From 7b5ebdd51b7cedcd8c9ff10187fd4550a994119a Mon Sep 17 00:00:00 2001
From: slef <slef>
Date: Wed, 3 Dec 2003 01:42:03 +0000
Subject: [PATCH] bug 662 fixes securing DBI

---
 C4/Biblio.pm | 1053 +++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 818 insertions(+), 235 deletions(-)

diff --git a/C4/Biblio.pm b/C4/Biblio.pm
index eafaaa444a..1ff2b99480 100644
--- a/C4/Biblio.pm
+++ b/C4/Biblio.pm
@@ -621,8 +621,8 @@ sub MARCmodsubfield {
 	    $sth=$dbh->prepare("select max(blobidlink) from marc_blob_subfield");
 	    $sth->execute;
 	    my ($res)=$sth->fetchrow;
-	    $sth=$dbh->prepare("update marc_subfield_table set subfieldvalue=null, valuebloblink=$res where subfieldid=?");
-	    $sth->execute($subfieldid);
+	    $sth=$dbh->prepare("update marc_subfield_table set subfieldvalue=null, valuebloblink=? where subfieldid=?");
+	    $sth->execute($res,$subfieldid);
 	}
     } else {
 	# note this can leave orphan bloblink. Not a big problem, but we should build somewhere a orphan deleting script...
@@ -646,16 +646,19 @@ sub MARCfindsubfield {
     my $subfieldid;
     my $lastsubfieldid;
     my $query="select subfieldid from marc_subfield_table where bibid=? and tag=? and subfieldcode=?";
+    my @bind_values = ($bibid,$tag, $subfieldcode);
     if ($subfieldvalue) {
-	$query .= " and subfieldvalue=".$dbh->quote($subfieldvalue);
+	$query .= " and subfieldvalue=?";
+	push(@bind_values,$subfieldvalue);
     } else {
 	if ($subfieldorder<1) {
 	    $subfieldorder=1;
 	}
-	$query .= " and subfieldorder=$subfieldorder";
+	$query .= " and subfieldorder=?";
+	push(@bind_values,$subfieldorder);
     }
     my $sti=$dbh->prepare($query);
-    $sti->execute($bibid,$tag, $subfieldcode);
+    $sti->execute(@bind_values);
     while (($subfieldid) = $sti->fetchrow) {
 	$resultcounter++;
 	$lastsubfieldid=$subfieldid;
@@ -1191,8 +1194,7 @@ delete a biblio
 sub OLDnewbiblio {
   my ($dbh,$biblio) = @_;
 #  my $dbh    = &C4Connect;
-  my $query  = "Select max(biblionumber) from biblio";
-  my $sth    = $dbh->prepare($query);
+  my $sth    = $dbh->prepare("Select max(biblionumber) from biblio");
   $sth->execute;
   my $data   = $sth->fetchrow_arrayref;
   my $bibnum = $$data[0] + 1;
@@ -1200,9 +1202,7 @@ sub OLDnewbiblio {
 
   if ($biblio->{'seriestitle'}) { $series = 1 };
   $sth->finish;
-  $query = "insert into biblio set biblionumber  = ?, title         = ?, author        = ?, copyrightdate = ?,
-									serial        = ?, seriestitle   = ?, notes         = ?, abstract      = ?";
-  $sth = $dbh->prepare($query);
+  $sth = $dbh->prepare("insert into biblio set biblionumber  = ?, title = ?, author = ?, copyrightdate = ?, serial = ?, seriestitle = ?, notes = ?, abstract = ?");
   $sth->execute($bibnum,$biblio->{'title'},$biblio->{'author'},$biblio->{'copyrightdate'},$series,$biblio->{'seriestitle'},$biblio->{'notes'},$biblio->{'abstract'});
 
   $sth->finish;
@@ -1216,11 +1216,9 @@ sub OLDmodbiblio {
 	my $query;
 	my $sth;
 
