AND d.node_id = i.id
-                           AND d.lang = '.protect($current['lang']).'
+                           AND d.lang = :lang
                          ORDER BY pdate DESC
                          LIMIT '.$limit.'
-                        OFFSET 0');
+                        OFFSET 0',
+                'object',
+                array(
+                    ':lang' => $current['lang']
+                )
+            );
 								
 			$rs = $DB->result();
 			
@@ -451,7 +456,7 @@ class feed
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_feeds WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_feeds WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: feeds.php
change_type: ModificationType.MODIFY
diff: @@ -143,13 +143,17 @@ function run()
 			break;
 			
 		case "path_check": // check if a requested path is not used
-			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
-			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+			$DB->query(
+			    'SELECT type, object_id, lang
+                      FROM nv_paths
+                     WHERE path = :path
+                       AND website = :wid',
+                'object',
+                array(
+                    ':wid' => $this->website,
+                    'path' => $_REQUEST['path']
+                )
+            );
 						 
 			$rs = $DB->result();
 			

programming_language: PHP
filename: file.class.php
change_type: ModificationType.MODIFY
diff: @@ -573,10 +573,17 @@ class file
 		if(empty($wid))
 			$wid = $website->id;
 
-		$DB->query('  SELECT * FROM nv_files
-					   WHERE name LIKE '.protect('%'.$text.'%').'
-					     AND website = '.$wid.'
-					ORDER BY '.$orderby);
+		$DB->query(
+		    'SELECT * FROM nv_files
+			  	   WHERE name LIKE :text
+				     AND website = :wid
+				ORDER BY '.$orderby,
+            'object',
+            array(
+                ':wid' => $wid,
+                ':text' => '%' . $text . '%'
+            )
+        );
 					
 		return $DB->result();		
 	}
@@ -587,22 +594,39 @@ class file
 		global $website;
 		
 		if(empty($wid))
-			$wid = $website->id;		
+        {
+			$wid = $website->id;
+        }
 
 		if($limit < 1)
+        {
 			$limit = 2147483647;
+        }
+
+        $query_params = array(
+            ':wid' => $wid,
+            ':type' => $media,
+        );
 
+		$text_search = "";
         if(!empty($text))
-            $text = ' AND name LIKE '.protect('%'.$text.'%');
+        {
+            $text_search = ' AND name LIKE :text';
+            $query_params[':text'] = '%' . $text . '%';
+        }
 		
-		$DB->query('  SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
-					   WHERE type = '.protect($media).'
-					     AND enabled = 1
-						 AND website = '.$wid.'
-						 '.$text.'
-					ORDER BY '.$orderby.'
-					   LIMIT '.$limit.' 
-					  OFFSET '.$offset);
+		$DB->query(
+		    'SELECT SQL_CALC_FOUND_ROWS * FROM nv_files
+			  WHERE type = :type
+                 AND enabled = 1
+                 AND website = :wid 
+                 '.$text_search.'
+            ORDER BY '.$orderby.'
+               LIMIT '.$limit.' 
+              OFFSET '.$offset,
+            'object',
+            $query_params
+        );
 
         $total = $DB->foundRows();
         $rows = $DB->result();
@@ -2426,7 +2450,7 @@ class file
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_files WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_files WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: files.php
change_type: ModificationType.MODIFY
diff: @@ -420,7 +420,7 @@ function files_browser($parent, $search="")
     $navibrowse_hierarchy = $navibrowse->generate();
 	$navibars->add_content($navibrowse_hierarchy);
     
-    $layout->add_script('
+    $layout->add_script('    
         navigate_file_drop(
             ".navibrowse",
             "'.$parent.'",

programming_language: PHP
filename: grid_notes.class.php
change_type: ModificationType.MODIFY
diff: @@ -36,9 +36,14 @@ class grid_notes
             'background',
             'nv_notes',
             'website = '.$website->id.'
-             AND item_type = '.protect($item_type).'
-             AND item_id = '.protect($item_id).'
-             ORDER BY date_created DESC'
+             AND item_type = :item_type
+             AND item_id = :item_id
+             ORDER BY date_created DESC',
+            NULL,
+            array(
+                ':item_type' => $item_type,
+                ':item_id' => $item_id
+            )
         );
 
 
@@ -51,10 +56,14 @@ class grid_notes
             $DB->execute('
                 DELETE FROM nv_notes
                 WHERE website = '.$website->id.'
-                  AND item_type = '.protect($item_type).' 
-                  AND item_id = '.protect($item_id).'
-                  AND note = ""
-            ');
+                  AND item_type = :item_type 
+                  AND item_id = :item_id
+                  AND note = ""',
+                array(
+                    ':item_type' => $item_type,
+                    ':item_id' => $item_id
+                )
+            );
         }
 
     }
@@ -77,11 +86,17 @@ class grid_notes
             $DB->query(
                 'SELECT gn.id, gn.item_id, gn.background, gn.note, gn.date_created, u.username as creator
                    FROM nv_notes gn, nv_users u
-                  WHERE gn.website = '.protect($website->id).'
-                    AND gn.item_type = '.protect($type).'
-                    AND gn.item_id IN ('.implode(",", $ids).')
+                  WHERE gn.website = :wid
+                    AND gn.item_type = :item_type
+                    AND gn.item_id IN (:item_ids)
                     AND u.id = gn.user
-                  ORDER BY gn.item_id ASC, gn.date_created DESC'
+                  ORDER BY gn.item_id ASC, gn.date_created DESC',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':item_type' => $type,
+                    ':item_ids' => implode(",", $ids)
+                )
             );
 
             $grid_notes = $DB->result();
@@ -134,12 +149,17 @@ class grid_notes
         $DB->query("    
             SELECT gn.*, u.username as username
             FROM nv_notes gn, nv_users u
-            WHERE gn.website = ".protect($website->id)."
-              AND gn.item_type = ".protect($item_type)."
-              AND gn.item_id = ".protect($id)."
-              AND gn.user = u.id ".
-              $extra."
-            ORDER BY gn.date_created DESC"
+            WHERE gn.website = ".intval($website->id)."
+              AND gn.item_type = :item_type
+              AND gn.item_id = :item_id
+              AND gn.user = u.id 
+              ".$extra."
+            ORDER BY gn.date_created DESC",
+            'object',
+            array(
+                ':item_type' => $item_type,
+                ':item_id' => $id
+            )
         );
 
         $result = $DB->result();
@@ -200,8 +220,8 @@ class grid_notes
 
         $DB->execute('
             DELETE FROM nv_notes
-                WHERE website = '.protect($website->id).'
-                  AND id = '.protect($id).'
+                WHERE website = '.intval($website->id).'
+                  AND id = '.intval($id).'
                 LIMIT 1'
         );
 
@@ -215,10 +235,15 @@ class grid_notes
 
         $DB->execute('
             DELETE FROM nv_notes
-                WHERE website = '.protect($website->id).'
-                  AND item_type = '.protect($object_type).'
-                  AND item_id = '.protect($object_id).'
-                LIMIT 1'
+                WHERE website = :wid
+                  AND item_type = :object_type
+                  AND item_id = :object_id
+                LIMIT 1',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         return 'true';
@@ -233,7 +258,7 @@ class grid_notes
 
         $DB->query('
             SELECT * FROM nv_notes 
-            WHERE website = '.protect($website->id),
+            WHERE website = '.intval($website->id),
             'object'
         );
         $out = $DB->result();

programming_language: PHP
filename: item.class.php
change_type: ModificationType.MODIFY
diff: @@ -520,7 +520,7 @@ class item
 			$category_template = $DB->query_single(
                 'template',
                 'nv_structure',
-                ' id = '.protect($this->category).' AND website = '.$website->id
+                ' id = '.intval($this->category).' AND website = '.intval($website->id)
             );
 			$template->load($category_template);
 		}
@@ -642,9 +642,9 @@ class item
             $DB->query('
                 SELECT COUNT(*) as total
                       FROM nv_comments
-                     WHERE website = ' . protect($this->website) . '
+                     WHERE website = ' . intval($this->website) . '
                        AND object_type = "item"
-                       AND object_id = ' . protect($this->id) . '
+                       AND object_id = ' . intval($this->id) . '
                        AND status = 0'
             );
 
@@ -779,7 +779,7 @@ class item
         global $website;
 
         $out = array();
-        $DB->query('SELECT * FROM nv_items WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_items WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: items.php
change_type: ModificationType.MODIFY
diff: @@ -37,9 +37,6 @@ function run()
 					break;
 
                 case 'elements_by_tag':
-                    $tag = $_REQUEST['tag'];
-                    $lang = $_REQUEST['lang'];
-
                     $DB->query('
                         SELECT i.id, i.access, i.date_created AS date, d.text as title                               
                                FROM nv_items i
@@ -47,18 +44,24 @@ function run()
                                      ON i.id = d.node_id
                                     AND d.node_type = "item"
                                     AND d.subtype = "title"
-                                    AND d.lang = '.protect($lang).'
-                                    AND d.website = '.$website->id.'
+                                    AND d.lang = :lang
+                                    AND d.website = :wid
                             WHERE i.id IN (
                                 SELECT node_id FROM nv_webdictionary
-                                 WHERE website = ' . $website->id . '
+                                 WHERE website = :wid
                                    AND node_type = "item"
                                    AND subtype = "tags"
-                                   AND lang = ' . protect($lang) . '
-                                   AND FIND_IN_SET('.protect($tag).', text) > 0
+                                   AND lang = :lang
+                                   AND FIND_IN_SET(:tag, text) > 0
                             )
-                        ORDER BY i.id DESC
-                    ');
+                        ORDER BY i.id DESC',
+                        'object',
+                        array(
+                            ':lang' => $_REQUEST['lang'],
+                            ':wid' => $website->id,
+                            ':tag' => $_REQUEST['tag']
+                        )
+                    );
 
                     $rs = $DB->result();
 
@@ -225,7 +228,7 @@ function run()
 
                         $category_text = '';
                         if($dataset[$i]['association']=='free')
-                            $category_text = '[ '.strtolower(t(100, 'Free')).' ]';
+                            $category_text = '[ '.mb_strtolower(t(100, 'Free')).' ]';
                         else
                             $category_text = $dataset[$i]['category_path'];
 
@@ -465,15 +468,23 @@ function run()
 			break;
 			
 		case 90:
-			$DB->query('SELECT id, date_created, autosave
-						  FROM nv_webdictionary_history
-						 WHERE node_type = "item"
-						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-						   AND lang = '.protect($_GET['lang']).'
-						   AND node_id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id.' 
-				      ORDER BY date_created DESC',
-						'array');		
+			$DB->query(
+			    'SELECT id, date_created, autosave
+                      FROM nv_webdictionary_history
+                     WHERE node_type = "item"
+                       AND subtype = :subtype
+                       AND lang = :lang 
+                       AND node_id = :node_id
+                       AND website = :wid 
+                  ORDER BY date_created DESC',
+                    'array',
+                array(
+                    ':wid' => $website->id,
+                    ':node_id' => $_REQUEST['id'],
+                    ':lang' => $_REQUEST['lang'],
+                    ':subtype' => 'section-'.$_REQUEST['section']
+                )
+            );
 			
 			$result = $DB->result();
 			
@@ -497,12 +508,17 @@ function run()
 				  FROM nv_webdictionary
 				 WHERE node_type = "item"
 				   AND subtype = "title"
-				   AND lang = '.protect($_REQUEST['lang']).'
-				   AND website = '.$website->id.'
-				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+				   AND lang = :lang
+				   AND website = :wid
+				   AND text LIKE :text
 		      ORDER BY text ASC
 			     LIMIT 20',
-				'array'
+				'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%'.$_REQUEST['title'].'%'
+                )
 			);
 
 			echo json_encode($DB->result());
@@ -520,8 +536,8 @@ function run()
 				$DB->query('SELECT text
 							  FROM nv_webdictionary_history
 							 WHERE node_type = "item"
-							   AND website = '.$website->id.' 
-							   AND id = '.protect($_REQUEST['id']),							   
+							   AND website = '.intval($website->id).' 
+							   AND id = '.intval($_REQUEST['id']),
 							'array');	
 							
 				$data = $DB->first();				
@@ -529,29 +545,45 @@ function run()
 			}
 			else if($_REQUEST['zone'] == 'section')
 			{		
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "item"
-							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.' 
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "item"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':node_id' => $_REQUEST['node_id'],
+                        ':subtype' => 'section-'.$_REQUEST['section']
+                    )
+                );
 
 				$data = $DB->first();				
 				echo $data['text'];
 			}
 			else if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-item"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
-
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "property-item"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                        'array',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $_REQUEST['lang'],
+                            ':node_id' => $_REQUEST['node_id'],
+                            ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']
+                        )
+                    );
+                
 				$data = $DB->first();
 				echo $data['text'];
 			}
@@ -561,12 +593,14 @@ function run()
 
 		// return raw template content
 		case 93:
-			$DB->query('SELECT file
-						  FROM nv_templates
-						 WHERE enabled = 1
-						   AND id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id,
-						'array');
+			$DB->query(
+			    'SELECT file
+                    FROM nv_templates
+                   WHERE enabled = 1
+                     AND id = '.intval($_REQUEST['id']).'
+                     AND website = '.intval($website->id),
+                'array'
+            );
 						
 			$data = $DB->first();
 			
@@ -626,12 +660,18 @@ function run()
 		case 95: // free path checking
 			
 			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
-			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+
+			$DB->query(
+			    'SELECT type, object_id, lang
+	 				  FROM nv_paths
+					 WHERE path = :path
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':path' => $path,
+                        ':wid' => $website->id
+                    )
+                );
 			
 			$rs = $DB->result();
 			
@@ -649,11 +689,14 @@ function run()
 			$DB->query('
 				SELECT id, username as text
 				  FROM nv_users
-				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
+				 WHERE username LIKE :username
 		      ORDER BY username ASC
 			     LIMIT 30',
-				'array
-			');
+				'array',
+				array(
+				    ':username' => '%' . $_REQUEST['username'] . '%'
+                )
+			);
 						
 			$rows = $DB->result();
             $total = $DB->foundRows();
@@ -677,25 +720,40 @@ function run()
             // find items by its title
             // any language
 
+            $text = $_REQUEST['title'];
+            if(!empty($_REQUEST['term'])) // tagit request
+                $text = $_REQUEST['term'];
+
+            $query_params = array(
+                ':wid' => $website->id,
+                ':lang' => $website->languages_published[0],
+                ':text' => '%' . $text . '%'
+            );
+
             $template_filter = '';
 
 	        if(!empty($_REQUEST['template']))
-                $template_filter = ' AND nvi.template = '.protect($_REQUEST['template']).' ';
+            {
+                $template_filter = ' AND nvi.template = :template ';
+                $query_params[':template'] = $_REQUEST['template'];
+            }
 
 	        if(!empty($_REQUEST['association']))
-                $template_filter = ' AND nvi.association = '.protect($_REQUEST['association']).' ';
+            {
+                $template_filter = ' AND nvi.association = :association ';
+                $query_params[':association'] = $_REQUEST['association'];
+            }
 
 	        if(isset($_REQUEST['embedding']))
-                $template_filter = ' AND nvi.embedding = '.protect($_REQUEST['embedding']).' ';
-
-            $text = $_REQUEST['title'];
-            if(!empty($_REQUEST['term'])) // tagit request
-                $text = $_REQUEST['term'];
+            {
+                $template_filter = ' AND nvi.embedding = :embedding ';
+                $query_params[':embedding'] = $_REQUEST['embedding'];
+            }
 
             $limit = intval($_REQUEST['page_limit']);
             if(empty($limit)) $limit = null;
             $limit = value_or_default($limit, 1000);
-            
+
             $sql = '
 				SELECT SQL_CALC_FOUND_ROWS DISTINCT nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_items nvi
@@ -703,21 +761,17 @@ function run()
 				   AND nvw.node_id = nvi.id
 				   '.$template_filter.'
 				   AND nvw.subtype = "title"
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvi.website
-				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
-				        OR
-				        ( nvi.id LIKE  ' . protect('%' . $text . '%') . ' 
-				          AND
-				          nvw.lang = '.protect($website->languages_published[0]).'
-				        )
-				       )
+				   AND ( nvw.text LIKE :text 
+				         OR ( nvi.id LIKE :text AND nvw.lang = :lang )
+				   )
 		        GROUP BY nvw.node_id, nvw.text
 		        ORDER BY nvw.text ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query($sql, 'array', $query_params);
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
@@ -728,7 +782,7 @@ function run()
 					$rows[$i]['path'] = $DB->query_single(
 						'path',
 						'nv_paths',
-						'	website = '.protect($website->id).' AND 
+						'	website = '.intval($website->id).' AND 
 							type="item" AND 
 							object_id="'.$rows[$i]['id'].'" AND 
 							lang="'.$website->languages_list[0].'"
@@ -2092,7 +2146,7 @@ function items_form($item)
 		else if($item->association == 'category' && ($item->category > 0))
 		{
 			// we have to get the template set in the category of the item
-			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($item->category).' AND website = '.$website->id);
+			$template_id = $DB->query_single('template', 'nv_structure', ' id = '.intval($item->category).' AND website = '.intval($website->id));
 			$properties_html = navigate_property_layout_form('item', $template_id, 'item', $item->id);
 		}
 
