Code review (profile)

profile.module

Line 452: Use ANSI standard <> instead of !=

    $result = db_query('SELECT name, title, type, weight, page FROM {profile_fields} WHERE fid != %d AND visibility = %d ORDER BY weight', $field->fid, PROFILE_PUBLIC_LISTINGS);

Line 478: Use ANSI standard <> instead of !=

    $result = pager_query("SELECT u.uid, u.access FROM {users} u INNER JOIN {profile_values} v ON u.uid = v.uid WHERE v.fid = %d AND $query AND u.access != 0 AND u.status != 0 ORDER BY u.access DESC", 20, 0, NULL, $arguments);

Line 478: In SQL strings, Use db_query() placeholders in place of variables. This is a protential source of SQL injection attacks when the variable can come from user data. (Drupal Docs)
```
    $result = pager_query("SELECT u.uid, u.access FROM {users} u INNER JOIN {profile_values} v ON u.uid = v.uid WHERE v.fid = %d AND $query AND u.access != 0 AND u.status != 0 ORDER BY u.access DESC", 20, 0, NULL, $arguments);
```
Explanation: Use %s and %d variable substitution. When inserting an array of values use $placeholders = implode(',', array_fill(0, count($args), "'%s'"));

Line 511: Use ANSI standard <> instead of !=

    $result = pager_query('SELECT uid, access FROM {users} WHERE uid > 0 AND status != 0 AND access != 0 ORDER BY access DESC', 20, 0, NULL);

Line 600: Use ANSI standard <> instead of !=

    $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d ORDER BY category, weight', PROFILE_HIDDEN);

Line 603: Use ANSI standard <> instead of !=

    $result = db_query('SELECT * FROM {profile_fields} WHERE visibility != %d AND visibility != %d ORDER BY category, weight', PROFILE_PRIVATE, PROFILE_HIDDEN);

aggregator (core)	googleanalytics (active)	taxonomy (active) (core)
api (active)	help (active) (core)	throttle (core)
block (active) (core)	legacy	tracker (core)
blog (core)	locale (core)	upload (core)
blogapi (core)	menu (active) (core)	user (active) (core)
book (core)	node (active) (core)	watchdog (active)
coder (active)	path (active) (core)	xmlsitemap (active)
color (active) (core)	ping (core)	xmlsitemap_engines (active)
comment (active) (core)	poll (core)	xmlsitemap_node (active)
contact (core)	profile (core)	xmlsitemap_term (active)
drupal (core)	search (core)	xmlsitemap_user (active)
filter (active) (core)	statistics (active) (core)
forum (core)	system (active) (core)

bluemarine (core)	garland (active) (core)	minnelli (core)
chameleon (core)	marvin (core)	pushbutton (core)

drupalcode.com

Search Drupal 5

Navigation

profile.module

profile.install