vb 3.5 and globalize()

[Mythotical]

Ok I am working on porting a vb 3.0.3 hack to vb 3.5 and globalize is no longer used so I need to know what replaced it and say for instance replace this line:

PHP Code:

globalize($_REQUEST, array('u' => INT)); 


I figured out quite alot of the new stuff just that is questioning my experiences. Kinda mind boggling for me. hehe

Any help would be much appreciated.

Yes this is unaltered file and vbulletin test forum.

Thanks
Myth

[merk]

PHP Code:

$vbulletin->input->clean_gpc('r', 'goto', TYPE_STR); 


Change "R" based on which superglobal you want to clean from (request, post, get, cookies, etc)

Change goto to the variable you wish to clean, and type_str to the type you want to clean it to (find them in a file somewhere, not sure which)

You should then use the below method to access the variable (not it doesnt get "globalised").

PHP Code:

$vbulletin->GPC['goto'] 


You may also clean multiple variables in one command,

PHP Code:

$vbulletin->input->clean_array_gpc('r', array(
 'perpage'   => TYPE_UINT,
 'pagenumber' => TYPE_UINT,
 'highlight'  => TYPE_STR,
 'posted'  => TYPE_BOOL,
)); 


[Mythotical]

Thanks that helped.

Now I get this error:

Database error in vBulletin 3.5.0 Release Candidate 2:

Invalid SQL:

		SELECT username
		FROM vbuser
		WHERE userid =;

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 3
Error Number : 1064
Date         : Monday, September 5th 2005 @ 09:35:22 AM
Script       : http://www.eternaltide.net/test/admincp/qas.php?&do=qaslink&u=1
Referrer     : 
IP Address   : XX.XXX.XXX.XX
Username     : Admin
Classname    : vb_database

This is what its referring to:

PHP Code:

    $vbulletin->input->clean_array_gpc('r', array( 'u' => TYPE_UINT));
    $user = $db->query_first("
        SELECT username
        FROM " . TABLE_PREFIX . "user
        WHERE userid = $u
    "); 


thanks Merk for your help

Myth

[merk]

You will need to set $u yourself or change $u to {$vbulletin->GPC[u]}

[Mythotical]

so how would I set it myself also if not that, how would or where would {$vbulletin->GPC[u]} go? Would I just put it in place of WHERE userid = $u to look liked WHERE userid = {$vbulletin->GPC[u]} ?

[merk]

Hrm - not only that but you're using the wrong function.

PHP Code:

$vbulletin->input->clean_gpc('r', 'u', TYPE_UINT);
    $user = $db->query_first(" 
        SELECT username 
        FROM " . TABLE_PREFIX . "user 
        WHERE userid = " . $vbulletin->GPC['u']
    ); 


[Mythotical]

Ok got it but this new warning shows up:

Warning: Invalid argument supplied for foreach() in /includes/class_core.php on line 1519

This is at line 1519:

		foreach ($variables AS $varname => $vartype)
		{
			if (!isset($this->registry->GPC["$varname"])) // limit variable to only being "cleaned" once to avoid potential corruption
			{
				$this->registry->GPC_exists["$varname"] = isset($sg["$varname"]);
				$this->registry->GPC["$varname"] =& $this->clean(
					$sg["$varname"],
					$vartype,
					isset($sg["$varname"])
				);
			}
		}
	}

That is 1519 to 1531

Now after that warning I get this:

Database error in vBulletin 3.5.0 Release Candidate 2:

Invalid SQL:

		SELECT userid, username, qas
		FROM vbuser
		WHERE userid =;

MySQL Error  : You have an error in your SQL syntax.  Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 3
Error Number : 1064
Date         : Monday, September 5th 2005 @ 09:51:34 AM
Script       : http://www.eternaltide.net/test/admincp/qas.php
Referrer     : 
IP Address   : XX.XXX.XXX.XX
Username     : Admin
Classname    : vb_database

Now what I think its refering to is in one of two places, I am providing both places, please double check to make sure I have it correct.

Place 1:

PHP Code:

    $vbulletin->input->clean_array_gpc('r', 'u', TYPE_UINT, 'u2');
    $user1 = $db->query_first("
        SELECT userid, username, qas
        FROM " . TABLE_PREFIX . "user
        WHERE userid = " . $vbulletin->GPC['u']
        ); 


Place 2:

PHP Code:

    $user1 = $db->query_first("
        SELECT userid, username, qas
        FROM " . TABLE_PREFIX . "user
        WHERE userid = " . $vbulletin->GPC['u']
        );
    $returntou1="$vbphrase[qas_return_to] <a href=\"user.php?$session[sessionurl]&do=edit&u=$user1[userid]\">$user1[username]'s $vbphrase[profile]</a>";
    $user2 = $db->query_first("
        SELECT userid, username, qas
        FROM " . TABLE_PREFIX . "user
        WHERE userid = " . $vbulletin->GPC['u2']
        ); 


Thanks again Merk

Myth

[merk]

The warning at the top of your post indicates that $variables is not an array. Code above that that builds $variables might not be returning anything.

The database error that you are getting is a similar cause of the same problem above.

As for your attempt to use "u2" as a variable will fail because you havent cleaned it first. You must clean all variables you're using.

Call the function you call for u, but replace u with u2.

[Mythotical]

Ok Merk, no go, couldn't get it figured out.

I can't find the function used to call for u.

Ok the whole warning thing I'm ignoring for now as I believe this coding error is whats causing that warning.

How would I clean the variable for "u2"? What should the function look like?

[merk]

I take it the user1 query in "place 1" and "place 2" are the same query?

You need to clean every single input variable you might be using to make sure they are actually input variables.

They do not get globalised, so you need to access them from where vBulletin stores them, $vbulletin->GPC['name'].

To get them put into that GPC array, you will need to run clean_gpc or clean_array_gpc (the second one takes many different variables at the same time, does the same thing).

To clean 2 variables, you should use (which would replace the clean_gpc command that you are using at place one.

PHP Code:

$vbulletin->input->clean_array_gpc('r', array(
 'u'   => TYPE_UINT,
 'u2' => TYPE_UINT,
));