@@ -2153,15 +2207,17 @@ function items_form($item)
 			// comments list
 			// removed filter: AND nvwu.website = nvc.website ... reason: the webuser could be from another website if sharing webusers is enabled
 			// TODO: retrieve comments by AJAX call to avoid memory issues. right now we just retrieve the first 500 comments
-			$DB->query('SELECT nvc.*, nvwu.username, nvwu.avatar
-						  FROM nv_comments nvc
-						 LEFT OUTER JOIN nv_webusers nvwu 
-						 			  ON nvwu.id = nvc.user
-						 WHERE nvc.website = '.protect($website->id).'
-						   AND nvc.object_type = "item"
-						   AND nvc.object_id = '.protect($item->id).'
-						ORDER BY nvc.date_created ASC
-						LIMIT 500');
+			$DB->query(
+			    'SELECT nvc.*, nvwu.username, nvwu.avatar
+                      FROM nv_comments nvc
+                     LEFT OUTER JOIN nv_webusers nvwu 
+                                  ON nvwu.id = nvc.user
+                     WHERE nvc.website = '.intval($website->id).'
+                       AND nvc.object_type = "item"
+                       AND nvc.object_id = '.intval($item->id).'
+                    ORDER BY nvc.date_created ASC
+                    LIMIT 500'
+            );
 												
 			$comments = $DB->result();
 			$comments_total = count($comments);

programming_language: PHP
filename: order.class.php
change_type: ModificationType.MODIFY
diff: @@ -146,7 +146,7 @@ class order
         $DB->query('
             SELECT * 
             FROM nv_orders_lines 
-            WHERE `order` = '.protect($this->id).' 
+            WHERE `order` = '.intval($this->id).' 
             ORDER BY position ASC'
         );
         $this->lines = $DB->result();
@@ -665,7 +665,12 @@ class order
         $order_id = $DB->query_single(
             'id',
             'nv_orders',
-            'reference = '.protect($reference).' AND website = "'.$website_id.'"'
+            'reference = :reference AND website = :wid',
+            NULL,
+            array(
+                ':wid' => $website_id,
+                ':reference' => $reference
+            )
         );
 
         return $order_id;
@@ -721,7 +726,7 @@ class order
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_orders WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_orders WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: orders.php
change_type: ModificationType.MODIFY
diff: @@ -30,11 +30,16 @@ function run()
                 case 'find_webuser': // json find webuser by name (for "webuser" autocomplete)
                     $DB->query('SELECT id, username as text
 						  FROM nv_webusers
-						 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
-						   AND website = '.$website->id.'
+						 WHERE username LIKE :username
+						   AND website = :wid
 				      ORDER BY username ASC
 					     LIMIT 30',
-                        'array');
+                        'array',
+                        array(
+                            ':wid' => $website->id,
+                            ':username' => '%' . $_REQUEST['username'] . '%'
+                        )
+                    );
 
                     $rows = $DB->result();
                     $total = $DB->foundRows();

programming_language: PHP
filename: path.class.php
change_type: ModificationType.MODIFY
diff: @@ -137,9 +137,15 @@ class path
 		$ok = $DB->query('
 			SELECT *
 			  FROM nv_paths
-			 WHERE type = '.protect($type).'
-			   AND object_id = '.protect($object_id).'
-			   AND website = '.$website_id
+			 WHERE type = :type
+			   AND object_id = :object_id
+			   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website_id,
+                ':object_id' => $object_id,
+                ':type' => $type
+            )
 		);
 
 	    if(!$ok)
@@ -164,25 +170,40 @@ class path
 		global $website;
 
 		if(empty($website_id))
-			$website_id = $website->id;
+		{
+            $website_id = $website->id;
+        }
 		
-	    if(empty($object_id)) throw new Exception('ERROR path: No ID!');
+	    if(empty($object_id))
+        {
+            throw new Exception('ERROR path: No ID!');
+        }
 
 		// delete old entries
 		$DB->execute('
 			DELETE FROM nv_paths
-			WHERE type = '.protect($type).'
-			  AND object_id = '.protect($object_id).'
-			  AND website = '.$website_id
+			WHERE type = :type
+			  AND object_id = :object_id
+			  AND website = :wid',
+            array(
+                ':wid' => $website_id,
+                ':object_id' => $object_id,
+                ':type' => $type
+            )
 		);
 
         if(!is_array($paths))
+        {
             return;
+        }
 
 		// and now insert the new values
 		foreach($paths as $lang => $path)
 		{
-    	  	if(empty($path)) continue;
+    	  	if(empty($path))
+            {
+                continue;
+            }
     
 			$ok = $DB->execute('
  				INSERT INTO nv_paths
@@ -200,7 +221,10 @@ class path
 				)
 			);
   			
-  			if(!$ok) throw new Exception($DB->get_last_error());
+  			if(!$ok)
+            {
+                throw new Exception($DB->get_last_error());
+            }
 		}
 		
 	}
@@ -214,7 +238,7 @@ class path
 
         $DB->query('
 			SELECT * FROM nv_paths
-			WHERE website = '.protect($website->id),
+			WHERE website = '.intval($website->id),
 	        'object'
         );
         $out = $DB->result();

programming_language: PHP
filename: payment_method.class.php
change_type: ModificationType.MODIFY
diff: @@ -312,7 +312,7 @@ class payment_method
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_payment_methods WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: permission.class.php
change_type: ModificationType.MODIFY
diff: @@ -24,14 +24,20 @@ class permission
 
         $ws_query = '';
         if(!empty($website))
-            $ws_query = ' AND website = '.protect($website);
+            $ws_query = ' AND website = '.intval($website);
 
         $status = $DB->query('
             SELECT * FROM nv_permissions
-             WHERE name = '.protect($name).'
-               AND profile = '.intval($profile_id).'
-               AND user = '.intval($user_id).
-            $ws_query
+             WHERE name = :name 
+               AND profile = :profile_id 
+               AND user = :user_id',
+            $ws_query,
+            'object',
+            array(
+                ':name' => $name,
+                ':profile_id' => intval($profile_id),
+                ':user_id' => intval($user_id)
+            )
         );
 
         if($status)
@@ -276,16 +282,26 @@ class permission
             $DB->query('
                 SELECT *
                 FROM nv_permissions
-                WHERE profile = '.protect($object->profile).'
-                  AND (website = 0 OR website = '.protect($ws).')'
+                WHERE profile = :profile
+                  AND (website = 0 OR website = :wid)',
+                'object',
+                array(
+                    ':profile' => $object->profile,
+                    ':wid' => $ws
+                )
             );
             $permissions_profile = $DB->result();
 
             $DB->query('
                 SELECT *
                   FROM nv_permissions
-                 WHERE user = '.protect($object->id).'
-                   AND (website = 0 OR website = '.protect($ws).')'
+                 WHERE user = :object_id
+                   AND (website = 0 OR website = :wid)',
+            'object',
+                array(
+                    ':wid' => $ws,
+                    ':object_id' => $object->id
+                )
             );
             $permissions_user = $DB->result();
         }
@@ -293,8 +309,13 @@ class permission
         {
             $DB->query('
                 SELECT * FROM nv_permissions
-                 WHERE profile = '.protect($object->id).'
-                 AND (website = 0 OR website = '.protect($ws).')'
+                 WHERE profile = :object_id
+                 AND (website = 0 OR website = :wid)',
+                'object',
+                array(
+                    ':wid' => $ws,
+                    ':object_id' => $object->id
+                )
             );
 
             $permissions_profile = $DB->result();

programming_language: PHP
filename: product.class.php
change_type: ModificationType.MODIFY
diff: @@ -726,9 +726,9 @@ class product
             $DB->query('
                 SELECT COUNT(*) as total
                       FROM nv_comments
-                     WHERE website = ' . protect($this->website) . '
+                     WHERE website = ' . intval($this->website) . '
                        AND object_type = "product"
-                       AND object_id = ' . protect($this->id) . '
+                       AND object_id = ' . intval($this->id) . '
                        AND status = 0'
             );
 
@@ -797,19 +797,23 @@ class product
 		sort($search);
 		foreach($search as $text)
 		{
-			$like = ' LIKE '.protect('%'.$text.'%');
-
 			// we search for the IDs at the dictionary NOW (to avoid inefficient requests)
-			$DB->query('SELECT DISTINCT (nvw.node_id)
-						 FROM nv_webdictionary nvw
-						 WHERE nvw.node_type = "product"
-						   AND nvw.website = '.$website->id.'
-						   AND nvw.text '.$like, 'array');
+			$DB->query(
+			    'SELECT DISTINCT (nvw.node_id)
+                     FROM nv_webdictionary nvw
+                     WHERE nvw.node_type = "product"
+                       AND nvw.website = '.$website->id.'
+                       AND nvw.text LIKE :text',
+                'array',
+                array(
+                    ':text' => '%'.$text.'%'
+                )
+            );
 
 			$dict_ids = $DB->result("node_id");
 
 			// all columns to look for
-			$cols[] = 'p.id' . $like;
+			$cols[] = 'p.id LIKE ' .  protect('%'.$text.'%').' ';
 			if(!empty($dict_ids))
 				$cols[] = 'p.id IN ('.implode(',', $dict_ids).')';
 
@@ -827,7 +831,7 @@ class product
         global $website;
 
         $out = array();
-        $DB->query('SELECT * FROM nv_products WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_products WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: products.php
change_type: ModificationType.MODIFY
diff: @@ -37,9 +37,6 @@ function run()
 					break;
 
                 case 'products_by_tag':
-                    $tag = $_REQUEST['tag'];
-                    $lang = $_REQUEST['lang'];
-
                     $DB->query('
                         SELECT p.id, p.access, p.date_created AS date, d.text as title                               
                                FROM nv_products p
@@ -47,18 +44,24 @@ function run()
                                      ON p.id = d.node_id
                                     AND d.node_type = "product"
                                     AND d.subtype = "title"
-                                    AND d.lang = '.protect($lang).'
-                                    AND d.website = '.$website->id.'
+                                    AND d.lang = :lang
+                                    AND d.website = :wid
                             WHERE p.id IN (
                                 SELECT node_id FROM nv_webdictionary
-                                 WHERE website = ' . $website->id . '
+                                 WHERE website = :wid
                                    AND node_type = "product"
                                    AND subtype = "tags"
-                                   AND lang = ' . protect($lang) . '
-                                   AND FIND_IN_SET('.protect($tag).', text) > 0
+                                   AND lang = :lang
+                                   AND FIND_IN_SET(:tag, text) > 0
                             )
-                        ORDER BY p.id DESC
-                    ');
+                        ORDER BY p.id DESC',
+                        'object',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $_REQUEST['lang'],
+                            ':tag' => $_REQUEST['tag']
+                        )
+                    );
 
                     $rs = $DB->result();
 
@@ -106,7 +109,7 @@ function run()
 					$max	    =   intval($_REQUEST['rows']);
 					$offset     =   ($page - 1) * $max;
 					$orderby    =   $_REQUEST['sidx'].' '.$_REQUEST['sord'];
-					$where      =   ' p.website = '.$website->id;
+					$where      =   ' p.website = :wid';
 
 					if($_REQUEST['_search']=='true' || isset($_REQUEST['quicksearch']))
 					{
@@ -153,31 +156,42 @@ function run()
 							$where .= ' AND '.navitable::jqgridcompare($_REQUEST['searchField'], $_REQUEST['searchOper'], $_REQUEST['searchString']);
 					}
 
-					$sql = ' SELECT SQL_CALC_FOUND_ROWS
-					                p.*, d.text as title, d.lang as language,
-                                    u.username as author_username,
-                                    (   SELECT COUNT(*)
-                                        FROM nv_comments cm
-                                        WHERE cm.object_type = "product"
-                                          AND cm.object_id = p.id
-                                          AND cm.website = '.$website->id.'
-                                    ) as comments
-							   FROM nv_products p
-						  LEFT JOIN nv_webdictionary d
-						  		 	 ON p.id = d.node_id
-								 	AND d.node_type = "product"
-									AND d.subtype = "title"
-									AND d.lang = '.protect($website->languages_list[0]).'
-									AND d.website = '.$website->id.'
-						  LEFT JOIN nv_users u
-						  			 ON u.id = p.author
-							  WHERE '.$where.'							   
-						   ORDER BY '.$orderby.' 
-							  LIMIT '.$max.'
-							 OFFSET '.$offset;
-
-					if(!$DB->query($sql, 'array'))
-						throw new Exception($DB->get_last_error());
+                    $query_params = array(
+                        ':wid' => $website->id,
+                        ':lang' => $website->languages_list[0]
+                    );
+
+					$ok = $DB->query(
+					    'SELECT SQL_CALC_FOUND_ROWS
+                                p.*, d.text as title, d.lang as language,
+                                u.username as author_username,
+                                (   SELECT COUNT(*)
+                                    FROM nv_comments cm
+                                    WHERE cm.object_type = "product"
+                                      AND cm.object_id = p.id
+                                      AND cm.website = :wid
+                                ) as comments
+                           FROM nv_products p
+                      LEFT JOIN nv_webdictionary d
+                                 ON p.id = d.node_id
+                                AND d.node_type = "product"
+                                AND d.subtype = "title"
+                                AND d.lang = :lang
+                                AND d.website = :wid
+                      LEFT JOIN nv_users u
+                                 ON u.id = p.author
+                          WHERE '.$where.'							   
+                       ORDER BY '.$orderby.' 
+                          LIMIT '.$max.'
+                         OFFSET '.$offset,
+                        'array',
+                        $query_params
+                    );
+
+					if(!$ok)
+					{
+                        throw new Exception($DB->get_last_error());
+                    }
 
 					$dataset = $DB->result();	
 					$total = $DB->foundRows();
@@ -458,15 +472,23 @@ function run()
 			break;
 
 		case "load_content_history":
-			$DB->query('SELECT id, date_created, autosave
-						  FROM nv_webdictionary_history
-						 WHERE node_type = "product"
-						   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-						   AND lang = '.protect($_GET['lang']).'
-						   AND node_id = '.protect($_REQUEST['id']).'
-						   AND website = '.$website->id.' 
-				      ORDER BY date_created DESC',
-						'array');		
+			$DB->query(
+			    'SELECT id, date_created, autosave
+                      FROM nv_webdictionary_history
+                     WHERE node_type = "product"
+                       AND subtype = :subtype
+                       AND lang = :lang
+                       AND node_id = :node_id
+                       AND website = :wid 
+                  ORDER BY date_created DESC',
+                'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':node_id' => $_REQUEST['id'],
+                    ':subtype' => 'section-'.$_REQUEST['section']
+                )
+            );
 			
 			$result = $DB->result();
 			
@@ -490,12 +512,17 @@ function run()
 				  FROM nv_webdictionary
 				 WHERE node_type = "product"
 				   AND subtype = "title"
-				   AND lang = '.protect($_REQUEST['lang']).'
-				   AND website = '.$website->id.'
-				   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+				   AND lang = :lang
+				   AND website = :wid
+				   AND text LIKE :text
 		      ORDER BY text ASC
 			     LIMIT 20',
-				'array'
+				'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%' . $_REQUEST['title'] . '%'
+                )
 			);
 
 			echo json_encode($DB->result());
@@ -510,40 +537,58 @@ function run()
 		
 			if($_REQUEST['history']=='true')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary_history
-							 WHERE node_type = "product"
-							   AND website = '.$website->id.' 
-							   AND id = '.protect($_REQUEST['id']),							   
-							'array');	
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary_history
+                         WHERE node_type = "product"
+                           AND website = '.intval($website->id).' 
+                           AND id = '.intval($_REQUEST['id']),
+                    'array'
+                );
 							
 				$data = $DB->first();				
 				echo $data['text'];		
 			}
 			else if($_REQUEST['zone'] == 'section')
 			{		
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "product"
-							   AND subtype = '.protect('section-'.$_REQUEST['section']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.' 
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "product"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid 
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':subtype' => 'section-'.$_REQUEST['section'],
+                        ':node_id' => $_REQUEST['node_id']
+                    )
+                );
 
 				$data = $DB->first();				
 				echo $data['text'];
 			}
 			else if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-product"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                          FROM nv_webdictionary
+                         WHERE node_type = "property-product"
+                           AND subtype = :subtype
+                           AND lang = :lang
+                           AND website = :wid
+                           AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
+                        ':lang' => $_REQUEST['lang'],
+                        ':wid' => $website->id,
+                        ':node_id' => $_REQUEST['node_id']
+                    )
+                );
 
 				$data = $DB->first();
 				echo $data['text'];
@@ -602,13 +647,16 @@ function run()
 			break;
 
         case 'path_free_check':
-			$path = $_REQUEST['path'];
-
 			$DB->query('
                 SELECT type, object_id, lang
                   FROM nv_paths
-                 WHERE path = '.protect($path).'
-                   AND website = '.$website->id
+                 WHERE path = :path
+                   AND website = :wid',
+            'object',
+                array(
+                    ':wid' => $website->id,
+                    ':path' => $_REQUEST['path']
+                )
             );
 			
 			$rs = $DB->result();
@@ -623,8 +671,13 @@ function run()
 			$DB->query('
                 SELECT id
                   FROM nv_products
-                 WHERE sku = '.protect($sku).'
-                   AND website = '.$website->id
+                 WHERE sku = :sku
+                   AND website = :wid',
+            'object',
+                array(
+                    ':sku' => $sku,
+                    ':wid' => $website->id
+                )
             );
 