-	$query = "Update biblio set title         = ?, author        = ?, abstract      = ?, copyrightdate = ?,
-					seriestitle   = ?, serial        = ?, unititle      = ?, notes         = ? where biblionumber = ?";
-	$sth   = $dbh->prepare($query);
-	$sth->execute($biblio->{'title'},$biblio->{'author'},$biblio->{'abstract'},$biblio->{'copyrightdate'},
-						$biblio->{'seriestitle'},$biblio->{'serial'},$biblio->{'unititle'},$biblio->{'notes'},$biblio->{'biblionumber'});
+	$query = "";
+	$sth   = $dbh->prepare("Update biblio set title = ?, author = ?, abstract = ?, copyrightdate = ?, seriestitle = ?, serial = ?, unititle = ?, notes = ? where biblionumber = ?");
+	$sth->execute($biblio->{'title'},$biblio->{'author'},$biblio->{'abstract'},$biblio->{'copyrightdate'}, $biblio->{'seriestitle'},$biblio->{'serial'},$biblio->{'unititle'},$biblio->{'notes'},$biblio->{'biblionumber'});
 
 	$sth->finish;
 	return($biblio->{'biblionumber'});
@@ -1228,8 +1226,7 @@ sub OLDmodbiblio {
 
 sub OLDmodsubtitle {
 	my ($dbh,$bibnum, $subtitle) = @_;
-	my $query = "update bibliosubtitle set subtitle = ? where biblionumber = ?";
-	my $sth   = $dbh->prepare($query);
+	my $sth   = $dbh->prepare("update bibliosubtitle set subtitle = ? where biblionumber = ?");
 	$sth->execute($subtitle,$bibnum);
 	$sth->finish;
 } # sub modsubtitle
@@ -1238,17 +1235,13 @@ sub OLDmodsubtitle {
 sub OLDmodaddauthor {
     my ($dbh,$bibnum, $author) = @_;
 #    my $dbh   = C4Connect;
-    my $query = "Delete from additionalauthors where biblionumber = $bibnum";
-    my $sth = $dbh->prepare($query);
+    my $sth = $dbh->prepare("Delete from additionalauthors where biblionumber = ?");
 
-    $sth->execute;
+    $sth->execute($bibnum);
     $sth->finish;
 
     if ($author ne '') {
-        $query = "Insert into additionalauthors set
-                        author       = ?,
-                        biblionumber = ?";
-        $sth   = $dbh->prepare($query);
+        $sth   = $dbh->prepare("Insert into additionalauthors set author = ?, biblionumber = ?");
 
         $sth->execute($author,$bibnum);
 
@@ -1265,8 +1258,7 @@ sub OLDmodsubject {
 	for (my $i = 0; $i < $count; $i++) {
 		$subject[$i] =~ s/^ //g;
 		$subject[$i] =~ s/ $//g;
-		my $query = "select * from catalogueentry where entrytype = 's' and catalogueentry = ?";
-		my $sth   = $dbh->prepare($query);
+		my $sth   = $dbh->prepare("select * from catalogueentry where entrytype = 's' and catalogueentry = ?");
 		$sth->execute($subject[$i]);
 
 		if (my $data = $sth->fetchrow_hashref) {
@@ -1274,16 +1266,13 @@ sub OLDmodsubject {
 			if ($force eq $subject[$i] || $force == 1) {
 				# subject not in aut, chosen to force anway
 				# so insert into cataloguentry so its in auth file
-				$query = "Insert into catalogueentry (entrytype,catalogueentry) values ('s',?)";
-				my $sth2 = $dbh->prepare($query);
+				my $sth2 = $dbh->prepare("Insert into catalogueentry (entrytype,catalogueentry) values ('s',?)");
 
 				$sth2->execute($subject[$i]);
 				$sth2->finish;
 			} else {
 				$error = "$subject[$i]\n does not exist in the subject authority file";
-				$query = "Select * from catalogueentry where entrytype = 's' and (catalogueentry like ?
-									or catalogueentry like ? or catalogueentry like ?)";
-				my $sth2 = $dbh->prepare($query);
+				my $sth2 = $dbh->prepare("Select * from catalogueentry where entrytype = 's' and (catalogueentry like ? or catalogueentry like ? or catalogueentry like ?)");
 				$sth2->execute("$subject[$i] %","% $subject[$i] %","% $subject[$i]");
 				while (my $data = $sth2->fetchrow_hashref) {
 					$error .= "<br>$data->{'catalogueentry'}";
@@ -1294,11 +1283,11 @@ sub OLDmodsubject {
 		$sth->finish;
 	} # else
 	if ($error eq '') {
-		my $query = "Delete from bibliosubject where biblionumber = ?";
-		my $sth   = $dbh->prepare($query);
+		my $sth   = $dbh->prepare("Delete from bibliosubject where biblionumber = ?");
 		$sth->execute($bibnum);
 		$sth->finish;
 		$sth = $dbh->prepare("Insert into bibliosubject values (?,?)");
+		my $query;
 		foreach $query (@subject) {
 			$sth->execute($query,$bibnum);
 		} # foreach
@@ -1367,8 +1356,7 @@ sub OLDmodnote {
 sub OLDnewbiblioitem {
 	my ($dbh,$biblioitem) = @_;
 	#  my $dbh   = C4Connect;
-	my $query = "Select max(biblioitemnumber) from biblioitems";
-	my $sth   = $dbh->prepare($query);
+	my $sth   = $dbh->prepare("Select max(biblioitemnumber) from biblioitems");
 	my $data;
 	my $bibitemnum;
 
