From 787f6d01d961b841d563ebd121d8ff9a4853312f Mon Sep 17 00:00:00 2001
From: slef <slef>
Date: Thu, 8 Jan 2004 17:11:48 +0000
Subject: [PATCH] DBI call fix for bug 662.

---
 overdue.pl | 22 ++++++++--------------
 pay.pl     | 22 +++++++++-------------
 stats2.pl  |  7 +++----
 3 files changed, 20 insertions(+), 31 deletions(-)

diff --git a/overdue.pl b/overdue.pl
index 4a08882a21..05a4ad6fe7 100755
--- a/overdue.pl
+++ b/overdue.pl
@@ -56,9 +56,8 @@ my $todaysdate = (1900+$datearr[5]).'-'.sprintf ("%0.2d", ($datearr[4]+1)).'-'.s
 
 my $dbh = C4::Context->dbh;
 
-my $query="select date_due,borrowernumber,itemnumber from issues where isnull(returndate) && date_due<'$todaysdate' order by date_due,borrowernumber";
-my $sth=$dbh->prepare($query);
-$sth->execute;
+my $sth=$dbh->prepare("select date_due,borrowernumber,itemnumber from issues where isnull(returndate) && date_due<? order by date_due,borrowernumber");
+$sth->execute($todaysdate);
 
 my @overduedata;
 while (my $data=$sth->fetchrow_hashref) {
@@ -66,27 +65,22 @@ while (my $data=$sth->fetchrow_hashref) {
   $bornum=$data->{'borrowernumber'};
   $itemnum=$data->{'itemnumber'};
 
-  my $query="select concat(firstname,' ',surname),phone,emailaddress from borrowers where borrowernumber='$bornum'";
-  my $sth1=$dbh->prepare($query);
-  $sth1->execute;
+  my $sth1=$dbh->prepare("select concat(firstname,' ',surname),phone,emailaddress from borrowers where borrowernumber=?");
+  $sth1->execute($bornum);
   $data1=$sth1->fetchrow_hashref;
   $name=$data1->{'concat(firstname,\' \',surname)'};
   $phone=$data1->{'phone'};
   $email=$data1->{'emailaddress'};
   $sth1->finish;
 
-  # FIXME - There's already a $query in this scope.
-  my $query="select biblionumber from items where itemnumber='$itemnum'";
-  my $sth2=$dbh->prepare($query);
-  $sth2->execute;
+  my $sth2=$dbh->prepare("select biblionumber from items where itemnumber=?");
+  $sth2->execute($itemnum);
   $data2=$sth2->fetchrow_hashref;
   $biblionumber=$data2->{'biblionumber'};
   $sth2->finish;
 
-  # FIXME - There's already a $query in this scope.
-  my $query="select title,author from biblio where biblionumber='$biblionumber'";
-  my $sth3=$dbh->prepare($query);
-  $sth3->execute;
+  my $sth3=$dbh->prepare("select title,author from biblio where biblionumber=?");
+  $sth3->execute($biblionumber);
   $data3=$sth3->fetchrow_hashref;
   $title=$data3->{'title'};
   $author=$data3->{'author'};
diff --git a/pay.pl b/pay.pl
index 54c2a8358a..f3de382b0e 100755
--- a/pay.pl
+++ b/pay.pl
@@ -157,28 +157,24 @@ sub writeoff{
 	$user=~ s/Shannon/S/;
 	my $dbh = C4::Context->dbh;
 	my $env;
-	my $query="Update accountlines set amountoutstanding=0 where ";
+	my $sth;
 	if ($accounttype eq 'Res'){
-		$query.="accounttype='Res' and accountno='$accountnum' and borrowernumber='$bornum'";
+		$sth=$dbh->prepare("Update accountlines set amountoutstanding=0 where accounttype='Res' and accountno=? and borrowernumber=?");
+		$sth->execute($accountnum,$bornum);
 	} else {
-		$query.="accounttype='$accounttype' and itemnumber='$itemnum' and borrowernumber='$bornum'";
+		$sth=$dbh->prepare("Update accountlines set amountoutstanding=0 where accounttype=? and itemnumber=? and borrowernumber=?");
+		$sth->execute($accounttype,$itemnum,$bornum);
 	}
-	my $sth=$dbh->prepare($query);
-	#  print $query;
-	$sth->execute;
 	$sth->finish;
-	$query="select max(accountno) from accountlines";
-	$sth=$dbh->prepare($query);
+	$sth=$dbh->prepare("select max(accountno) from accountlines");
 	$sth->execute;
 	my $account=$sth->fetchrow_hashref;
 	$sth->finish;
 	$account->{'max(accountno)'}++;
-	$query="insert into accountlines (borrowernumber,accountno,itemnumber,date,amount,description,accounttype)
-						values ('$bornum','$account->{'max(accountno)'}','$itemnum',now(),'$amount','Writeoff','W')";
-	$sth=$dbh->prepare($query);
-	$sth->execute;
+	$sth=$dbh->prepare("insert into accountlines (borrowernumber,accountno,itemnumber,date,amount,description,accounttype)
+						values (?,?,?,now(),?,'Writeoff','W')");
+	$sth->execute($bornum,$account->{'max(accountno)'},$itemnum,$amount);
 	$sth->finish;
-	#  print $query;
 	UpdateStats($env,$user,'writeoff',$amount,'','','',$bornum);
 }
 
diff --git a/stats2.pl b/stats2.pl
index 8944b027fc..2b11ca1689 100755
--- a/stats2.pl
+++ b/stats2.pl
@@ -62,15 +62,14 @@ $date=UnixDate($date,'%Y-%m-%d');
 $date2=UnixDate($date2,'%Y-%m-%d');
 
 my $dbh = C4::Context->dbh;
-my $query="select *
+my $sth=$dbh->prepare("select *
 from accountlines,accountoffsets,borrowers where
 accountlines.borrowernumber=accountoffsets.borrowernumber and
 (accountlines.accountno=accountoffsets.accountno or accountlines.accountno
 =accountoffsets.offsetaccount) and accountlines.timestamp >=20000621000000
 and borrowers.borrowernumber=accountlines.borrowernumber
-group by accountlines.borrowernumber,accountlines.accountno";
-my $sth=$dbh->prepare($query);
-$sth->execute;
+group by accountlines.borrowernumber,accountlines.accountno");
+$sth->execute();
 
 
 
-- 
2.39.5