 			$rs = $DB->result();
@@ -642,11 +695,14 @@ function run()
 			$DB->query('
 				SELECT id, username as text
 				  FROM nv_users
-				 WHERE username LIKE '.protect('%'.$_REQUEST['username'].'%').'
+				 WHERE username LIKE :username
 		      ORDER BY username ASC
 			     LIMIT 30',
-				'array
-			');
+				'array',
+                array(
+                    ':username' => '%'.$_REQUEST['username'].'%'
+                )
+            );
 						
 			$rows = $DB->result();
             $total = $DB->foundRows();
@@ -670,19 +726,29 @@ function run()
             // find items by its title
             // any language
 
-            $template_filter = '';
-
-	        if(!empty($_REQUEST['template']))
-                $template_filter = ' AND nvp.template = '.protect($_REQUEST['template']).' ';
-
             $text = $_REQUEST['title'];
             if(!empty($_REQUEST['term'])) // tagit request
+            {
                 $text = $_REQUEST['term'];
+            }
+
+            $query_params = array(
+                ':wid' => $website->id,
+                ':lang' => $website->languages_published[0],
+                ':text' => '%' . $text . '%'
+            );
+
+            $template_filter = '';
+            if(!empty($_REQUEST['template']))
+            {
+                $template_filter = ' AND nvp.template = :template ';
+                $query_params[':template'] = $_REQUEST['template'];
+            }
 
             $limit = intval($_REQUEST['page_limit']);
             if(empty($limit)) $limit = null;
             $limit = value_or_default($limit, 1000);
-            
+
             $sql = '
 				SELECT SQL_CALC_FOUND_ROWS DISTINCT nvw.node_id as id, nvw.text as text
 				  FROM nv_webdictionary nvw, nv_products nvp
@@ -690,21 +756,17 @@ function run()
 				   AND nvw.node_id = nvp.id
 				   '.$template_filter.'
 				   AND nvw.subtype = "title"
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvp.website
-				   AND ( nvw.text LIKE ' . protect('%' . $text . '%') . ' 
-				        OR
-				        ( nvp.id LIKE  ' . protect('%' . $text . '%') . ' 
-				          AND
-				          nvw.lang = '.protect($website->languages_published[0]).'
-				        )
+				   AND ( nvw.text LIKE :text 
+				        OR ( nvp.id LIKE :text AND nvw.lang = :lang )
 				       )
 		        GROUP BY nvw.node_id, nvw.text
 		        ORDER BY nvw.text ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query($sql, 'array', $query_params);
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
@@ -737,14 +799,20 @@ function run()
 				SELECT SQL_CALC_FOUND_ROWS nvb.*
 				  FROM nv_brands nvb
 				 WHERE nvb.website = '.$website->id.' AND ( 
-				         nvb.name LIKE ' . protect('%' . $text . '%') . '    OR
-				         nvb.id LIKE   ' . protect('%' . $text . '%') . '
+				         nvb.name LIKE :text OR
+				         nvb.id LIKE :text
                        )
 		        ORDER BY nvb.name ASC
 			     LIMIT '.$limit.'
 			     OFFSET '.max(0, intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1));
 
-            $DB->query($sql, 'array');
+            $DB->query(
+                $sql,
+                'array',
+                array(
+                    ':text' => '%' . $text . '%'
+                )
+            );
             $rows = $DB->result();
 			$total = $DB->foundRows();
 
@@ -1464,7 +1532,9 @@ function products_form($item)
 
 	$brand_name = "";
 	if(!empty($item->brand))
+    {
         $brand_name = $DB->query_single('name', 'nv_brands', 'id = '.intval($item->brand));
+    }
 
     $navibars->add_tab_content_row(
         array(
@@ -2110,9 +2180,9 @@ function products_form($item)
                   FROM nv_comments nvc
                  LEFT OUTER JOIN nv_webusers nvwu 
                               ON nvwu.id = nvc.user
-                 WHERE nvc.website = '.protect($website->id).'
+                 WHERE nvc.website = '.intval($website->id).'
                    AND nvc.object_type = "product"
-                   AND nvc.object_id = '.protect($item->id).'
+                   AND nvc.object_id = '.intval($item->id).'
                 ORDER BY nvc.date_created ASC
                 LIMIT 500
             ');

programming_language: PHP
filename: property.class.php
change_type: ModificationType.MODIFY
diff: @@ -482,21 +482,33 @@ class property
 
         if(is_numeric($code))
         {
+            $query_params = array(
+                ':template' => $code,
+                ':wid' => $website_id
+            );
+
             // properties attached to a custom template (not a theme template)
             if(!empty($element))
-                $element = ' AND element = '.protect($element);
+            {
+                $element = ' AND element = :element ';
+                $query_params[':element'] = $element;
+            }
             else
+            {
                 $element = ' AND element != "block"';
+            }
 
-            if($DB->query('
-                   SELECT *
-                   FROM nv_properties
-                   WHERE template = '.protect($code).'
-                   '.$element.'
-                     AND website = '.$website_id.'
-                   ORDER BY position ASC, id ASC'
-                )
-            )
+            $ok = $DB->query(
+            'SELECT * FROM nv_properties
+                 WHERE template = :template
+                  '.$element.'
+                  AND website = :wid
+                ORDER BY position ASC, id ASC',
+                'object',
+                $query_params
+            );
+
+            if($ok)
             {
                 $data = $DB->result();
             }
@@ -742,7 +754,12 @@ class property
                 $block_group_id = $DB->query_single(
                     'MAX(id)',
                     'nv_block_groups',
-                    ' code = '.protect($code).' AND website = '.$website->id
+                    ' code = :code AND website = :wid',
+                    NULL,
+                    array(
+                        ':wid' => $website->id,
+                        ':code' => $code
+                    )
                 );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
@@ -773,7 +790,16 @@ class property
             if(empty($object_id))
             {
                 // we need to find the block_group ID by checking the block uid
-                $block_group_id = $DB->query_single('id', 'nv_block_groups', ' blocks LIKE '.protect('%'.$item_uid.'%').' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'id',
+                    'nv_block_groups',
+                    ' blocks LIKE :uid AND website = :wid',
+                    NULL,
+                    array(
+                        ':wid' => $website->id,
+                        ':uid' => '%'.$item_uid.'%'
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
@@ -782,7 +808,16 @@ class property
             // at the end, $object_id MUST BE the numeric ID of the block group (we have only its codename, not the numeric ID)
             else if(!empty($code))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :object_id AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':object_id' => $object_id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
@@ -806,13 +841,27 @@ class property
 
     	// load the assigned (simple) properties values
         // check node_uid empty or NULL to mantain compatibility with Navigate CMS < 2.2
+        $query_params = array(
+            ':wid' => $website->id,
+            ':object_type' => $object_type,
+            ':object_id' => $object_id
+        );
+
+        $uid_filter = '';
+        if(!empty($item_uid))
+        {
+            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
+            $query_params[':node_uid'] = $item_uid;
+        }
+
 		$DB->query('
 		    SELECT * FROM nv_properties_items
- 			 WHERE element = '.protect($object_type).'
-			   AND node_id = '.protect($object_id).
-			   (empty($item_uid)? '' : ' AND ( node_uid = '.protect($item_uid).' OR node_uid = "" OR node_uid IS NULL )').'
-			   AND website = '.$website->id,
-            'array'
+ 			 WHERE element = :object_type
+			   AND node_id = :object_id
+			   '.$uid_filter.'			   
+			   AND website = :wid',
+            'array',
+            $query_params
         );
 
 		$values = $DB->result();
@@ -882,7 +931,16 @@ class property
 
             if(!is_numeric($object_id))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :code AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':code' => $code
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
@@ -912,7 +970,16 @@ class property
             // $object_id MUST BE the numeric ID of the block group (we have only its codename, not the numeric ID)
             if(!empty($code))
             {
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($object_id).' AND website = '.$website->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :object_id AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':object_id' => $object_id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
@@ -971,15 +1038,30 @@ class property
             if(($property->type=='element' || $property->type=='item') && !isset($_REQUEST['property-'.$property->id]))
                 $property_value = "";
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':property_id' => $property->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            );
+
+            $uid_filter = '';
+            if(!empty($object_uid))
+            {
+                $uid_filter = ' AND node_uid = :object_uid ';
+                $query_params[':object_uid'] = $object_uid;
+            }
+
             // remove the old property row
             $DB->execute('
                 DELETE
                      FROM nv_properties_items
-                    WHERE property_id = '.protect($property->id).'
-                      AND element = '.protect($object_type).'
-                      AND node_id = '.protect($object_id).
-                      (empty($object_uid)? '' : ' AND node_uid = '.protect($object_uid)).'
-                      AND website = '.$website->id
+                    WHERE property_id = :property_id
+                      AND element = :object_type
+                      AND node_id = :object_id
+                      '.$uid_filter.'
+                      AND website = :wid',
+                $query_params
             );
 
             // now insert the new row
@@ -1078,7 +1160,16 @@ class property
             if(!is_numeric($object_id))
             {
                 // assume there can only be one block group of the same type
-                $block_group_id = $DB->query_single('MAX(id)', 'nv_block_groups', ' code = '.protect($code).' AND website = '.$ws->id);
+                $block_group_id = $DB->query_single(
+                    'MAX(id)',
+                    'nv_block_groups',
+                    ' code = :code AND website = :wid',
+                    null,
+                    array(
+                        ':code' => $code,
+                        ':wid' => $ws->id
+                    )
+                );
                 $object_id = $block_group_id;
                 if(empty($block_group_id))
                     $object_id = 0;
@@ -1204,13 +1295,29 @@ class property
                 $value = ""; // should not be needed because of value_or_default, but doing this here fixes some warnings
 
             // remove the old property value row
+
+            $query_params = array(
+                ':wid' => $ws->id,
+                ':object_id' => $object_id,
+                ':pr_object_type' => $property_object_type,
+                ':pr_id' => $property->id
+            );
+
+            $uid_filter = '';
+            if(!empty($node_uid))
+            {
+                $uid_filter = ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $node_uid;
+            }
+
             $DB->execute('
 				DELETE FROM nv_properties_items
-                	  WHERE property_id = '.protect($property->id).'
-                        AND element = '.protect($property_object_type).'
-                        AND node_id = '.protect($object_id).
-                        (empty($node_uid)? '' : ' AND node_uid = '.protect($node_uid)).'
-                        AND website = '.$ws->id
+                	  WHERE property_id = :pr_id
+                        AND element = :pr_object_type
+                        AND node_id = :object_id                        
+                        AND website = :wid
+                        '.$uid_filter,
+                $query_params
             );
 
             // now we insert a new row
@@ -1275,10 +1382,15 @@ class property
 
         $DB->execute('
             DELETE FROM nv_properties_items
-                  WHERE website = '.$website_id.'
-                    AND element = '.protect($element_type).'
-                    AND node_id = '.intval($element_id).'
-        ');
+                  WHERE website = :wid
+                    AND element = :e_type
+                    AND node_id = :e_id ',
+            array(
+                ':wid' => $website_id,
+                ':e_type' => $element_type,
+                ':e_id' => $element_id
+            )
+        );
     }
 
     public static function country_name_by_code($code, $language="")
@@ -1287,10 +1399,17 @@ class property
 
         $lang = core_get_language($language);
 
-        $DB->query('SELECT name
-					FROM nv_countries
-		 			WHERE lang = '.protect($lang).'
-					  AND country_code = '.protect($code));
+        $DB->query(
+            'SELECT name
+			 	  FROM nv_countries
+		 		  WHERE lang = :lang
+				    AND country_code = :ccode',
+            'object',
+            array(
+                ':ccode' => $code,
+                ':lang' => $lang
+            )
+        );
 
         $row = $DB->first();
 
@@ -1310,10 +1429,16 @@ class property
         if($alpha3)
             $code = 'alpha3';
 
-		$DB->query('SELECT '.$code.' AS country_code, name
-					FROM nv_countries
-		 			WHERE lang = '.protect($lang).'
-					ORDER BY name ASC');
+		$DB->query(
+		    'SELECT '.$code.' AS country_code, name
+			  	  FROM nv_countries
+		 		  WHERE lang = :lang
+				  ORDER BY name ASC',
+            'object',
+            array(
+                ':lang' => $lang
+            )
+        );
 					
 		$rs = $DB->result();
 		
@@ -1346,7 +1471,7 @@ class property
 
         $country_query = " 1=1 ";
         if(!empty($country_id))
-            $country_query = ' AND r.country = '.protect($country_id);
+            $country_query = ' AND r.country = '.intval($country_id);
 
 		$DB->query('
             SELECT r.`numeric` AS region_id, c.country_code, r.name
@@ -1370,9 +1495,11 @@ class property
         // TODO: region names have no translation in database at this time
         // $lang = core_get_language($language);
 
-        $DB->query('SELECT name
-					FROM nv_countries_regions
-		 			WHERE `numeric` = '.protect($code));
+        $DB->query(
+            'SELECT name
+			  	  FROM nv_countries_regions
+		 		  WHERE `numeric` = '.intval($code)
+        );
 
         $row = $DB->first();
 
@@ -1487,10 +1614,15 @@ class property
 
         $DB->query('
             SELECT * FROM nv_properties_items
-            WHERE website = '.protect($website->id).'
-              AND property_id = '.protect($property).'
-              AND value = '.protect($value),
-            'object');
+            WHERE website = '.intval($website->id).'
+              AND property_id = :property_id 
+              AND value = :value',
+            'object',
+            array(
+                ':proeprty_id' => $property,
+                ':value' => $value
+            )
+        );
 
         return $DB->result();
     }
@@ -1502,12 +1634,12 @@ class property
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_properties WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_properties WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_properties'] = json_encode($DB->result());
 
-        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_properties_items WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_properties_items'] = json_encode($DB->result());

programming_language: PHP
filename: property.layout.php
change_type: ModificationType.MODIFY
diff: @@ -1076,11 +1076,18 @@ function navigate_property_layout_field($property, $object="", $website_id="")
                         $content_title = $DB->query_single(
                             'text',
                             'nv_webdictionary',
-                            '    node_type = "structure" AND
-                                        website = "' . $ws->id . '" AND
-                                        node_id = ' . protect($cid) . ' AND
-                                        subtype = "title" AND
-                                        lang = "' . $ws->languages_published[0] . '"'
+                            '    
+                                node_type = "structure" AND
+                                website = :wid AND
+                                node_id = :node_id AND
+                                subtype = "title" AND
+                                lang = :lang',
+                            NULL,
+                            array(
+                                ':wid' => $ws->id,
+                                ':lang' => $ws->languages_published[0],
+                                ':node_id' => $cid
+                            )
                         );
 
                         $layout->add_script('
@@ -1330,11 +1337,18 @@ function navigate_property_layout_field($property, $object="", $website_id="")
                     $content_title = $DB->query_single(
                         'text',
                         'nv_webdictionary',
-                        '   node_type = "item" AND
-                        website = "'.$ws->id.'" AND
-                        node_id = '.protect($cid).' AND
-                        subtype = "title" AND
-                        lang = "'.$ws->languages_published[0].'"'
+                        '   
+                            node_type = "item" AND
+                            website = :wid AND
+                            node_id = :node_id AND
+                            subtype = "title" AND
+                            lang = :lang',
+                        NULL,
+                        array(
+                            ':wid' => $ws->id,
+                            ':node_id' => $cid,
+                            ':lang' => $ws->languages_published[0]
+                        )
                     );
 
                     $layout->add_script('

programming_language: PHP
filename: shipping_method.class.php
change_type: ModificationType.MODIFY
diff: @@ -266,7 +266,7 @@ class shipping_method
         global $DB;
         global $website;
 
-        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_shipping_methods WHERE website = '.intval($website->id), 'object');
         $out = $DB->result();
 
         if($type='json')

programming_language: PHP
filename: shipping_methods.php
change_type: ModificationType.MODIFY
diff: @@ -34,7 +34,15 @@ function run()
                     if(!empty($shipping_method_id))
                         $shipping_method->load($shipping_method_id);
 
-                    $country_id = $DB->query_single('`numeric`', 'nv_countries', 'country_code = '.protect($country_code));
+                    $country_id = $DB->query_single(
+                        '`numeric`',
+                        'nv_countries',
+                        'country_code = :ccode',
+                        null,
+                        array(
+                            ':ccode' => $country_code
+                        )
+                    );
 
                     $DB->query('
                         SELECT `numeric`, name 
@@ -435,7 +443,13 @@ function shipping_methods_form($object)
         if(!empty($rate->regions))
         {
             foreach ($rate->regions as $rr)
-                $rate_regions[] = $DB->query_single('name', 'nv_countries_regions', '`numeric` = ' . protect($rr));
+            {
+                $rate_regions[] = $DB->query_single(
+                    'name',
+                    'nv_countries_regions',
+                    '`numeric` = ' . intval($rr)
+                );
+            }
         }
 
         $rate_weight =  ($rate->weight->min==0? '&infin;' : core_decimal2string($rate->weight->min)).