@@ -1408,16 +1396,14 @@ sub OLDnewbiblioitem {
 
 sub OLDnewsubject {
   my ($dbh,$bibnum)=@_;
-  my $query="insert into bibliosubject (biblionumber) values ($bibnum)";
-  my $sth=$dbh->prepare($query);
-  $sth->execute;
+  my $sth=$dbh->prepare("insert into bibliosubject (biblionumber) values (?)");
+  $sth->execute($bibnum);
   $sth->finish;
 }
 
 sub OLDnewsubtitle {
     my ($dbh,$bibnum, $subtitle) = @_;
-    my $query = "insert into bibliosubtitle set biblionumber = ?, subtitle = ?";
-    my $sth   = $dbh->prepare($query);
+    my $sth   = $dbh->prepare("insert into bibliosubtitle set biblionumber = ?, subtitle = ?");
     $sth->execute($bibnum,$subtitle);
     $sth->finish;
 }
@@ -1426,8 +1412,7 @@ sub OLDnewsubtitle {
 sub OLDnewitems {
 	my ($dbh,$item, $barcode) = @_;
 	#  my $dbh   = C4Connect;
-	my $query = "Select max(itemnumber) from items";
-	my $sth   = $dbh->prepare($query);
+	my $sth   = $dbh->prepare("Select max(itemnumber) from items");
 	my $data;
 	my $itemnumber;
 	my $error = "";
@@ -1486,26 +1471,28 @@ sub OLDmoditem {
 #  my ($dbh,$loan,$itemnum,$bibitemnum,$barcode,$notes,$homebranch,$lost,$wthdrawn,$replacement)=@_;
 #  my $dbh=C4Connect;
 $item->{'itemnum'}=$item->{'itemnumber'} unless $item->{'itemnum'};
-  my $query="update items set  barcode='$item->{'barcode'}',itemnotes='$item->{'notes'}'
-                          where itemnumber=$item->{'itemnum'}";
+  my $query="update items set  barcode=?,itemnotes=? where itemnumber=?";
+  my @bind = ($item->{'barcode'},$item->{'notes'},$item->{'itemnum'});
   if ($item->{'barcode'} eq ''){
   	$item->{'notforloan'}=0 unless $item->{'notforloan'};
-    $query="update items set notforloan=$item->{'notforloan'} where itemnumber=$item->{'itemnum'}";
+    $query="update items set notforloan=? where itemnumber=?";
+    @bind = ($item->{'notforloan'},$item->{'itemnum'});
   }
   if ($item->{'lost'} ne ''){
-    $query="update items set biblioitemnumber=$item->{'bibitemnum'},
-                             barcode='$item->{'barcode'}',
-                             itemnotes='$item->{'notes'}',
-                             homebranch='$item->{'homebranch'}',
-                             itemlost='$item->{'lost'}',
-                             wthdrawn='$item->{'wthdrawn'}'
-                          where itemnumber=$item->{'itemnum'}";
+    $query="update items set biblioitemnumber=?,
+                             barcode=?,
+                             itemnotes=?,
+                             homebranch=?,
+                             itemlost=?,
+                             wthdrawn=?
+                          where itemnumber=?";
+    @bind = ($item->{'bibitemnum'},$item->{'barcode'},$item->{'notes'},$item->{'homebranch'},$item->{'lost'},$item->{'wthdrawn'},$item->{'itemnum'});
   }
   if ($item->{'replacement'} ne ''){
     $query=~ s/ where/,replacementprice='$item->{'replacement'}' where/;
   }
   my $sth=$dbh->prepare($query);
-  $sth->execute;
+  $sth->execute(@bind);
   $sth->finish;
 #  $dbh->disconnect;
 }
@@ -1513,23 +1500,22 @@ $item->{'itemnum'}=$item->{'itemnumber'} unless $item->{'itemnum'};
 sub OLDdelitem{
   my ($dbh,$itemnum)=@_;
 #  my $dbh=C4Connect;
-  my $query="select * from items where itemnumber=$itemnum";
-  my $sth=$dbh->prepare($query);
-  $sth->execute;
+  my $sth=$dbh->prepare("select * from items where itemnumber=?");
+  $sth->execute($itemnum);
   my $data=$sth->fetchrow_hashref;
   $sth->finish;
-  $query="Insert into deleteditems set ";
+  my $query="Insert into deleteditems set ";
+  my @bind = ();
   foreach my $temp (keys %$data){
-    $query .= "$temp = ".$dbh->quote($data->{$temp}).",";
+    $query .= "$temp = ?,"
+    push(@bind,$data->{$temp});
   }
-  $query=~ s/\,$//;
 #  print $query;
   $sth=$dbh->prepare($query);
-  $sth->execute;
+  $sth->execute(@bind);
   $sth->finish;
-  $query = "Delete from items where itemnumber=$itemnum";
-  $sth=$dbh->prepare($query);
-  $sth->execute;
+  $sth=$dbh->prepare("Delete from items where itemnumber=?");
+  $sth->execute($itemnum);
   $sth->finish;
 #  $dbh->disconnect;
 }
@@ -1537,12 +1523,11 @@ sub OLDdelitem{
 sub OLDdeletebiblioitem {
     my ($dbh,$biblioitemnumber) = @_;
 #    my $dbh   = C4Connect;
-    my $query = "Select * from biblioitems
-where biblioitemnumber = $biblioitemnumber";
-    my $sth   = $dbh->prepare($query);
+    my $sth   = $dbh->prepare("Select * from biblioitems
+where biblioitemnumber = ?");
     my $results;
 
