From 5fcac3604abdcfbf6f422f8ea58bee33304f1825 Mon Sep 17 00:00:00 2001
From: slef <slef>
Date: Thu, 8 Jan 2004 17:29:56 +0000
Subject: [PATCH] DBI call fix for bug 662.

---
 bookcount.pl                       | 45 +++++++++++-------------------
 value_builder/unimarc_field_60X.pl |  7 ++---
 2 files changed, 19 insertions(+), 33 deletions(-)

diff --git a/bookcount.pl b/bookcount.pl
index bbb2709b04..0fab4f78a9 100755
--- a/bookcount.pl
+++ b/bookcount.pl
@@ -107,10 +107,8 @@ use DBI;
 sub itemdatanum {
     my ($itemnumber)=@_;
     my $dbh = C4::Context->dbh;
-    my $itm = $dbh->quote("$itemnumber");
-    my $query = "select * from items where itemnumber=$itm";
-    my $sth=$dbh->prepare($query);
-    $sth->execute;
+    my $sth=$dbh->prepare("select * from items where itemnumber=?");
+    $sth->execute($itemnumber);
     my $data=$sth->fetchrow_hashref;
     $sth->finish;
     return($data);
@@ -119,14 +117,12 @@ sub itemdatanum {
 sub lastmove {
       my ($itemnumber)=@_;
       my $dbh = C4::Context->dbh;
-      my $var1 = $dbh->quote($itemnumber);
-      my $sth =$dbh->prepare("select max(branchtransfers.datearrived) from branchtransfers where branchtransfers.itemnumber=$var1");
-      $sth->execute;
+      my $sth =$dbh->prepare("select max(branchtransfers.datearrived) from branchtransfers where branchtransfers.itemnumber=?");
+      $sth->execute($itemnumber);
       my ($date) = $sth->fetchrow_array;
       return(0, "Item has no branch transfers record") if not $date;
-      my $var2 = $dbh->quote($date);
-      $sth=$dbh->prepare("Select * from branchtransfers where branchtransfers.itemnumber=$var1 and branchtransfers.datearrived=$var2");
-      $sth->execute;
+      $sth=$dbh->prepare("Select * from branchtransfers where branchtransfers.itemnumber=? and branchtransfers.datearrived=?");
+      $sth->execute($itemnumber,$date);
       my ($data) = $sth->fetchrow_hashref;
       return(0, "Item has no branch transfers record") if not $data;
       $sth->finish;
@@ -136,10 +132,8 @@ sub lastmove {
 sub issuessince {
       my ($itemnumber, $date)=@_;
       my $dbh = C4::Context->dbh;
-      my $itm = $dbh->quote($itemnumber);
-      my $dat = $dbh->quote($date);
-      my $sth=$dbh->prepare("Select count(*) from issues where issues.itemnumber=$itm and issues.timestamp > $dat");
-      $sth->execute;
+      my $sth=$dbh->prepare("Select count(*) from issues where issues.itemnumber=? and issues.timestamp > ?");
+      $sth->execute($itemnumber,$date);
       my $count=$sth->fetchrow_hashref;
       $sth->finish;
       return($count->{'count(*)'});
@@ -148,32 +142,25 @@ sub issuessince {
 sub issuesat {
       my ($itemnumber, $brcd)=@_;
       my $dbh = C4::Context->dbh;
-      my $itm = $dbh->quote($itemnumber);
-      my $brc = $dbh->quote($brcd);
-      my $query = "Select count(*) from issues where itemnumber=$itm and branchcode = $brc";
-      my $sth=$dbh->prepare($query);
-      $sth->execute;
+      my $sth=$dbh->prepare("Select count(*) from issues where itemnumber=? and branchcode = ?");
+      $sth->execute($itemnumber,$brcd);
       my ($count)=$sth->fetchrow_array;
       $sth->finish;
       return($count);
 }
 
 sub lastseenat {
-      my ($itemnumber, $brcd)=@_;
+      my ($itm, $brc)=@_;
       my $dbh = C4::Context->dbh;
-      my $itm = $dbh->quote($itemnumber);
-      my $brc = $dbh->quote($brcd);
-      my $query = "Select max(timestamp) from issues where itemnumber=$itm and branchcode = $brc";
-      my $sth=$dbh->prepare($query);
-      $sth->execute;
+      my $sth=$dbh->prepare("Select max(timestamp) from issues where itemnumber=? and branchcode = ?");
+      $sth->execute($itm,$brc);
       my ($date1)=$sth->fetchrow_array;
       $sth->finish;
-      $query = "Select max(datearrived) from branchtransfers where itemnumber=$itm and tobranch = $brc";
-      # FIXME - There's already a $sth in this scope.
-      my $sth=$dbh->prepare($query);
-      $sth->execute;
+      $sth=$dbh->prepare("Select max(datearrived) from branchtransfers where itemnumber=? and tobranch = ?");
+      $sth->execute($itm,$brc);
       my ($date2)=$sth->fetchrow_array;
       $sth->finish;
+      #FIXME: MJR thinks unsafe
       $date2 =~ s/-//g;
       $date2 =~ s/://g;
       $date2 =~ s/ //g;
diff --git a/value_builder/unimarc_field_60X.pl b/value_builder/unimarc_field_60X.pl
index 29f6b136eb..26211395e0 100644
--- a/value_builder/unimarc_field_60X.pl
+++ b/value_builder/unimarc_field_60X.pl
@@ -77,13 +77,12 @@ sub plugin {
 	my $authoritysep = C4::Context->preference('authoritysep');
 	my @splitted = /$authoritysep/,$search_string;
 	my $level = $#splitted+1;
-	my $query;
+	my $sti;
 	if ($search_string) { # if no search pattern, returns only the 50 1st top level values
-		$query = "select distinct freelib,father,level from bibliothesaurus where category='NC' and freelib like ? order by father,freelib";
+		$sti=$dbh->prepare("select distinct freelib,father,level from bibliothesaurus where category='NC' and freelib like ? order by father,freelib");
 	} else {
-		$query = "select distinct freelib,father,level from bibliothesaurus where category='NC' and level=0 and freelib like ? order by father,freelib limit 0,50";
+		$sti=$dbh->prepare("select distinct freelib,father,level from bibliothesaurus where category='NC' and level=0 and freelib like ? order by father,freelib limit 0,50");
 	}
-	my $sti=$dbh->prepare($query);
 	$sti->execute($Rsearch_string);
 	my @results;
 	while (my ($freelib,$father,$level)=$sti->fetchrow) {