programming_language: PHP
filename: structure.class.php
change_type: ModificationType.MODIFY
diff: @@ -186,8 +186,8 @@ class structure
             $DB->query('
 				SELECT MAX(position) as max_position
                   FROM nv_structure
-                 WHERE parent = '.protect($this->parent).'
-                   AND website = '.protect($this->website)
+                 WHERE parent = '.intval($this->parent).'
+                   AND website = '.intval($this->website)
             );
 
             $max = $DB->result('max_position');
@@ -389,8 +389,8 @@ class structure
         $out = $DB->query_single(
             'COUNT(id)',
             'nv_items',
-            ' category = '.protect($this->id).' AND
-              website = '.protect($this->website).' AND
+            ' category = '.intval($this->id).' AND
+              website = '.intval($this->website).' AND
               permission <= '.$permission.' AND 
               (date_published = 0 OR date_published < '.core_time().') AND 
               (date_unpublish = 0 OR date_unpublish > '.core_time().') AND 
@@ -745,7 +745,7 @@ class structure
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_structure WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_structure WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: structure.php
change_type: ModificationType.MODIFY
diff: @@ -101,12 +101,17 @@ function run()
 		case 95: // free path checking
 			
 			$path = $_REQUEST['path'];
-			$id = $_REQUEST['id'];
 			
-			$DB->query('SELECT type, object_id, lang
-	 					  FROM nv_paths
-						 WHERE path = '.protect($path).'
-						   AND website = '.$website->id);
+			$DB->query(
+			    'SELECT type, object_id, lang
+	 			 	   FROM nv_paths
+					  WHERE path = :path 
+					    AND website = :wid',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':path' => $path
+                ));
 						 
 			$rs = $DB->result();
 			
@@ -127,9 +132,17 @@ function run()
             if(!empty($_REQUEST['term'])) // tagit request
                 $text = $_REQUEST['term'];
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':text' => '%' . $text . '%'
+            );
+
             $language_filter = "";
             if(!empty($_REQUEST['lang']))
-                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
+            {
+                $language_filter = ' AND nvw.lang = :lang ';
+                $query_params[':lang'] = $_REQUEST['lang'];
+            }
 
 			$DB->query('
 				SELECT SQL_CALC_FOUND_ROWS nvw.node_id as id, nvw.text as text
@@ -138,16 +151,17 @@ function run()
 				   AND nvw.node_id = nvi.id
 				   AND nvw.subtype = "title"
 				   AND (	nvi.association = "free" OR
-				            (nvi.association = "category" AND nvi.embedding=0)
+				            (nvi.association = "category" AND nvi.embedding = 0)
 				   )
 				   '.$language_filter.'
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvi.website
-				   AND nvw.text LIKE '.protect('%'.$text.'%').'
+				   AND nvw.text LIKE :text
 		      ORDER BY nvw.text ASC
 			     LIMIT '.intval($_REQUEST['page_limit']).'
 			     OFFSET '.max(0, (intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1))),
-				'array'
+				'array',
+                $query_params
 			);
 
             $rows = $DB->result();
@@ -179,9 +193,17 @@ function run()
             if(!empty($_REQUEST['term'])) // tagit request
                 $text = $_REQUEST['term'];
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':text' => '%'.$text.'%'
+            );
+
             $language_filter = "";
             if(!empty($_REQUEST['lang']))
-                $language_filter = ' AND nvw.lang = '.protect($_REQUEST['lang']);
+            {
+                $language_filter = ' AND nvw.lang = :lang ';
+                $query_params[':lang'] = $_REQUEST['lang'];
+            }
 
 			$DB->query('
 				SELECT SQL_CALC_FOUND_ROWS nvw.node_id as id, nvw.text as text
@@ -190,9 +212,9 @@ function run()
 				   AND nvw.node_id = nvs.id
 				   AND nvw.subtype = "title"
 				   '.$language_filter.'
-				   AND nvw.website = '.$website->id.'
+				   AND nvw.website = :wid
 				   AND nvw.website = nvs.website
-				   AND nvw.text LIKE '.protect('%'.$text.'%').'
+				   AND nvw.text LIKE :text
 		      ORDER BY nvw.text ASC
 			     LIMIT '.intval($_REQUEST['page_limit']).'
 			     OFFSET '.max(0, (intval($_REQUEST['page_limit']) * (intval($_REQUEST['page'])-1))),
@@ -225,12 +247,17 @@ function run()
 					  FROM nv_webdictionary
 					 WHERE node_type = "structure"
 					   AND subtype = "title"
-					   AND lang = '.protect($_REQUEST['lang']).'
-					   AND website = '.$website->id.'
-					   AND text LIKE '.protect('%'.$_REQUEST['title'].'%').'
+					   AND lang = :lang 
+					   AND website = :wid
+					   AND text LIKE :text
 			      ORDER BY text ASC
 				     LIMIT 30',
-					'array'
+					'array',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $_REQUEST['lang'],
+                    ':text' => '%'.$_REQUEST['title'].'%'
+                )
 			);
 
 			echo json_encode($DB->result());
@@ -277,14 +304,21 @@ function run()
 
 			if($_REQUEST['zone'] == 'property')
 			{
-				$DB->query('SELECT text
-							  FROM nv_webdictionary
-							 WHERE node_type = "property-structure"
-							   AND subtype = '.protect('property-'.$_REQUEST['section'].'-'.$_REQUEST['lang']).'
-							   AND lang = '.protect($_REQUEST['lang']).'
-							   AND website = '.$website->id.'
-							   AND node_id = '.protect($_REQUEST['node_id']),
-							'array');
+				$DB->query(
+				    'SELECT text
+                      FROM nv_webdictionary
+                     WHERE node_type = "property-structure"
+                       AND subtype = :subtype
+                       AND lang = :lang							   
+                       AND website = :wid
+                       AND node_id = :node_id',
+                    'array',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $_REQUEST['lang'],
+                        ':subtype' => 'property-'.$_REQUEST['section'].'-'.$_REQUEST['lang'],
+                        ':node_id' => $_REQUEST['node_id']
+                    ));
 
 				$data = $DB->first();
 				echo $data['text'];
@@ -648,20 +682,20 @@ function structure_form($item)
 
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$parent->id.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_first.png"> 
-                                        <small>('.strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
+                                        <small>('.mb_strtolower(t(84, 'Parent')).')</small> '.$parent->dictionary[$website->languages_list[0]]["title"].
                                     '</a>';
         }
 
         if(!empty($previous_brother))
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$previous_brother.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_previous.png"> 
-                                        <small>('.strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
+                                        <small>('.mb_strtolower(t(501, 'Previous')).')</small> '.$previous_brother_title.
                                     '</a>';
 
         if(!empty($next_brother))
             $extra_actions[] = '    <a href="?fid=structure&act=edit&id='.$next_brother.'">
                                         <img height="16" align="absmiddle" width="16" src="img/icons/silk/resultset_next.png"> 
-                                        <small>('.strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
+                                        <small>('.mb_strtolower(t(502, 'Next')).')</small> '.$next_brother_title.
                                     '</a>';
     }
 

programming_language: PHP
filename: template.class.php
change_type: ModificationType.MODIFY
diff: @@ -416,7 +416,7 @@ class template
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_templates WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_templates WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: templates.php
change_type: ModificationType.MODIFY
diff: @@ -935,7 +935,7 @@ function templates_section_widths()
 	
 	$DB->query('SELECT sections
 				  FROM nv_templates
-				 WHERE website = '.protect($website->id),
+				 WHERE website = '.intval($website->id),
 				'array');
 				
 	$result = $DB->result();

programming_language: PHP
filename: theme.class.php
change_type: ModificationType.MODIFY
diff: @@ -186,15 +186,23 @@ class theme
                 $DB->query('
                   SELECT subtype, lang, text
                     FROM nv_webdictionary
-                   WHERE website = '.$website->id.'
+                   WHERE website = :wid
                      AND node_type = "theme"
-                     AND lang = '.protect($current_language).'
-                     AND theme = '.protect($this->name)
+                     AND lang = :lang
+                     AND theme = :theme',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $current_language,
+                        ':theme' => $this->name
+                    )
                 );
                 $rs = $DB->result();
 
                 for($r=0; $r < count($rs); $r++)
+                {
                     $this->dictionary[$rs[$r]->subtype] = $rs[$r]->text;
+                }
             }
 		}
 
@@ -1077,7 +1085,16 @@ class theme
 	        if($tmp->association != "free" && $tmp->embedding == 1)
 	        {
 		        // we have to get the template set in the category of the item
-				$template_id = $DB->query_single('template', 'nv_structure', ' id = '.protect($tmp->category).' AND website = '.$website->id);
+				$template_id = $DB->query_single(
+				    'template',
+                    'nv_structure',
+                    ' id = :category AND website = :wid',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':category' => $tmp->category
+                    )
+                );
 	        }
 
 	        $properties['item'][$tmp->id] = property::load_properties('item', $template_id, 'item', $tmp->id);
@@ -1519,8 +1536,8 @@ class theme
                     $template = $DB->query_single(
                         'template',
                         'nv_structure',
-                        ' id = '.protect($real[$el_id]->category).' AND 
-								  website = '.$ws->id
+                        ' id = '.intval($real[$el_id]->category).' AND 
+								  website = '.intval($ws->id)
                     );
                 }
             }

programming_language: PHP
filename: themes.php
change_type: ModificationType.MODIFY
diff: @@ -21,7 +21,15 @@ function run()
 
         case 'remove':
             // check the theme is not actually used in any website
-            $usages = $DB->query_single('COUNT(*)', 'nv_websites', ' theme = '.protect($_REQUEST['theme']));
+            $usages = $DB->query_single(
+                'COUNT(*)',
+                'nv_websites',
+                ' theme = :theme',
+                null,
+                array(
+                    ':theme' => $_REQUEST['theme']
+                )
+            );
             if($usages == 0)
             {
                 try

programming_language: PHP
filename: users.php
change_type: ModificationType.MODIFY
diff: @@ -332,7 +332,7 @@ function users_form($item)
 
 	// Thousands separator
 	$data = array(
-        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
+        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
         1	=> json_decode('{"code": ",", "name": ", ---> 1,234,567"}'),
         2	=> json_decode('{"code": ".", "name": ". ---> 1.234.567"}'),
 	);

programming_language: PHP
filename: users_log.class.php
change_type: ModificationType.MODIFY
diff: @@ -135,11 +135,11 @@ class users_log
 							nvf.lid as function_title, nvf.icon as function_icon, nvul.date
 			FROM nv_users_log nvul, 
 				 nv_functions nvf
-			WHERE nvul.user = '.protect($user->id).'
+			WHERE nvul.user = '.intval($user->id).'
 			  AND nvul.function = nvf.id
 			  AND nvul.item > 0
 			  AND nvul.action = "load"
-			  AND nvul.website = '.protect($website->id).'
+			  AND nvul.website = '.intval($website->id).'
 			  AND nvul.item_title <> ""
 			  AND nvul.date > '.( core_time() - 30 * 86400).'
 			  AND nvul.date = (	SELECT MAX(nvulm.date) 
@@ -147,8 +147,8 @@ class users_log
 			  					 WHERE nvulm.function = nvul.function 
 			  					   AND nvulm.item = nvul.item
 			  					   AND nvulm.item_title = nvul.item_title
-			  					   AND nvulm.website = '.protect($website->id).'
-			  					   AND nvulm.user = '.protect($user->id).'
+			  					   AND nvulm.website = '.intval($website->id).'
+			  					   AND nvulm.user = '.intval($user->id).'
 							   )
 			ORDER BY nvul.date DESC
 			LIMIT '.$limit
@@ -169,22 +169,29 @@ class users_log
 		$DB->query('
 			SELECT DISTINCT nvul.website, nvul.function, nvul.item, nvul.date
 			FROM nv_users_log nvul
-			WHERE nvul.user = '.protect($user->id).'
-			  AND nvul.function = '.protect($function).'
+			WHERE nvul.user = :user_id
+			  AND nvul.function = :function
 			  AND nvul.item > 0
-			  AND nvul.action = '.protect($action).'
-			  AND nvul.website = '.protect($website->id).'
+			  AND nvul.action = :action
+			  AND nvul.website = :wid
 			  AND nvul.date > '.( core_time() - 30 * 86400).'
 			  AND nvul.date = (	SELECT MAX(nvulm.date) 
 			  					  FROM nv_users_log nvulm 
 			  					 WHERE nvulm.function = nvul.function 
 			  					   AND nvulm.item = nvul.item
 			  					   AND nvulm.item_title = nvul.item_title
-			  					   AND nvulm.website = '.protect($website->id).'
-			  					   AND nvulm.user = '.protect($user->id).'
+			  					   AND nvulm.website = :wid
+			  					   AND nvulm.user = :user_id
 							   )
 			ORDER BY nvul.date DESC
-			LIMIT '.$limit
+			LIMIT '.$limit,
+        'object',
+            array(
+                ':wid' => $website->id,
+                ':action' => $action,
+                ':function' => $function,
+                ':user_id' => $user->id
+            )
 		);
 
 		$rows = $DB->result();

programming_language: PHP
filename: webdictionary.class.php
change_type: ModificationType.MODIFY
diff: @@ -26,8 +26,9 @@ class webdictionary
 		{
 			if($DB->query('SELECT * FROM nv_webdictionary
 							WHERE node_id = '.intval($id).'
-							  AND node_type = '.protect('global').'
-							  AND website = '.$website->id))
+							  AND node_type = "global"
+							  AND website = '.intval($website->id))
+            )
 			{
 				$data = $DB->result();
 				$this->load_from_resultset($data); // there will be as many entries as languages enabled
@@ -67,16 +68,27 @@ class webdictionary
 					SELECT lang, text
 					  FROM nv_webdictionary 
 					 WHERE node_type = "extension"
-					   AND extension = '.protect($this->extension).'
-					   AND subtype = '.protect($this->subtype).'
-					   AND website = '.$website->id
+					   AND extension = :extension
+					   AND subtype = :subtype
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':subtype' => $this->subtype,
+                        ':extension' => $this->extension
+                    )
 				);
 
 				$data = $DB->result();
 
-				if(!is_array($data)) $data = array();
+				if(!is_array($data))
+				{
+				    $data = array();
+                }
 				foreach($data as $item)
-					$this->text[$item->lang] = $item->text;
+                {
+                    $this->text[$item->lang] = $item->text;
+                }
 			}
 			else    // theme translation (only for the current active theme)
 			{
@@ -105,9 +117,15 @@ class webdictionary
 					SELECT lang, text
 					  FROM nv_webdictionary 
 					 WHERE node_type = "theme"
-					   AND theme = '.protect($theme->name).'
-					   AND subtype = '.protect($this->subtype).'
-					   AND website = '.$website->id
+					   AND theme = :theme 
+					   AND subtype = :subtype 
+					   AND website = :wid',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':subtype' => $this->subtype,
+                        ':theme' => $theme->name
+                    )
 				);
 
 				$data = $DB->result();
@@ -163,20 +181,35 @@ class webdictionary
 
 		if(!empty($this->node_id))
 		{
+		    $query_params = array(
+                ':wid' => $this->website,
+                ':subtype' => $this->subtype,
+                ':theme' => $this->theme,
+                ':extension' => $this->extension,
+                ':node_type' => $this->node_type
+            );
+
 			if(is_numeric($this->node_id))
-				$node_id_filter .= ' AND node_id = '.intval($this->node_id);
+            {
+				$node_id_filter .= ' AND node_id = :node_id ';
+				$query_params[':node_id'] = $this->node_id;
+            }
 
 			if(is_numeric($this->node_uid))
-				$node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
+            {
+				$node_id_filter .= ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $this->node_uid;
+            }
 
 			$DB->execute('
 				DELETE FROM nv_webdictionary 
-					WHERE website = '.protect($this->website).'
-					  AND subtype = '.protect($this->subtype).'
-					  AND theme = '.protect($this->theme).' 
-					  AND extension = '.protect($this->extension).' 
-					  AND node_type = '.protect($this->node_type).
-					  $node_id_filter
+					WHERE website = :wid 
+					  AND subtype = :subtype
+					  AND theme = :theme  
+					  AND extension = :extension  
+					  AND node_type = :node_type
+					  '.$node_id_filter,
+                $query_params
 			);
 		}
 		
@@ -188,25 +221,40 @@ class webdictionary
 	{
 		global $DB;
 
-        $node_id_filter = "";
+        $node_filter = "";
 
 		// remove all old entries
 		if(!empty($this->node_id))
 		{
+		    $query_params = array(
+                ':wid' => $this->website,
+                ':extension' => $this->extension,
+                ':theme' => $this->theme,
+                ':node_type' => $this->node_type,
+                ':subtype' => $this->subtype
+            );
+
             if(is_numeric($this->node_id))
-                $node_id_filter .= ' AND node_id = '.intval($this->node_id);
+            {
+                $node_filter .= ' AND node_id = :node_id ';
+                $query_params[':node_id'] = $this->node_id;
+            }
 
             if(is_numeric($this->node_uid))
-                $node_id_filter .= ' AND node_uid = '.intval($this->node_uid);
+            {
+                $node_filter .= ' AND node_uid = :node_uid ';
+                $query_params[':node_uid'] = $this->node_uid;
+            }
 			