-    $sth->execute;
+    $sth->execute($biblioitemnumber);
 
     if ($results = $sth->fetchrow_hashref) {
     	$sth->finish;
@@ -1553,52 +1538,51 @@ where biblioitemnumber = $biblioitemnumber";
         $sth->execute($results->{biblioitemnumber}, $results->{biblionumber}, $results->{volume}, $results->{number}, $results->{classification}, $results->{itemtype},
 					$results->{isbn}, $results->{issn} ,$results->{dewey} ,$results->{subclass} ,$results->{publicationyear} ,$results->{publishercode} ,$results->{volumedate} ,$results->{volumeddesc} ,$results->{timestamp} ,$results->{illus} ,
      					$results->{pages} ,$results->{notes} ,$results->{size} ,$results->{url} ,$results->{lccn} );
-        $query = "Delete from biblioitems
-                        where biblioitemnumber = $biblioitemnumber";
-        $dbh->do($query);
+        my $sth2 = $dbh->prepare("Delete from biblioitems where biblioitemnumber = ?");
+        $sth2->execute($biblioitemnumber);
+        $sth2->finish();
     } # if
     $sth->finish;
 # Now delete all the items attached to the biblioitem
-    $query = "Select * from items where biblioitemnumber = $biblioitemnumber";
-    $sth   = $dbh->prepare($query);
-    $sth->execute;
+    $sth   = $dbh->prepare("Select * from items where biblioitemnumber = ?");
+    $sth->execute($biblioitemnumber);
     my @results;
     while (@results = $sth->fetchrow_array) {
-	$query = "Insert into deleteditems values (";
+	my $query = "Insert into deleteditems values (";
 	foreach my $value (@results) {
-	    $value  = $dbh->quote($value);
-	    $query .= "$value,";
+	    $query .= "?,";
 	} # foreach
 	$query =~ s/\,$/\)/;
-	$dbh->do($query);
+	my $sth2= $dbh->prepare($query);
+	$sth2->execute(@results);
+	$sth2->finish()
     } # while
     $sth->finish;
-    $query = "Delete from items where biblioitemnumber = $biblioitemnumber";
-    $dbh->do($query);
+    $sth = $dbh->prepare("Delete from items where biblioitemnumber = ?");
+    $sth->execute($biblioitemnumber);
+    $sth->finish();
 #    $dbh->disconnect;
 } # sub deletebiblioitem
 