 			$DB->execute('
  				DELETE FROM nv_webdictionary
-				WHERE subtype = '.protect($this->subtype).'
-				  AND node_type = '.protect($this->node_type).'
-				  AND theme = '.protect($this->theme).'
-				  AND extension = '.protect($this->extension).'
-				  AND website = '.protect($this->website).
-				  $node_id_filter
+				WHERE subtype = :subtype
+				  AND node_type = :node_type
+				  AND theme = :theme 
+				  AND extension = :extension 
+				  AND website = :wid
+				  '.$node_filter,
+                $query_params
 			);
 		}
 		
@@ -227,9 +275,15 @@ class webdictionary
 			$tmp = $DB->query_single(
 				'MAX(node_id)',
 				'nv_webdictionary',
-				' subtype = '.protect($this->subtype).'
-				       AND node_type = '.protect($this->node_type).'
-					   AND website = '.$this->website
+				' subtype = :subtype 
+				       AND node_type = :node_type 
+					   AND website = :wid',
+                null,
+                array(
+                    ':wid' => $this->website,
+                    ':subtype' => $this->subtype,
+                    ':node_type' => $this->node_type
+                )
 			);
 
 			$this->node_id = intval($tmp) + 1;
@@ -290,13 +344,28 @@ class webdictionary
 	public static function load_object_strings($node_type, $node_id, $node_uid=null)
 	{
 		global $DB;
+
+		$query_params = array(
+            ':node_type' => $node_type,
+            ':node_id' => $node_id
+        );
+
+		$uid_filter = '';
+		if(!empty($node_uid))
+        {
+            $uid_filter = ' AND ( node_uid = :node_uid OR node_uid = "" OR node_uid IS NULL )';
+            $query_params[':node_uid'] = $node_uid;
+        }
+
 		
 		$DB->query('
 			SELECT subtype, lang, text
 			  FROM nv_webdictionary
-			 WHERE node_type = '.protect($node_type).'
-			   AND node_id = '.protect($node_id).
-            (empty($node_uid)? '' : ' AND ( node_uid = '.protect($node_uid).' OR node_uid = "" OR node_uid IS NULL )')
+			 WHERE node_type = :node_type
+			   AND node_id = :node_id 
+            '.$uid_filter,
+            'object',
+            $query_params
 		);
 
 		$data = $DB->result();
@@ -333,11 +402,18 @@ class webdictionary
 
                 $DB->execute('
                     DELETE FROM nv_webdictionary
-                     WHERE node_type = '.protect($node_type).'
-                       AND node_id = '.protect($node_id).'
-                       AND website = '.$website_id.'
-                       AND lang = '.protect($lang).'
-                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')'
+                     WHERE node_type = :node_type
+                       AND node_id = :node_id 
+                       AND website = :wid 
+                       AND lang = :lang
+                       AND subtype IN (:subtype)',
+                    array(
+                        ':wid' => $website_id,
+                        ':lang' => $lang,
+                        ':node_id' => $node_id,
+                        ':node_type' => $node_type,
+                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes))
+                    )
                 );
             }
         }
@@ -348,14 +424,22 @@ class webdictionary
             {
                 $subtypes = array_keys($texts);
 
-                $DB->execute('
-                    DELETE FROM nv_webdictionary
-                     WHERE node_type = '.protect($node_type).'
-                       AND node_id = '.protect($node_id).'
-                       AND website = '.$website_id.'
-                       AND lang = '.protect($lang).'
-                       AND subtype IN ('.implode(",", array_map(function($k){ return protect($k);}, $subtypes)).')
-                       AND node_uid = '.protect($node_uid)
+                $DB->execute(
+                    'DELETE FROM nv_webdictionary
+                         WHERE node_type = :node_type
+                           AND node_id = :node_id 
+                           AND website = :wid 
+                           AND lang = :lang
+                           AND subtype IN (:subtype)
+                           AND node_uid = :node_uid',
+                    array(
+                        ':wid' => $website_id,
+                        ':lang' => $lang,
+                        ':node_id' => $node_id,
+                        ':node_type' => $node_type,
+                        ':subtype' => implode(",", array_map(function($k){ return protect($k);}, $subtypes)),
+                        ':node_uid' => $node_uid
+                    )
                 );
             }
         }
@@ -364,9 +448,14 @@ class webdictionary
             // first, delete old entries (deletes too much rows when updating block group block properties)
             $DB->execute('
                 DELETE FROM nv_webdictionary
-                 WHERE node_type = '.protect($node_type).'
-                   AND node_id = '.protect($node_id).'
-                   AND website = '.$website_id
+                 WHERE node_type = :node_type 
+                   AND node_id = :node_id 
+                   AND website = :wid',
+                array(
+                    ':wid' => $website_id,
+                    ':node_type' => $node_type,
+                    ':node_id' => $node_id
+                )
             );
             // and then insert the new values
         }
@@ -422,40 +511,57 @@ class webdictionary
 			{
 				case "global":
 					// remove old entry, if exists
-					$DB->execute('
-		                DELETE FROM nv_webdictionary
-						WHERE node_id = '.protect($id).'
-						  AND node_type = '.protect('global').'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+					$DB->execute(
+                    'DELETE FROM nv_webdictionary
+						WHERE node_id = :id 
+						  AND node_type = "global"
+						  AND lang = :lang 
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $language,
+                            ':id' => $id
+                        )
+                    );
 					break;
 
 				case "theme":
 					// remove old entry, if exists
 					$DB->execute('
 		                DELETE FROM nv_webdictionary
-						WHERE subtype = '.protect($id).'
-						  AND node_type = '.protect("theme").'
-						  AND theme = '.protect($object).'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+						WHERE subtype = :id 
+						  AND node_type = "theme"
+						  AND theme = :object
+						  AND lang = :lang 
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':wid' => $website->id,
+                            ':lang' => $language,
+                            ':object' => $object,
+                            ':id' => $id
+                        )
+                    );
 					break;
 
 				case "extension":
 					// remove old entry, if exists
-					$DB->execute('
-		                DELETE FROM nv_webdictionary
-						WHERE subtype = '.protect($id).'
-						  AND node_type = '.protect("extension").'
-						  AND extension = '.protect($object).'
-						  AND lang = '.protect($language).'
-						  AND website = '.$website->id.'
-						LIMIT 1
-					');
+					$DB->execute(
+                    'DELETE FROM nv_webdictionary
+						WHERE subtype = :id
+						  AND node_type = "extension"
+						  AND extension = :object 
+						  AND lang = :lang
+						  AND website = :wid
+						LIMIT 1',
+                        array(
+                            ':id' => $id,
+                            ':object' => $object,
+                            ':lang' => $language,
+                            ':wid' => $website->id
+                        )
+                    );
 					break;
 			}
 
@@ -495,7 +601,7 @@ class webdictionary
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webdictionary WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: webdictionary_history.class.php
change_type: ModificationType.MODIFY
diff: @@ -23,20 +23,32 @@ class webdictionary_history
 			{	
 				if(strpos($subtype, 'section-')===0)
 				{			
-					if($litem=='<p><br _mce_bogus="1"></p>') continue;	// tinymce empty contents, no need to save it
+					if($litem=='<p><br _mce_bogus="1"></p>')
+                    {
+                        // equals to tinymce empty content, so no need to save it
+                        continue;
+                    }
 				
-					// has the text been changed since last save?
+					// has the text been changed since the last save?
 					$last_litem = $DB->query_single(
 						'`text`',
 						'nv_webdictionary_history',
-						'   node_id = '.protect($node_id).' AND
-							website = '.protect($website_id).' AND
-							lang = '.protect($lang).' AND
-							subtype = '.protect($subtype).' AND
-							node_type = '.protect($node_type).' AND
-							autosave = '.protect(($autosave)? '1' : '0').'
-						 ORDER BY date_created DESC
-						'
+						'   
+						    node_id = :node_id AND
+							website = :wid AND
+							lang = :lang AND
+							subtype = :subtype AND
+							node_type = :node_type AND
+							autosave = '.(($autosave)? '1' : '0').'
+						 ORDER BY date_created DESC',
+                        null,
+                        array(
+                            ':wid' => $website_id,
+                            ':node_id' => $node_id,
+                            ':lang' => $lang,
+                            ':subtype' => $subtype,
+                            ':node_type' => $node_type
+                        )
 					);
 																							
 					if($last_litem != $litem)
@@ -49,13 +61,20 @@ class webdictionary_history
 							// remove previous autosaved elements
 							$DB->execute('
 								DELETE FROM nv_webdictionary_history
-								WHERE node_id = '.protect($node_id).' AND
-									  website = '.protect($website_id).' AND
-										 lang = '.protect($lang).' AND
-									  subtype = '.protect($subtype).' AND
-									node_type = '.protect($node_type).' AND
+								WHERE node_id = :node_id AND
+									  website = :wid AND
+										 lang = :lang AND
+									  subtype = :subtype AND
+									node_type = :node_type AND
 									 autosave = 1 AND
-								 date_created < '.(core_time() - 86400 * 7)
+								 date_created < '.(core_time() - 86400 * 7),
+                                array(
+                                    ':wid' => $website_id,
+                                    ':lang' => $lang,
+                                    ':node_id' => $node_id,
+                                    ':node_type' => $node_type,
+                                    ':subtype' => $subtype
+                                )
 							);
 						}
 
@@ -92,9 +111,14 @@ class webdictionary_history
 		$DB->query('
 			SELECT subtype, lang, text
 			  FROM nv_webdictionary_history
-			 WHERE node_type = '.protect($node_type).'
-			   AND node_id = '.protect($node_id).'
-			 ORDER BY date_created ASC'
+			 WHERE node_type = :node_type 
+			   AND node_id = :node_id
+			 ORDER BY date_created ASC',
+            'object',
+            array(
+                ':node_type' => $node_type,
+                ':node_id' => $node_id
+            )
 		);
 				
 		$data = $DB->result();
@@ -119,7 +143,7 @@ class webdictionary_history
 
         $DB->query('
 			SELECT * FROM nv_webdictionary_history
-			WHERE website = '.protect($website->id),
+			WHERE website = '.intval($website->id),
 	        'object'
         );
 

programming_language: PHP
filename: website.class.php
change_type: ModificationType.MODIFY
diff: @@ -1266,7 +1266,7 @@ class website
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_websites WHERE id = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_websites WHERE id = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: websites.php
change_type: ModificationType.MODIFY
diff: @@ -31,20 +31,26 @@ function run()
 					$DB->query('
 						SELECT p.path, d.text
 						  FROM nv_paths p, nv_webdictionary d
-						 WHERE p.website = '.protect($website->id).' AND
-						       p.lang = '.protect($lang).' AND
+						 WHERE p.website = :website_id AND
+						       p.lang = :lang AND
 						       d.website = p.website AND
 						       d.node_type = p.type AND
 						       d.node_id = p.object_id AND
 						       d.lang = p.lang AND
 						       d.subtype = "title" AND 
 						       (    
-						            p.path LIKE '.protect('%'.$text.'%').'  OR  
-									d.text LIKE '.protect('%'.$text.'%').' 
+						            p.path LIKE :text  OR  
+									d.text LIKE :text 
 						       )
 						 ORDER BY d.id DESC
-						 LIMIT 10
-					');
+						 LIMIT 10',
+                        'object',
+                        array(
+					        ':website_id' => $website->id,
+                            ':lang' => $lang,
+                            ':text' => '%' . $text . '%'
+                        )
+                    );
 
 					$result = $DB->result();
 
@@ -210,13 +216,18 @@ function run()
 			break;
 
 		case 5:	// search an existing path
-			$DB->query('SELECT path as id, path as label, path as value
+			$DB->query(
+			    'SELECT path as id, path as label, path as value
 						  FROM nv_paths
-						 WHERE path LIKE '.protect('%'.$_REQUEST['term'].'%').'
-						   AND website = '.protect($_REQUEST['wid']).'
+						 WHERE path LIKE :term
+						   AND website = :website_id
 				      ORDER BY path ASC
 					     LIMIT 30',
-						'array');
+                'array',
+                array(
+                    ':website_id' => $_REQUEST['wid'],
+                    ':term' => '%'.$_REQUEST['term'].'%'
+                ));
 
 			echo json_encode($DB->result());
 
@@ -453,7 +464,7 @@ function websites_form($item)
 				  FROM nv_webdictionary
 				  WHERE node_type = "item"
 				    AND website = '.$item->id.'
-				    AND text LIKE '.protect("%navigate_download.php%").'
+				    AND text LIKE "%navigate_download.php%"
 			    LIMIT 1
 		    ');
 		    $rs = $DB->result('text');
@@ -1206,7 +1217,7 @@ function websites_form($item)
 
     // number format | thousands separator
     $data = array(
-        0	=> json_decode('{"code": "", "name": "('.strtolower(t(581, "None")).') ---> 1234567"}'),
+        0	=> json_decode('{"code": "", "name": "('.mb_strtolower(t(581, "None")).') ---> 1234567"}'),
         1	=> json_decode('{"code": ",", "name": ", ---> 1,234,567"}'),
         2	=> json_decode('{"code": ".", "name": ". ---> 1.234.567"}'),
     );

programming_language: PHP
filename: webuser_vote.class.php
change_type: ModificationType.MODIFY
diff: @@ -129,12 +129,19 @@ class webuser_vote
 		$DB->query('
 			SELECT value, COUNT(*) as votes
 			  FROM nv_webuser_votes
-             WHERE website = '.protect($website->id).'
-			   AND object  = '.protect($object).'
-               AND object_id = '.protect($object_id).'
+             WHERE website = :wid
+			   AND object  = :object
+               AND object_id = :object_id
 			 GROUP BY value
 			 ORDER BY value ASC
-		 ');
+		 ',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            )
+        );
 					 
 		$data = $DB->result();
 		
@@ -146,15 +153,23 @@ class webuser_vote
 		global $DB;
 		global $website;
 		
-		$DB->queryLimit('wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username', 
-						'nv_webuser_votes wuv, nv_webusers wu', 
-						'	 wuv.website = '.protect($website->id).'
-					   	 AND wuv.object  = '.protect($object).'
- 					   	 AND wuv.object_id = '.protect($object_id).'
-					   	 AND wu.id = wuv.webuser',
-						$orderby, 
-						$offset, 
-						$limit);
+		$DB->queryLimit(
+		    'wuv.id AS id, wuv.date AS date, wuv.webuser AS webuser, wu.username AS username',
+			'nv_webuser_votes wuv, nv_webusers wu',
+			'	 
+			    wuv.website = :wid 
+			    AND wuv.object  = :object 
+ 				AND wuv.object_id = :object_id
+				AND wu.id = wuv.webuser',
+            $orderby,
+            $offset,
+            $limit,
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            )
+        );
 					 				 
 		return array($DB->result(), $DB->foundRows());
 	}	
@@ -164,19 +179,26 @@ class webuser_vote
 		global $DB;
 		global $website;
 		
-		$fromDate = 0;
+		$from_date = 0;
 		if($since > 0)	// last x days
-			$fromDate = time() - $since*24*60*60;
+			$from_date = time() - $since * 24*60*60;
 		
 		$DB->query('
 			SELECT date, value 
 			  FROM nv_webuser_votes
-             WHERE website = '.protect($website->id).'
-			   AND object  = '.protect($object).'
-               AND object_id = '.protect($object_id).' 
-			   AND date > '.$fromDate.'
-			 ORDER BY date ASC
-        ');
+             WHERE website = :wid
+			   AND object  = :object
+               AND object_id = :object_id 
+			   AND date > :from_date
+			 ORDER BY date ASC',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id,
+                ':from_date' => $from_date
+            )
+        );
 					 
 		$data = $DB->result();
 		
@@ -204,9 +226,15 @@ class webuser_vote
 		if($DB->query('
 				SELECT *
 				  FROM nv_webuser_votes
-				 WHERE webuser = '.intval($webuser).'
-				   AND object  = '.protect($object).'
-				   AND object_id = '.protect($object_id)
+				 WHERE webuser = :webuser 
+				   AND object  = :object
+				   AND object_id = :object_id',
+        'object',
+                array(
+                    ':webuser' => $webuser,
+                    ':object' => $object,
+                    ':object_id' => $object_id
+                )
 			)
 		)
 		{
@@ -220,9 +248,14 @@ class webuser_vote
 		{
 			$ok = $DB->execute('
  				UPDATE nv_webuser_votes
-				   SET `value`	=  '.protect($value).',
-						date 	=  '.protect(core_time()).'
-				 WHERE id = '.$webuser_vote_id
+				   SET `value`	=  :value,
+						date 	=  :time
+				 WHERE id = :wu_vote_id',
+                array(
+                    ':wu_vote_id' => $webuser_vote_id,
+                    ':time' => core_time(),
+                    ':value' => $value
+                )
 			);
 			
 			if(!$ok)
@@ -284,9 +317,14 @@ class webuser_vote
 		
 		$DB->execute('
 			UPDATE '.$table[$object].' 
-			   SET votes = '.protect($votes).',
-			   	   score = '.protect($score).'
-			 WHERE id = '.protect($object_id)
+			   SET  votes = :votes, 
+			        score = :score
+			 WHERE id = :object_id',
+            array(
+                ':votes' => $votes,
+                ':score' => $score,
+                ':object_id' => $object_id
+            )
 		);
 		
 		return true;		
@@ -297,11 +335,18 @@ class webuser_vote
 		global $DB;
 		global $website;
 				
-		$DB->query('SELECT COUNT(*) as votes, SUM(value) as score
-					  FROM nv_webuser_votes
-					 WHERE object_id = '.protect($object_id).'
-					   AND object = '.protect($object).'
-					   AND website = '.$website->id);	
+		$DB->query(
+		    'SELECT COUNT(*) as votes, SUM(value) as score
+                  FROM nv_webuser_votes
+                 WHERE object_id = :object_id
+                   AND object = :object
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object' => $object,
+                ':object_id' => $object_id
+            ));
 					   
 		$data = $DB->first();
 		
@@ -355,7 +400,7 @@ class webuser_vote
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webuser_votes WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out = json_encode($DB->result());

programming_language: PHP
filename: webuser.class.php
change_type: ModificationType.MODIFY
diff: @@ -49,9 +49,18 @@ class webuser
 		global $session;
         global $events;
 
-        $ok = $DB->query('SELECT * FROM nv_webusers WHERE cookie_hash = '.protect($hash));
+        $ok = $DB->query(
+            'SELECT * FROM nv_webusers WHERE cookie_hash = :hash',
+            'object',
+            array(
+                ':hash' => $hash
+            )
+        );
+
         if($ok)
+        {
             $data = $DB->result();
+        }
 
         if(!empty($data))
 		{
@@ -99,12 +108,18 @@ class webuser
         $swuser = $DB->query_single(
             'webuser',
             'nv_webuser_profiles',
-            ' network = '.protect($network).' AND '.
-            ' network_user_id = '.protect($network_user_id)
+            ' network = :network AND network_user_id = :network_uid',
+            null,
+            array(
+                ':network' => $network,
+                ':network_uid' => $network_user_id
+            )
         );
 
         if(!empty($swuser))
+        {
             $this->load($swuser);
+        }
     }
 
     public function load_from_resultset($rs)
@@ -432,19 +447,26 @@ class webuser
 
         $website_check = '';
 		if($website > 0)
-			$website_check = 'AND website  = '.protect($website);
-
-		if($DB->query('SELECT * 
-						 FROM nv_webusers 
-						WHERE ( access = 0 OR
-						 		(access = 2 AND 
-						 			(access_begin = 0 OR access_begin < '.time().') AND 
-						 			(access_end = 0 OR access_end > '.time().') 
-					            )
-					           )
-						  '.$website_check.'
-						  AND LOWER(username) = '.protect($username))
-		)
+			$website_check = 'AND website  = '.intval($website);
+
+		$ok = $DB->query(
+		    'SELECT * 
+                     FROM nv_webusers 
+                    WHERE ( access = 0 OR
+                            (access = 2 AND 
+                                (access_begin = 0 OR access_begin < '.time().') AND 
+                                (access_end = 0 OR access_end > '.time().') 
+                            )
+                           )
+                      '.$website_check.'
+                      AND LOWER(username) = :username',
+        'object',
+            array(
+                ':username' => $username
+            )
+        );
+
+		if($ok)
 		{		
 			$data = $DB->result();
 
@@ -486,7 +508,12 @@ class webuser
         $username = $DB->query_single(
             'username',
             'nv_webusers',
-            'website = '.intval($website).' AND email = '.protect($email)
+            'website = :wid AND email = :email',
+            null,
+            array(
+                ':wid' => $website,
+                ':email' => $email
+            )
         );
 
         if(empty($username))
@@ -568,9 +595,14 @@ class webuser
 		$DB->query('
 			SELECT id, activation_key
 			  FROM nv_webusers
-			 WHERE email = '.protect($email).'
-			   AND activation_key = '.protect($hash).'
-		');
+			 WHERE email = :email
+			   AND activation_key = :hash',
+            'object',
+            array(
+                ':email' => $email,
+                ':hash' => $hash
+            )
+        );
 		$rs = $DB->first();
 
 		if(!empty($rs->id))
@@ -611,9 +643,14 @@ class webuser
 		$DB->query('
 			SELECT id, activation_key
 			  FROM nv_webusers
-			 WHERE email = '.protect($email).'
-			   AND activation_key = '.protect($hash).'
-		');
+			 WHERE email = :email
+			   AND activation_key = :hash',
+            'object',
+            array(
+                ':email' => $email,
+                ':hash' => $hash
+            )
+        );
 		$rs = $DB->first();
 
 		if(!empty($rs->id))
@@ -670,8 +707,13 @@ class webuser
         $swuser = $DB->query_single(
             'webuser',
             'nv_webuser_profiles',
-            ' network = '.protect($network).' AND '.
-            ' network_user_id = '.protect($network_user_id)
+            ' network = :network AND '.
+            ' network_user_id = :network_uid',
+            null,
+            array(
+                ':network' => $network,
+                ':network_uid' => $network_user_id
+            )
         );
 
         // the webuser already exists or is logged in?
@@ -757,10 +799,17 @@ class webuser
 		$username = mb_strtolower($username);
 	
 		$data = NULL;
-		if($DB->query('SELECT COUNT(*) as total
-					   FROM nv_webusers 
-					   WHERE LOWER(username) = '.protect($username).'
-					   	 AND website = '.$website_id))
+		if($DB->query(
+		    'SELECT COUNT(*) as total
+                   FROM nv_webusers 
+                   WHERE LOWER(username) = :username
+                     AND website = :wid',
+                array(
+                    ':wid' => $website_id,
+                    ':username' => $username
+                )
+            )
+        )
 		{
 			$data = $DB->first();
 		}
@@ -888,7 +937,7 @@ class webuser
             FROM (  
                     SELECT id, activation_key, SUBSTRING_INDEX(activation_key, "-", -1) AS expiration_time
                     FROM nv_webusers
-                    WHERE website = ' . protect($website->id) . '
+                    WHERE website = ' . intval($website->id) . '
                       AND access = 1
                       AND activation_key != ""
                   ) ex
@@ -926,7 +975,7 @@ class webuser
                 joindate, lastseen, newsletter, private_comment, 
                 access, access_begin, access_end
             FROM nv_webusers
-            WHERE website = '.protect($website->id), 'array');
+            WHERE website = '.intval($website->id), 'array');
 
         $fields = array(
             "id",
@@ -989,14 +1038,14 @@ class webuser
 
         $out = array();
 
-        $DB->query('SELECT * FROM nv_webusers WHERE website = '.protect($website->id), 'object');
+        $DB->query('SELECT * FROM nv_webusers WHERE website = '.intval($website->id), 'object');
 
         if($type='json')
             $out['nv_webusers'] = json_encode($DB->result());
 
         $DB->query('SELECT nwp.* FROM nv_webuser_profiles nwp, nv_webusers nw
                     WHERE nwp.webuser = nw.id
-                      AND nw.website = '.protect($website->id),
+                      AND nw.website = '.intval($website->id),
             'object');
 
         if($type='json')

programming_language: PHP
filename: webuser_group.class.php
change_type: ModificationType.MODIFY
diff: @@ -113,7 +113,7 @@ class webuser_group
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id));
+                    WHERE website = '.intval($website->id));
 
         return $DB->result();
     }
@@ -126,7 +126,7 @@ class webuser_group
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id));
+                    WHERE website = '.intval($website->id));
 
         $rs = $DB->result();
 
@@ -145,7 +145,7 @@ class webuser_group
 
         $DB->query('SELECT *
                     FROM nv_webuser_groups
-                    WHERE website = '.protect($website->id),
+                    WHERE website = '.intval($website->id),
                     'object');
 
         $out = $DB->result();

programming_language: PHP
filename: blocks.php
change_type: ModificationType.MODIFY
diff: @@ -85,22 +85,33 @@ function nvweb_blocks($vars=array())
 	switch($order_mode)
 	{
         case 'single':
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':id' => $vars['id']
+            );
+
             $query_type = '';
             if(!empty($vars['type']))
-                $query_type = ' AND type = '.protect($vars['type']);
+            {
+                $query_type = ' AND type = :type';
+                $query_params[':type'] = $vars['type'];
+            }
 
             $DB->query('
                 SELECT id, type
                   FROM nv_blocks
                  WHERE enabled = 1
                    '.$query_type.'
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    '.$categories_query.'
                    '.$exclusions_query.'
-                   AND id = '.protect($vars['id'])
+                   AND id = :id',
+                'object',
+                $query_params
             );
             $row = $DB->first();
 
@@ -113,19 +124,27 @@ function nvweb_blocks($vars=array())
 
         case 'priority':
 		case 'ordered':
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':type' => $vars['type']
+            );
+
             $DB->query('
                 SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    '.$categories_query.'
                    '.$exclusions_query.'
-                ORDER BY position ASC
-            ');
+                ORDER BY position ASC',
+                'object',
+                $query_params
+            );
 			$rows = $DB->result();
 
 			foreach($rows as $row)
@@ -141,42 +160,55 @@ function nvweb_blocks($vars=array())
             // "random" gets priority blocks first
             // retrieve fixed blocks
 
+            $query_params = array(
+                ':wid' => $website->id,
+                ':time' => core_time(),
+                ':type' => $vars['type']
+            );
+
             $DB->query('
                 SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
                    AND fixed = 1
                    '.$categories_query.'
                    '.$exclusions_query.'
-              ORDER BY position ASC
-            ');
+              ORDER BY position ASC',
+                'object',
+                $query_params
+            );
 
 			$fixed_rows = $DB->result();
 			$fixed_rows_ids = $DB->result('id');
 
         	if(empty($fixed_rows_ids))
-        		$fixed_rows_ids = array(0);
+            {
+                $fixed_rows_ids = array(0);
+            }
+
+        	$query_params[':fr_ids'] = implode(",", $fixed_rows_ids);
 
             // now retrieve the other blocks in random order
 			$DB->query('
 			    SELECT *
                   FROM nv_blocks
-                 WHERE type = '.protect($vars['type']).'
+                 WHERE type = :type
                    AND enabled = 1
-                   AND website = '.$website->id.'
-                   AND (date_published = 0 OR date_published < '.core_time().')
-                   AND (date_unpublish = 0 OR date_unpublish > '.core_time().')
+                   AND website = :wid
+                   AND (date_published = 0 OR date_published < :time)
+                   AND (date_unpublish = 0 OR date_unpublish > :time)
                    AND access IN('.implode(',', $access).')
-                   AND id NOT IN('.implode(",", $fixed_rows_ids).')
+                   AND id NOT IN(:fr_ids)
                    '.$categories_query.'
                    '.$exclusions_query.'
-                 ORDER BY RAND()
-            ');
+                 ORDER BY RAND()',
+                $query_params
+            );
 		
 			$random_rows = $DB->result();
 

programming_language: PHP
filename: comments.php
change_type: ModificationType.MODIFY
diff: @@ -631,14 +631,20 @@ function nvweb_comments_list($offset=0, $limit=NULL, $permission=NULL, $order='o
               FROM nv_comments nvc
              LEFT OUTER JOIN nv_webusers nvwu
                           ON nvwu.id = nvc.user
-             WHERE nvc.website = '.protect($website->id).'
-               AND nvc.object_type = '.protect($object_type).'
-               AND nvc.object_id = '.protect($object_id).'
+             WHERE nvc.website = :wid 
+               AND nvc.object_type = :object_type
+               AND nvc.object_id = :object_id 
                AND nvc.status = 0
                AND nvc.reply_to = 0
             ORDER BY ' . $orderby . '
             LIMIT ' . $limit . '
-           OFFSET ' . $offset
+           OFFSET ' . $offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         $rs = $DB->result();
@@ -673,13 +679,19 @@ function nvweb_comments_list($offset=0, $limit=NULL, $permission=NULL, $order='o
               FROM nv_comments nvc
              LEFT OUTER JOIN nv_webusers nvwu
                           ON nvwu.id = nvc.user
-             WHERE nvc.website = ' . protect($website->id) . '
-               AND nvc.object_type = '.protect($object_type).'
-               AND nvc.object_id = '.protect($object_id).'
+             WHERE nvc.website = :wid
+               AND nvc.object_type = :object_type
+               AND nvc.object_id = :object_id 
                AND nvc.status = 0
             ORDER BY ' . $orderby . '
             LIMIT ' . $limit . '
-           OFFSET ' . $offset
+           OFFSET ' . $offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':object_type' => $object_type,
+                ':object_id' => $object_id
+            )
         );
 
         $rs = $DB->result();
@@ -709,12 +721,17 @@ function nvweb_website_comments_list($offset=0, $limit=2147483647, $permission=N
                                  nvwd.website = nvc.website AND
                                  nvwd.node_type = nvc.object_type AND
                                  nvwd.subtype = "title" AND
-                                 nvwd.lang = '.protect($current['lang']).'
-				 WHERE nvc.website = '.protect($website->id).'
+                                 nvwd.lang = :lang
+				 WHERE nvc.website = :wid
 				   AND status = 0
 				ORDER BY '.$orderby.'
 				LIMIT '.$limit.'
-			   OFFSET '.$offset);
+			   OFFSET '.$offset,
+        array(
+            ':wid' => $website->id,
+            ':lang' => $current['lang']
+        )
+    );
 
     $rs = $DB->result();
     $total = $DB->foundRows();

programming_language: PHP
filename: conditional.php
change_type: ModificationType.MODIFY
diff: @@ -103,14 +103,14 @@ function nvweb_conditional($vars=array())
                        i.date_to_display, COALESCE(NULLIF(i.date_to_display, 0), i.date_created) as pdate,
                        d.text as title, i.position as position
                   FROM nv_items i, nv_structure s, nv_webdictionary d
-                 WHERE i.category IN('.implode(",", $categories).')
-                   AND i.website = '.$website->id.'
+                 WHERE i.category IN(:categories)
+                   AND i.website = :wid
                    AND i.permission <= '.$permission.'
-                   AND (i.date_published = 0 OR i.date_published < '.core_time().')
-                   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+                   AND (i.date_published = 0 OR i.date_published < :time)
+                   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                    AND s.id = i.category
-                   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-                   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+                   AND (s.date_published = 0 OR s.date_published < :time)
+                   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                    AND s.permission <= '.$permission.'
                    AND (s.access = 0 OR s.access = '.$access.$access_extra.')
                    AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
@@ -118,10 +118,17 @@ function nvweb_conditional($vars=array())
                    AND d.node_type = "item"
                    AND d.subtype = "title"
                    AND d.node_id = i.id
-                   AND d.lang = '.protect($current['lang']).'
+                   AND d.lang = :lang
                  '.$orderby.'
                  LIMIT 1
-                 OFFSET 0'
+                 OFFSET 0',
+            'object',
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $current['lang'],
+                    ':categories' => implode(",", $categories),
+                    ':time' => core_time()
+                )
             );
 
             $rs = $DB->result();
@@ -440,11 +447,16 @@ function nvweb_conditional($vars=array())
             $DB->query('
                 SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
-				   AND object_id = '.protect($item->id).'
+				 WHERE website = :wid
+				   AND object_id = :item_id
 				   AND object_type = "item"
-				   AND status = 0
-            ');
+				   AND status = 0',
+                'object',
+                array(
+                    ':wid' => $website->id,
+                    ':item_id' => $item->id
+                )
+            );
             $rs = $DB->result();
             $comments_count = intval($rs[0]->total) + 0;
 

programming_language: PHP
filename: contact.php
change_type: ModificationType.MODIFY
diff: @@ -289,9 +289,9 @@ function nvweb_contact_generate($fields)
     $text_color = '#595959';
     $title_color = '#595959';
 
-    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.background_color").' AND website = '.protect($website->id), 'id DESC');
-    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.text_color").' AND website = '.protect($website->id), 'id DESC');
-    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = '.protect("nvweb.contact.titles_color").' AND website = '.protect($website->id), 'id DESC');
+    $background_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.background_color" AND website = '.intval($website->id), 'id DESC');
+    $text_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.text_color" AND website = '.intval($website->id), 'id DESC');
+    $title_color_db = $DB->query_single('value', 'nv_permissions', 'name = "nvweb.contact.titles_color" AND website = '.intval($website->id), 'id DESC');
 
     if(!empty($background_color_db))    $background_color = str_replace('"', '', $background_color_db);
     if(!empty($text_color_db))          $text_color = str_replace('"', '', $text_color_db);

programming_language: PHP
filename: content.php
change_type: ModificationType.MODIFY
diff: @@ -317,9 +317,9 @@ function nvweb_content_comments_count($object_id = NULL, $object_type = "item")
 
 	$DB->query('SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
+				 WHERE website = '.intval($website->id).'
 				   AND object_type = "'.$object_type.'"
-				   AND object_id = '.protect($object_id).'
+				   AND object_id = '.intval($object_id).'
 				   AND status = 0'
 				);
 													
@@ -418,10 +418,14 @@ function nvweb_content_items($categories=array(), $only_published=false, $max=NU
 			   AND d.node_type = "item"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
         WHERE '.$where.'
         '.$orderby.'
-        '.$limit
+        '.$limit,
+        'object',
+        array(
+            ':lang' => $current['lang']
+        )
     );
 