 sub OLDdelbiblio{
   my ($dbh,$biblio)=@_;
-  my $query="select * from biblio where biblionumber=$biblio";
-  my $sth=$dbh->prepare($query);
-  $sth->execute;
+  my $sth=$dbh->prepare("select * from biblio where biblionumber=?");
+  $sth->execute($biblio);
   if (my @data=$sth->fetchrow_array){
     $sth->finish;
 # FIXME => replace insert values by insert (field) values ($value)
     $query="Insert into deletedbiblio values (";
     foreach my $temp (@data){
       $temp=~ s/\'/\\\'/g;
-      $query .= "'$temp',";
+      $query .= "?,";
     }
     #replacing the last , by ",?)"
     $query=~ s/\,$/\,\?\)/;
     $sth=$dbh->prepare($query);
-    $sth->execute;
+    $sth->execute(@data);
     $sth->finish;
-    $query = "Delete from biblio where biblionumber=$biblio";
-    $sth=$dbh->prepare($query);
-    $sth->execute;
+    $sth=$dbh->prepare("Delete from biblio where biblionumber=?");
+    $sth->execute($biblio);
     $sth->finish;
   }
   $sth->finish;
@@ -1613,10 +1597,9 @@ sub OLDdelbiblio{
 sub itemcount{
   my ($biblio)=@_;
   my $dbh = C4::Context->dbh;
-  my $query="Select count(*) from items where biblionumber=$biblio";
 #  print $query;
-  my $sth=$dbh->prepare($query);
-  $sth->execute;
+  my $sth=$dbh->prepare("Select count(*) from items where biblionumber=?");
+  $sth->execute($biblio);
   my $data=$sth->fetchrow_hashref;
   $sth->finish;
   return($data->{'count(*)'});
@@ -1640,17 +1623,15 @@ tables of the Koha database.
 sub getorder{
   my ($bi,$bib)=@_;
   my $dbh = C4::Context->dbh;
-  my $query="Select ordernumber
+  my $sth=$dbh->prepare("Select ordernumber
  	from aqorders
- 	where biblionumber=? and biblioitemnumber=?";
-  my $sth=$dbh->prepare($query);
+ 	where biblionumber=? and biblioitemnumber=?");
   $sth->execute($bib,$bi);
   # FIXME - Use fetchrow_array(), since we're only interested in the one
   # value.
   my $ordnum=$sth->fetchrow_hashref;
   $sth->finish;
   my $order=getsingleorder($ordnum->{'ordernumber'});
-#  print $query;
   return ($order,$ordnum->{'ordernumber'});
 }
 
@@ -1672,12 +1653,11 @@ aqorderbreakdown tables of the Koha database.
 sub getsingleorder {
   my ($ordnum)=@_;
   my $dbh = C4::Context->dbh;
-  my $query="Select * from biblio,biblioitems,aqorders,aqorderbreakdown
+  my $sth=$dbh->prepare("Select * from biblio,biblioitems,aqorders,aqorderbreakdown
   where aqorders.ordernumber=?
   and biblio.biblionumber=aqorders.biblionumber and
   biblioitems.biblioitemnumber=aqorders.biblioitemnumber and
-  aqorders.ordernumber=aqorderbreakdown.ordernumber";
-  my $sth=$dbh->prepare($query);
+  aqorders.ordernumber=aqorderbreakdown.ordernumber");
   $sth->execute($ordnum);
   my $data=$sth->fetchrow_hashref;
   $sth->finish;
@@ -1837,25 +1817,24 @@ sub checkitems{
   my ($count,@barcodes)=@_;
   my $dbh = C4::Context->dbh;
   my $error;
+  my $sth=$dbh->prepare("Select * from items where barcode=?");
   for (my $i=0;$i<$count;$i++){
     $barcodes[$i]=uc $barcodes[$i];
-    my $query="Select * from items where barcode='$barcodes[$i]'";
-    my $sth=$dbh->prepare($query);
-    $sth->execute;
+    $sth->execute($barcodes[$i]);
     if (my $data=$sth->fetchrow_hashref){
       $error.=" Duplicate Barcode: $barcodes[$i]";
     }
-    $sth->finish;
   }
+  $sth->finish;
   return($error);
 }
 