     $rs = $DB->result();

programming_language: PHP
filename: gallery.php
change_type: ModificationType.MODIFY
diff: @@ -70,8 +70,8 @@ function nvweb_gallery($vars=array())
 		$DB->query('
 		    SELECT id, permission, date_published, date_unpublish
               FROM nv_items
-             WHERE category = '.protect($current['object']->id).'
-               AND website = '.$website->id.'
+             WHERE category = '.intval($current['object']->id).'
+               AND website = '.intval($website->id).'
         ');
 		$rs = $DB->first();
 		$enabled = nvweb_object_enabled($rs);

programming_language: PHP
filename: list.php
change_type: ModificationType.MODIFY
diff: @@ -248,14 +248,14 @@ function nvweb_list($vars=array())
                                     SELECT search_nwdi.node_id
                                     FROM nv_webdictionary search_nwdi
                                     WHERE search_nwdi.node_type IN ("'.$object_type.'", "property-'.$object_type.'") AND
-                                          search_nwdi.website = ' . protect($website->id) . ' AND
+                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                           search_nwdi.text LIKE ' . protect('%' . substr($what, 1) . '%') .
                             '    ) 
                                  AND '.$object_alias.'.id NOT IN( 
                                     SELECT search_npi.node_id
                                      FROM   nv_properties_items search_npi 
                                      WHERE  search_npi.element = "'.$object_type.'" AND 
-                                            search_npi.website = ' . protect($website->id) . ' AND
+                                            search_npi.website = ' . intval($website->id) . ' AND
                                             search_npi.value LIKE ' . protect('%' . substr($what, 1) . '%') . '
                                  )
                             )';
@@ -267,14 +267,14 @@ function nvweb_list($vars=array())
                                     SELECT search_nwdi.node_id
                                     FROM nv_webdictionary search_nwdi
                                     WHERE search_nwdi.node_type IN ("'.$object_type.'", "property-'.$object_type.'") AND
-                                          search_nwdi.website = ' . protect($website->id) . ' AND
+                                          search_nwdi.website = ' . intval($website->id) . ' AND
                                           search_nwdi.text LIKE ' . protect('%' . $what . '%') .
                             '    )
                                  OR '.$object_alias.'.id IN( 
                                     SELECT  search_npi.node_id
                                      FROM   nv_properties_items search_npi
                                      WHERE  search_npi.element = "'.$object_type.'" AND 
-                                            search_npi.website = ' . protect($website->id) . ' AND
+                                            search_npi.website = ' . intval($website->id) . ' AND
                                             search_npi.value LIKE ' . protect('%' . $what . '%') . '
                                 )
                             )';
@@ -354,23 +354,30 @@ function nvweb_list($vars=array())
 			            s.date_published, s.date_unpublish, s.date_published as pdate,
 			            d.text as title, s.position as position
 			  FROM nv_structure s, nv_webdictionary d
-			 WHERE s.id IN('.implode(",", $categories).')
-			   AND s.website = '.$website->id.'
+			 WHERE s.id IN(:categories)
+			   AND s.website = :wid
 			   AND s.permission <= '.$permission.'
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND d.website = s.website
 			   AND d.node_type = "structure"
 			   AND d.subtype = "title"
 			   AND d.node_id = s.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
 		     '.$templates.'
 			 '.$visible.'
 			 '.$exclude.'
 			 '.$orderby.'
 			 LIMIT '.$vars['items'].'
-			OFFSET '.$offset
+			OFFSET '.$offset,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
 		);
 
 		$rs = $DB->result();
@@ -574,14 +581,14 @@ function nvweb_list($vars=array())
                     p.date_to_display, COALESCE(NULLIF(p.date_to_display, 0), p.date_created) as pdate,
                     d.text as title, p.position as position, s.position '.$columns_extra.'
 			  FROM nv_products p, nv_structure s, nv_webdictionary d			          
-			 WHERE p.category IN('.implode(",", $categories).')
-			   AND p.website = '.$website->id.'
+			 WHERE p.category IN(:categories)
+			   AND p.website = :wid
 			   AND p.permission <= '.$permission.'
 			   AND (p.date_published = 0 OR p.date_published < '.core_time().')
 			   AND (p.date_unpublish = 0 OR p.date_unpublish > '.core_time().')
 			   AND s.id = p.category
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND s.permission <= '.$permission.'
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND (p.access = 0 OR p.access = '.$access.$access_extra_items.')
@@ -589,7 +596,7 @@ function nvweb_list($vars=array())
 			   AND d.node_type = "product"
 			   AND d.subtype = "title"
 			   AND d.node_id = p.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
              '.$filters.'
              '.$search.'
 		     '.$templates.'
@@ -598,7 +605,16 @@ function nvweb_list($vars=array())
 			 LIMIT '.$vars['items'].'
 			OFFSET '.$offset;
 
-        $DB->query($query);
+        $DB->query(
+            $query,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
+        );
 
         $rs = $DB->result();
         $total = $DB->foundRows();
@@ -646,14 +662,14 @@ function nvweb_list($vars=array())
                 $DB->query('
                     SELECT SQL_CALC_FOUND_ROWS i.id
                       FROM nv_items i, nv_structure s, nv_webdictionary d
-                     WHERE i.category IN('.implode(",", $categories).')
-                       AND i.website = '.$website->id.'
+                     WHERE i.category IN(:categories)
+                       AND i.website = :wid
                        AND i.permission <= '.$permission.'
-                       AND (i.date_published = 0 OR i.date_published < '.core_time().')
-                       AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+                       AND (i.date_published = 0 OR i.date_published < :time)
+                       AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
                        AND s.id = i.category
-                       AND (s.date_published = 0 OR s.date_published < '.core_time().')
-                       AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+                       AND (s.date_published = 0 OR s.date_published < :time)
+                       AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
                        AND s.permission <= '.$permission.'
                        AND (s.access = 0 OR s.access = '.$access.$access_extra.')
                        AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
@@ -661,12 +677,18 @@ function nvweb_list($vars=array())
                        AND d.node_type = "item"
                        AND d.subtype = "title"
                        AND d.node_id = i.id
-                       AND d.lang = '.protect($current['lang']).'                       
+                       AND d.lang = :lang                       
                      '.$templates.'
                      '.$exclude.'
                      ORDER BY i.position ASC
-                     LIMIT 1
-                ');
+                     LIMIT 1',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':lang' => $current['lang'],
+                        ':time' => core_time(),
+                        ':categories' => implode(",", $categories)
+                    ));
 
                 $rs = $DB->result();
                 $tmp = new item();
@@ -758,7 +780,7 @@ function nvweb_list($vars=array())
         $DB->query('
             SELECT id
               FROM nv_structure
-             WHERE website = '.protect($website->id).'
+             WHERE website = '.intval($website->id).'
                AND (    permission > '.$permission.'
                      OR (date_published > 0 AND '.$website->current_time().' > date_published)
                      OR (date_unpublish > 0 AND '.$website->current_time().' > date_unpublish)
@@ -814,15 +836,15 @@ function nvweb_list($vars=array())
                     i.date_to_display, COALESCE(NULLIF(i.date_to_display, 0), i.date_created) as pdate,
                     d.text as title, i.position as position, s.position '.$columns_extra.'
 			  FROM nv_items i, nv_structure s, nv_webdictionary d			          
-			 WHERE i.category IN('.implode(",", $categories).')
-			   AND i.website = '.$website->id.'
+			 WHERE i.category IN(:categories)
+			   AND i.website = :wid
 			   AND i.permission <= '.$permission.'
 			   AND i.embedding = '.$embedded.'
-			   AND (i.date_published = 0 OR i.date_published < '.core_time().')
-			   AND (i.date_unpublish = 0 OR i.date_unpublish > '.core_time().')
+			   AND (i.date_published = 0 OR i.date_published < :time)
+			   AND (i.date_unpublish = 0 OR i.date_unpublish > :time)
 			   AND s.id = i.category
-			   AND (s.date_published = 0 OR s.date_published < '.core_time().')
-			   AND (s.date_unpublish = 0 OR s.date_unpublish > '.core_time().')
+			   AND (s.date_published = 0 OR s.date_published < :time)
+			   AND (s.date_unpublish = 0 OR s.date_unpublish > :time)
 			   AND s.permission <= '.$permission.'
 			   AND (s.access = 0 OR s.access = '.$access.$access_extra.')
 			   AND (i.access = 0 OR i.access = '.$access.$access_extra_items.')
@@ -830,7 +852,7 @@ function nvweb_list($vars=array())
 			   AND d.node_type = "item"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
              '.$filters.'
              '.$search.'
 		     '.$templates.'
@@ -839,7 +861,16 @@ function nvweb_list($vars=array())
 			 LIMIT '.$vars['items'].'
 			OFFSET '.$offset;
 
-		$DB->query($query);
+		$DB->query(
+		    $query,
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang'],
+                ':time' => core_time(),
+                ':categories' => implode(",", $categories)
+            )
+        );
 
 		$rs = $DB->result();
 
@@ -864,8 +895,13 @@ function nvweb_list($vars=array())
     $nested_conditional_fragments_preprocessed = $nested_conditional_fragments;
     $conditional_placeholder_tags_preprocessed = nvweb_tags_extract($item_html, 'nvlist_conditional_placeholder', true, true, 'UTF-8'); // selfclosing = true
 
-    // now we have all elements that will be shown in the list
+    // now we have all elements that will be shown in the list (if any)
     // let's process the nvlist template for each one
+    if(empty($rs))
+    {
+        $rs = array();
+    }
+
 	for($i = 0; $i < count($rs); $i++)
 	{
         // ignore empty objects, except in custom_source or cart modes
@@ -1209,13 +1245,13 @@ function nvweb_list_parse_tag($tag, $item, $source='item', $item_relative_positi
                     $out = $DB->query_single(
                         'COUNT(id)',
                         'nv_items',
-                        ' category = '.protect($item->id).' AND
-                          website = '.protect($item->website).' AND
+                        ' category = '.intval($item->id).' AND
+                          website = '.intval($item->website).' AND
                           permission <= '.$permission.' AND 
                           (date_published = 0 OR date_published < '.core_time().') AND 
                           (date_unpublish = 0 OR date_unpublish > '.core_time().') AND 
                           (access = 0 OR access = '.$access.$access_extra.')
-                        ');
+                    ');
                     break;
 
 				default:
@@ -1278,9 +1314,11 @@ function nvweb_list_parse_tag($tag, $item, $source='item', $item_relative_positi
 	                    }
 	                    else if(!empty($item->user))
 	                    {
-		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.protect($item->user));
+		                    $email = $DB->query_single('email', 'nv_webusers', 'id = '.intval($item->user));
 		                    if(!empty($email))
-			                    $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
+                            {
+                                $gravatar_hash = md5( strtolower( trim( $item->email ) ) );
+                            }
 	                    }
 
 	                    if(!empty($gravatar_hash) && $gravatar_default != 'none')

programming_language: PHP
filename: liveedit.php
change_type: ModificationType.MODIFY
diff: @@ -39,9 +39,9 @@ function nvweb_liveedit_render($vars)
             // load the first item
             $DB->query('	SELECT id 
 								  FROM nv_items
-								 WHERE category = '.protect($current['category']).'
+								 WHERE category = '.intval($current['category']).'
 								   AND permission < 2
-								   AND website = '.$website->id.'
+								   AND website = '.intval($website->id).'
 						   ');
 
             $rs = $DB->first();

programming_language: PHP
filename: menu.php
change_type: ModificationType.MODIFY
diff: @@ -63,7 +63,7 @@ function nvweb_menu($vars=array())
         // get category parents until root (to know how many levels count from)
         while($last > 0)
         {
-            $last = $DB->query_single('parent', 'nv_structure', ' id = '.protect($last));
+            $last = $DB->query_single('parent', 'nv_structure', ' id = '.intval($last));
             $inverse_hierarchy[] = $last;
         }
         $current['hierarchy'] = array_reverse($inverse_hierarchy);
@@ -392,12 +392,19 @@ function nvweb_menu_load_dictionary()
 	{
 		$structure['dictionary'] = array();
 
-		$DB->query('SELECT node_id, text
-					  FROM nv_webdictionary 
-					 WHERE node_type = "structure"
-					   AND subtype = "title" 
-					   AND lang = '.protect($current['lang']).'
-					   AND website = '.$website->id);		
+		$DB->query(
+		    'SELECT node_id, text
+                  FROM nv_webdictionary 
+                 WHERE node_type = "structure"
+                   AND subtype = "title" 
+                   AND lang = :lang
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
+        );
 					
 		$data = $DB->result();
 		
@@ -422,11 +429,18 @@ function nvweb_menu_load_routes()
 	{
 		$structure['routes'] = array();
 
-		$DB->query('SELECT object_id, path
-					  FROM nv_paths 
-					 WHERE type = "structure"
-					   AND lang = '.protect($current['lang']).'
-					   AND website = '.$website->id);		
+		$DB->query(
+		    'SELECT object_id, path
+                  FROM nv_paths 
+                 WHERE type = "structure"
+                   AND lang = :lang
+                   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
+        );
 					
 		$data = $DB->result();
 		
@@ -455,9 +469,14 @@ function nvweb_menu_load_actions()
             SELECT node_id, subtype, text
 			  FROM nv_webdictionary 
 			 WHERE node_type = "structure"
-			   AND lang = '.protect($current['lang']).'
+			   AND lang = :lang
 			   AND subtype IN("action-type", "action-jump-item", "action-jump-branch", "action-new-window")
-			   AND website = '.$website->id
+			   AND website = :wid',
+            'object',
+            array(
+                ':wid' => $website->id,
+                ':lang' => $current['lang']
+            )
         );
 					
 		$data = $DB->result();
@@ -482,11 +501,13 @@ function nvweb_menu_load_structure($parent=0)
 	{
 		$structure['cat-'.$parent] = array();
 		
-		$DB->query('SELECT * 
-					  FROM nv_structure
-					 WHERE parent = '.protect($parent).' 
-					   AND website = '.$website->id.' 
-					  ORDER BY position ASC');
+		$DB->query(
+		    'SELECT * 
+                  FROM nv_structure
+                 WHERE parent = '.intval($parent).' 
+                   AND website = '.intval($website->id).' 
+                  ORDER BY position ASC'
+        );
 				  
 		$structure['cat-'.$parent] = $DB->result();
 

programming_language: PHP
filename: metatags.php
change_type: ModificationType.MODIFY
diff: @@ -24,11 +24,18 @@ function nvweb_metatags($vars=array())
             $section = 	$DB->query_single(
                 'text',
                 'nv_webdictionary',
-                ' node_type = '.protect($current['type']).' AND
-				    node_id = '.protect($current['object']->id).' AND
-					subtype = '.protect('title').' AND
-					website = '.$website->id.' AND
-					   lang = '.protect($current['lang'])
+                ' node_type = :type AND
+				    node_id = :object_id AND
+					subtype = "title" AND
+					website = :wid AND
+					   lang = :lang',
+                null,
+                array(
+                    ':wid' => $website->id,
+                    ':lang' => $current['lang'],
+                    ':object_id' => $current['object']->id,
+                    ':type' => $current['type']
+                )
             );
             array_push($page_title_parts, $section);
             break;

programming_language: PHP
filename: product.php
change_type: ModificationType.MODIFY
diff: @@ -368,9 +368,9 @@ function nvweb_product_comments_count($object_id = NULL)
 
 	$DB->query('SELECT COUNT(*) as total
 				  FROM nv_comments
-				 WHERE website = '.protect($website->id).'
+				 WHERE website = '.intval($website->id).'
 				   AND object_type = "product"
-				   AND object_id = '.protect($object_id).'
+				   AND object_id = '.intval($object_id).'
 				   AND status = 0'
 				);
 													
@@ -439,10 +439,14 @@ function nvweb_categories_products($categories=array(), $only_published=false, $
 			   AND d.node_type = "product"
 			   AND d.subtype = "title"
 			   AND d.node_id = i.id
-			   AND d.lang = '.protect($current['lang']).'
+			   AND d.lang = :lang
         WHERE '.$where.'
         '.$orderby.'
-        '.$limit
+        '.$limit,
+        'object',
+        array(
+            ':lang' => $current['lang']
+        )
     );
 
     $rs = $DB->result();

programming_language: PHP
filename: properties.php
change_type: ModificationType.MODIFY
diff: @@ -49,7 +49,7 @@ function nvweb_properties($vars=array())
 			{
 				// load item template
 				if(empty($vars['template']))
-					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.protect($vars['id']));
+					$vars['template'] = $DB->query_single('template', 'nv_items', ' id = '.intval($vars['id']));
 
                 // if template is not defined (embedded element), take its category template
                 if(empty($vars['template']))
@@ -109,7 +109,7 @@ function nvweb_properties($vars=array())
 				// load item type
 				if(empty($vars['type']))
                 {
-                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.protect($vars['id']));
+                    $vars['type'] = $DB->query_single('type', 'nv_blocks', ' id = '.intval($vars['id']));
 
                     if(empty($cache['block_types']))
                         $cache['block_types'] = block::types();
@@ -191,7 +191,7 @@ function nvweb_properties($vars=array())
 			if(!isset($properties['structure-'.$vars['id']]))	
 			{
 				// load category template
-				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.protect($vars['id']));
+				$category_template = $DB->query_single('template', 'nv_structure', ' id = '.intval($vars['id']));
 				if(!empty($category_template))
 				{
 					$properties['structure-'.$vars['id']] = property::load_properties("structure", $category_template, 'structure', $vars['id']);
@@ -578,7 +578,7 @@ function nvweb_properties_render($property, $vars)
 		case 'file':
             if(!empty($property->value))
             {
-			    $file = $DB->query_single('name', 'nv_files', ' id = '.protect($property->value).' AND website = '.$website->id);
+			    $file = $DB->query_single('name', 'nv_files', ' id = '.intval($property->value).' AND website = '.intval($website->id));
 
                 if($vars['return']=='url' || $vars['return']=='url-download')
                     $out = NVWEB_OBJECT.'?type=file&id='.$property->value.'&disposition=attachment';

programming_language: PHP
filename: search.php
change_type: ModificationType.MODIFY
diff: @@ -78,7 +78,7 @@ function nvweb_search($vars=array())
                                             SELECT p.node_id
                                              FROM   nv_properties_items p 
                                              WHERE  p.element = "item" AND 
-                                                    p.website = '.protect($website->id).' AND
+                                                    p.website = '.intval($website->id).' AND
                                                     p.value LIKE '.protect('%'.substr($what, 1).'%').'
                                         )';
             }
@@ -89,7 +89,7 @@ function nvweb_search($vars=array())
 			                        SELECT  p.node_id
 			                         FROM   nv_properties_items p 
 			                         WHERE  p.element = "item" AND 
-			                                p.website = '.protect($website->id).' AND
+			                                p.website = '.intval($website->id).' AND
 			                                p.value LIKE '.protect('%'.$what.'%').'
                                 )';
             }
@@ -270,13 +270,13 @@ function nvweb_search($vars=array())
                     ON wd.node_id = d.node_id
                    AND wd.lang =  ' . protect($current['lang']) . '
                    AND wd.node_type = "item"
-                   AND wd.website = ' . protect($website->id) . '			  
+                   AND wd.website = ' . intval($website->id) . '			  
                  WHERE i.website = ' . $website->id . '
                    AND i.permission <= ' . $permission . '
                    AND (i.date_published = 0 OR i.date_published < ' . core_time() . ')
                    AND (i.date_unpublish = 0 OR i.date_unpublish > ' . core_time() . ')
                    AND (i.access = 0 OR i.access = ' . $access . ')
-                   AND d.website = ' . protect($website->id) . '
+                   AND d.website = ' . intval($website->id) . '
                    AND d.node_id = i.id
                    AND d.lang =  ' . protect($current['lang']) . '
                    AND (d.node_type = "item" OR d.node_type = "tags")

programming_language: PHP
filename: tags.php
change_type: ModificationType.MODIFY
diff: @@ -83,19 +83,29 @@ function nvweb_tags_retrieve($maxtags="", $categories=array(), $order='top', $se
         ';
     }
 
+    $query_params = array(
+        ':wid' => $website->id,
+        ':lang' => $lang,
+        ':types' => implode(',', $types)
+    );
+
     if(!empty($search))
-        $extra.= ' AND text LIKE '.protect('%'.$search.'%'); // note: we will need to pass another filter after exploding the tags
+    {
+        $extra .= ' AND text LIKE :search'; // note: we will need to pass another filter after exploding the tags
+        $query_params[':search'] = '%' . $search . '%';
+    }
 
     $DB->query(
         'SELECT text FROM nv_webdictionary
-          WHERE website = '.$website->id.'
-            AND node_type IN("'.implode('","', $types).'")
+          WHERE website = :wid
+            AND node_type IN(:types)
             AND subtype = "tags"
-            AND lang = '.protect($lang).'
+            AND lang = :lang 
             '.$extra.'
           ORDER BY RAND()
         ',
-        'array'
+        'array',
+        $query_params
     );
 
     $rows = $DB->result();

programming_language: PHP
filename: votes.php
change_type: ModificationType.MODIFY
diff: @@ -23,10 +23,17 @@ function nvweb_votes($vars=array())
 				$score = $DB->query_single(
                     'value',
                     'nv_webuser_votes',
-                    ' website = '.protect($website->id).'
-					  AND webuser = '.protect($webuser->id).'
-					  AND object = '.protect($current['type']).'
-					  AND object_id = '.protect($current['id'])
+                    ' website = :wid
+					  AND webuser = :webuser_id
+					  AND object = :type
+					  AND object_id = :object_id',
+                    null,
+                    array(
+                        ':wid' => $website->id,
+                        ':webuser_id' => $webuser->id,
+                        ':type' => $current['type'],
+                        ':object_id' => $current['id']
+                    )
                 );
             }
 			$out = (empty($score)? '0' : $score);

programming_language: PHP
filename: webuser.php
change_type: ModificationType.MODIFY
diff: @@ -194,8 +194,13 @@ function nvweb_webuser($vars=array())
                     $wu_id = $DB->query_single(
                         'id',
                         'nv_webusers',
-                        ' email = '.protect($email).'
-                          AND website = '.$website->id
+                        ' email = :email
+                          AND website = :wid',
+                        null,
+                        array(
+                            ':wid' => $website->id,
+                            ':email' => $email
+                        )
                     );
 
                     $wu = new webuser();
@@ -330,11 +335,17 @@ function nvweb_webuser($vars=array())
                 $DB->query('
                   SELECT COUNT(*) AS total 
                   FROM nv_webusers WHERE
-                  website = '.protect($website->id).'
+                  website = :wid
                     AND (
-                        email = '.protect($email).' OR
-                        username = '.protect(mb_strtolower($username)).'
-                    )'
+                        email = :email OR
+                        username = :username
+                    )',
+                    'object',
+                    array(
+                        ':wid' => $website->id,
+                        ':email' => $email,
+                        ':username' => mb_strtolower($username)
+                    )
                 );
                 $rs = $DB->result('total');
                 if($rs[0] > 0)
@@ -458,8 +469,13 @@ function nvweb_webuser($vars=array())
                     $wu_id = $DB->query_single(
                         'id',
                         'nv_webusers',
-                        ' email = '.protect($email).'
-                          AND website = '.$website->id
+                        ' email = :email
+                          AND website = :wid',
+                        null,
+                        array(
+                            ':wid' => $website->id,
+                            ':email' => $email
+                        )
                     );
 
                     $wu = new webuser();
@@ -655,8 +671,12 @@ function nvweb_webuser_generate_username($email)
         $wu_id = $DB->query_single(
             'id',
             'nv_webusers',
-            ' LOWER(username) = '.protect($username).'
-                              AND website = '.$website->id
+            ' LOWER(username) = :username AND website = :wid',
+            null,
+            array(
+                ':wid' => $website->id,
+                ':username' => $username
+            )
         );
     }
 
@@ -675,8 +695,12 @@ function nvweb_webuser_generate_username($email)
         $wu_id = $DB->query_single(
             'id',
             'nv_webusers',
-            ' LOWER(username) = ' . protect($email) . '
-                                    AND website = ' . $website->id
+            ' LOWER(username) = :email AND website = :wid',
+            null,
+            array(
+                ':wid' => $website->id,
+                ':email' => $email
+            )
         );
 
         if(empty($wu_id))

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,13 @@ $website = new website(); // only needed for the users log
 
 if(!empty($_COOKIE['navigate-user']))
 {
-    $nuid = $DB->query_single('id', 'nv_users', 'cookie_hash = '.protect($_COOKIE['navigate-user']));
+    $nuid = $DB->query_single(
+        'id',
+        'nv_users',
+        'cookie_hash = :cookie_hash',
+        NULL,
+        array(':cookie_hash' => $_COOKIE['navigate-user'])
+    );
 
     if(!empty($nuid))
     {
@@ -120,7 +126,7 @@ else if(isset($_SERVER['HTTP_ACCEPT_LANGUAGE']))
 $lang = new language();
 $lang->load($language_default);
 
-// is a recover password request?
+// is it a recover password request?
 if($_REQUEST['action']=='forgot-password')
 {
     $value = mb_strtolower(trim($_REQUEST['value']));
@@ -128,8 +134,9 @@ if($_REQUEST['action']=='forgot-password')
     $found_id = $DB->query_single(
         'id',
         'nv_users',
-        ' username = '.protect($value).' OR
-                 email = '.protect($value)
+        ' username = :value OR email = :value',
+        NULL,
+        array(':value' => $value)
     );
 
     if(!$found_id)
@@ -318,7 +325,9 @@ $(document).ready(function()
         $found_id = $DB->query_single(
             'id',
             'nv_users',
-            'activation_key = '.protect($value)
+            'activation_key = :activation_key',
+            NULL,
+            array(':activation_key' => $value)
         );
 
         if(!empty($found_id))

programming_language: PHP
filename: nvweb_plugins.php
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@ function nvweb_plugins_load()
         // read the database to find the disabled plugins
         $DB->query('SELECT extension, enabled
                       FROM nv_extensions
-                     WHERE website = '.protect($website->id).'
+                     WHERE website = '.intval($website->id).'
                        AND enabled = 0');
 
         $plugins_disabled = $DB->result('extension');

programming_language: PHP
filename: nvweb_routes.php
change_type: ModificationType.MODIFY
diff: @@ -158,10 +158,16 @@ function nvweb_load_website_by_url($url, $exit=true)
     $DB->query('
 		SELECT id, folder
 		  FROM nv_websites
-		 WHERE subdomain = '.protect($subdomain).'
-		   AND ( domain = '.protect($domain).' OR domain = '.protect($idn->encode($domain)).' ) 
+		 WHERE subdomain = :subdomain
+		   AND ( domain = :domain OR domain = :idn_domain ) 
 		 ORDER BY folder DESC
-	 ');
+	 ',
+        'object',
+        array(
+            ':subdomain' => $subdomain,
+            ':domain' => $domain,
+            ':idn_domain' => $idn->encode($domain)
+        ));
 	$websites = $DB->result();
 
 	if(empty($websites))
@@ -351,7 +357,7 @@ function nvweb_route_parse($route="")
 				$current['id'] = $node;
 				
 				$DB->query('SELECT * FROM nv_items 
-							 WHERE id = '.protect($current['id']).'
+							 WHERE id = '.intval($current['id']).'
 							   AND website = '.$website->id);
 				$current['object'] = $DB->first();
 				
@@ -359,7 +365,7 @@ function nvweb_route_parse($route="")
 				if($current['navigate_session']!=1 && !nvweb_is_bot())
 				{
 					$DB->execute(' UPDATE nv_items SET views = views + 1 
-								   WHERE id = '.$current['id'].' 
+								   WHERE id = '.intval($current['id']).' 
 									 AND website = '.$website->id);
 				}
 
@@ -377,7 +383,7 @@ function nvweb_route_parse($route="")
 				$current['id'] = $product;
 
 				$DB->query('SELECT * FROM nv_products 
-							 WHERE id = '.protect($current['id']).'
+							 WHERE id = '.intval($current['id']).'
 							   AND website = '.$website->id);
 				$current['object'] = $DB->first();
 
@@ -385,7 +391,7 @@ function nvweb_route_parse($route="")
 				if($current['navigate_session']!=1 && !nvweb_is_bot())
 				{
 					$DB->execute(' UPDATE nv_products SET views = views + 1 
-								   WHERE id = '.$current['id'].' 
+								   WHERE id = '.intval($current['id']).' 
 									 AND website = '.$website->id);
 				}
 
@@ -445,9 +451,11 @@ function nvweb_route_parse($route="")
 		default:
 			$DB->query('
                 SELECT * FROM nv_paths 
-				WHERE path = '.protect('/'.$route).' AND 
+				WHERE path = :route AND 
 				      website = '.$website->id.'
-				ORDER BY id DESC'
+				ORDER BY id DESC',
+                'object',
+                array(':route' => '/' . $route)
             );
 			$rs = $DB->result();
 
@@ -602,14 +610,14 @@ function nvweb_route_parse($route="")
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_structure SET views = views + 1 
-                                            WHERE id = '.protect($current['id']).' 
+                                            WHERE id = '.intval($current['id']).' 
                                               AND website = '.$website->id);
                         }
                         break;
 
                     case 'item':
                         $DB->query('SELECT * FROM nv_items 
-                                     WHERE id = '.protect($current['id']).'
+                                     WHERE id = '.intval($current['id']).'
                                        AND website = '.$website->id);
 
                         $current['object'] = $DB->first();
@@ -618,14 +626,14 @@ function nvweb_route_parse($route="")
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_items SET views = views + 1 
-                                           WHERE id = '.$current['id'].' 
+                                           WHERE id = '.intval($current['id']).' 
                                              AND website = '.$website->id);
                         }
                         break;
 
                     case 'product':
                         $DB->query('SELECT * FROM nv_products 
-                                     WHERE id = '.protect($current['id']).'
+                                     WHERE id = '.intval($current['id']).'
                                        AND website = '.$website->id);
 
                         $current['object'] = $DB->first();
@@ -634,7 +642,7 @@ function nvweb_route_parse($route="")
                         if($current['navigate_session']!=1 && !nvweb_is_bot())
                         {
                             $DB->execute(' UPDATE nv_products SET views = views + 1 
-                                           WHERE id = '.$current['id'].' 
+                                           WHERE id = '.intval($current['id']).' 
                                              AND website = '.$website->id);
                         }
                         break;
@@ -837,12 +845,17 @@ function nvweb_source_url($type, $id, $lang='')
             $id = $DB->query_single(
                 'id',
                 'nv_items',
-                'website = '.protect($website->id).'
-                 AND template = '.protect($template_type).'
+                'website = :website_id
+                 AND template = :template_type
                  AND permission = 0
                  AND access = 0
                  AND (date_published = 0 OR date_published < '.core_time().')
-                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
+                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
+                NULL,
+                array(
+                    ':website_id' => $website->id,
+                    ':template_type' => $template_type
+                )
             );
             if(!empty($id))
                 $type = 'item';
@@ -854,12 +867,17 @@ function nvweb_source_url($type, $id, $lang='')
             $id = $DB->query_single(
                 'id',
                 'nv_structure',
-                'website = '.protect($website->id).'
-                 AND template = '.protect($template_type).'
+                'website = :website_id
+                 AND template = :template_type
                  AND permission = 0
                  AND access = 0
                  AND (date_published = 0 OR date_published < '.core_time().')
-                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')'
+                 AND (date_unpublish = 0 OR date_unpublish > '.core_time().')',
+                NULL,
+                array(
+                   ':website_id' => $website->id,
+                   ':template_type' => $template_type
+                )
             );
             if(!empty($id))
                 $type = 'structure';
@@ -875,10 +893,16 @@ function nvweb_source_url($type, $id, $lang='')
     $url = $DB->query_single(
 		'path',
 		'nv_paths',
-		' type = '.protect($type).'
-		   AND object_id = '.protect($id).'
-		   AND lang = '.protect($lang).'
-		   AND website = '.$website->id
+		' type = :type
+		   AND object_id = :object_id
+		   AND lang = :lang
+		   AND website = '.$website->id,
+        NULL,
+        array(
+            ':type' => $type,
+            ':object_id' => $id,
+            ':lang' => $lang
+        )
 	);
 
 	if(empty($url))

programming_language: PHP
filename: nvweb_templates.php
change_type: ModificationType.MODIFY
diff: @@ -75,16 +75,21 @@ function nvweb_dictionary_load()
 	$DB->query('SELECT node_id, text
 				  FROM nv_webdictionary 
 				 WHERE node_type = "global"
-				   AND lang = '.protect($session['lang']).'
+				   AND lang = :lang
 				   AND website = '.$website->id.'
 				 UNION
 				 SELECT subtype AS node_id, text
 				 FROM nv_webdictionary
 				 WHERE node_type = "theme"
-				   AND theme = '.protect($website->theme).' 
-				   AND lang = '.protect($session['lang']).'
-				   AND website = '.$website->id
-			   );		
+				   AND theme = :ws_theme 
+				   AND lang = :lang
+				   AND website = '.$website->id,
+        'object',
+        array(
+            ':lang' => $session['lang'],
+            ':ws_theme' => $website->theme,
+        )
+    );
 						
 	$data = $DB->result();
 	
@@ -320,8 +325,12 @@ function nvweb_template_parse($template)
 									   node_type = "structure"
 								   AND subtype = "title"
 								   AND node_id = '.$tmp.'
-								   AND lang = '.protect($current['lang']).'
-								   AND website = '.$website->id
+								   AND lang = :lang
+								   AND website = '.$website->id,
+                                NULL,
+                                array(
+                                    ':lang' => $current['lang']
+                                )
 							);
 						}
 						break;

programming_language: PHP
filename: nvweb_xmlrpc.php
change_type: ModificationType.MODIFY
diff: @@ -135,7 +135,7 @@ function nvweb_xmlrpc()
 			$DB->query('
 				SELECT id
 				  FROM nv_structure
-				 WHERE website = '.protect($website_id).'
+				 WHERE website = '.intval($website_id).'
 				   AND permission < 2
 				ORDER BY parent ASC, position  ASC
 			');
@@ -203,9 +203,11 @@ function nvweb_xmlrpc()
 					         WHERE w.website = '.intval($website_id).'
 					           AND w.node_type = "structure"
 					           AND w.subtype = "title"
-					           AND w.text LIKE '.protect($category_name).'
-					   )
-				');
+					           AND w.text LIKE :category_name
+					   )',
+                    'object',
+                    array(':category_name' => $category_name)
+                );
 
 				$category = $DB->result('id');
 				$category = $category[0];

programming_language: PHP