 sub countitems{
   my ($bibitemnum)=@_;
   my $dbh = C4::Context->dbh;
-  my $query="Select count(*) from items where biblioitemnumber='$bibitemnum'";
-  my $sth=$dbh->prepare($query);
-  $sth->execute;
+  my $query="";
+  my $sth=$dbh->prepare("Select count(*) from items where biblioitemnumber=?");
+  $sth->execute($bibitemnum);
   my $data=$sth->fetchrow_hashref;
   $sth->finish;
   return($data->{'count(*)'});
@@ -1884,14 +1863,11 @@ sub delbiblio {
 
 sub getitemtypes {
   my $dbh   = C4::Context->dbh;
-  my $query = "select * from itemtypes order by description";
-  my $sth   = $dbh->prepare($query);
-    # || die "Cannot prepare $query" . $dbh->errstr;
+  my $sth   = $dbh->prepare("select * from itemtypes order by description");
   my $count = 0;
   my @results;
 
   $sth->execute;
-    # || die "Cannot execute $query\n" . $sth->errstr;
   while (my $data = $sth->fetchrow_hashref) {
     $results[$count] = $data;
     $count++;
@@ -1904,13 +1880,12 @@ sub getitemtypes {
 sub getbiblio {
     my ($biblionumber) = @_;
     my $dbh   = C4::Context->dbh;
-    my $query = "Select * from biblio where biblionumber = $biblionumber";
-    my $sth   = $dbh->prepare($query);
+    my $sth   = $dbh->prepare("Select * from biblio where biblionumber = ?");
       # || die "Cannot prepare $query\n" . $dbh->errstr;
     my $count = 0;
     my @results;
 
-    $sth->execute;
+    $sth->execute($biblionumber);
       # || die "Cannot execute $query\n" . $sth->errstr;
     while (my $data = $sth->fetchrow_hashref) {
       $results[$count] = $data;
@@ -1924,13 +1899,12 @@ sub getbiblio {
 sub getbiblioitem {
     my ($biblioitemnum) = @_;
     my $dbh   = C4::Context->dbh;
-    my $query = "Select * from biblioitems where
-biblioitemnumber = $biblioitemnum";
-    my $sth   = $dbh->prepare($query);
+    my $sth   = $dbh->prepare("Select * from biblioitems where
+biblioitemnumber = ?");
     my $count = 0;
     my @results;
 
-    $sth->execute;
+    $sth->execute($biblioitemnum);
 
     while (my $data = $sth->fetchrow_hashref) {
         $results[$count] = $data;
@@ -1944,13 +1918,11 @@ biblioitemnumber = $biblioitemnum";
 sub getbiblioitembybiblionumber {
     my ($biblionumber) = @_;
     my $dbh   = C4::Context->dbh;
-    my $query = "Select * from biblioitems where biblionumber =
-$biblionumber";
-    my $sth   = $dbh->prepare($query);
+    my $sth   = $dbh->prepare("Select * from biblioitems where biblionumber = ?");
     my $count = 0;
     my @results;
 
-    $sth->execute;
+    $sth->execute($biblionumber);
 
     while (my $data = $sth->fetchrow_hashref) {
         $results[$count] = $data;
@@ -1964,15 +1936,14 @@ $biblionumber";
 sub getitemsbybiblioitem {
     my ($biblioitemnum) = @_;
     my $dbh   = C4::Context->dbh;
-    my $query = "Select * from items, biblio where
+    my $sth   = $dbh->prepare("Select * from items, biblio where
 biblio.biblionumber = items.biblionumber and biblioitemnumber
-= $biblioitemnum";
-    my $sth   = $dbh->prepare($query);
+= ?");
       # || die "Cannot prepare $query\n" . $dbh->errstr;
     my $count = 0;
     my @results;
 
-    $sth->execute;
+    $sth->execute($biblioitemnum);
       # || die "Cannot execute $query\n" . $sth->errstr;
     while (my $data = $sth->fetchrow_hashref) {
       $results[$count] = $data;
@@ -2068,122 +2039,122 @@ sub char_decode {
 	$_ = $string ;
 # 	$encoding = C4::Context->preference("marcflavour") unless $encoding;
 	if ($encoding eq "UNIMARC") {
-		s/\xe1/Æ/gm ;
-		s/\xe2/Ð/gm ;
-		s/\xe9/Ø/gm ;
-		s/\xec/þ/gm ;
-		s/\xf1/æ/gm ;
-		s/\xf3/ð/gm ;
-		s/\xf9/ø/gm ;
-		s/\xfb/ß/gm ;
-		s/\xc1\x61/à/gm ;
-		s/\xc1\x65/è/gm ;
-		s/\xc1\x69/ì/gm ;
-		s/\xc1\x6f/ò/gm ;
-		s/\xc1\x75/ù/gm ;
-		s/\xc1\x41/À/gm ;
-		s/\xc1\x45/È/gm ;
-		s/\xc1\x49/Ì/gm ;
-		s/\xc1\x4f/Ò/gm ;
-		s/\xc1\x55/Ù/gm ;
-		s/\xc2\x41/Á/gm ;
-		s/\xc2\x45/É/gm ;
-		s/\xc2\x49/Í/gm ;
-		s/\xc2\x4f/Ó/gm ;
-		s/\xc2\x55/Ú/gm ;
-		s/\xc2\x59/Ý/gm ;
-		s/\xc2\x61/á/gm ;
-		s/\xc2\x65/é/gm ;
-		s/\xc2\x69/í/gm ;
-		s/\xc2\x6f/ó/gm ;
-		s/\xc2\x75/ú/gm ;
-		s/\xc2\x79/ý/gm ;
-		s/\xc3\x41/Â/gm ;
-		s/\xc3\x45/Ê/gm ;
-		s/\xc3\x49/Î/gm ;
-		s/\xc3\x4f/Ô/gm ;
-		s/\xc3\x55/Û/gm ;
-		s/\xc3\x61/â/gm ;
-		s/\xc3\x65/ê/gm ;
-		s/\xc3\x69/î/gm ;
-		s/\xc3\x6f/ô/gm ;
-		s/\xc3\x75/û/gm ;
-		s/\xc4\x41/Ã/gm ;
-		s/\xc4\x4e/Ñ/gm ;
-		s/\xc4\x4f/Õ/gm ;
-		s/\xc4\x61/ã/gm ;
-		s/\xc4\x6e/ñ/gm ;
-		s/\xc4\x6f/õ/gm ;
-		s/\xc8\x45/Ë/gm ;
-		s/\xc8\x49/Ï/gm ;
-		s/\xc8\x65/ë/gm ;
-		s/\xc8\x69/ï/gm ;
-		s/\xc8\x76/ÿ/gm ;
-		s/\xc9\x41/Ä/gm ;
-		s/\xc9\x4f/Ö/gm ;
-		s/\xc9\x55/Ü/gm ;
-		s/\xc9\x61/ä/gm ;
-		s/\xc9\x6f/ö/gm ;
-		s/\xc9\x75/ü/gm ;
-		s/\xca\x41/Å/gm ;
-		s/\xca\x61/å/gm ;
-		s/\xd0\x43/Ç/gm ;
-		s/\xd0\x63/ç/gm ;
+		s/\xe1/€/gm ;
+		s/\xe2/€/gm ;
+		s/\xe9/€/gm ;
+		s/\xec/€/gm ;
+		s/\xf1/€/gm ;
+		s/\xf3/€/gm ;
+		s/\xf9/€/gm ;
+		s/\xfb/€/gm ;
+		s/\xc1\x61/€/gm ;
+		s/\xc1\x65/€/gm ;
+		s/\xc1\x69/€/gm ;
+		s/\xc1\x6f/€/gm ;
+		s/\xc1\x75/€/gm ;
+		s/\xc1\x41/€/gm ;
+		s/\xc1\x45/€/gm ;
+		s/\xc1\x49/€/gm ;
+		s/\xc1\x4f/€/gm ;
+		s/\xc1\x55/€/gm ;
+		s/\xc2\x41/€/gm ;
+		s/\xc2\x45/€/gm ;
+		s/\xc2\x49/€/gm ;
+		s/\xc2\x4f/€/gm ;
+		s/\xc2\x55/€/gm ;
+		s/\xc2\x59/€/gm ;
+		s/\xc2\x61/€/gm ;
+		s/\xc2\x65/€/gm ;
+		s/\xc2\x69/€/gm ;
+		s/\xc2\x6f/€/gm ;
+		s/\xc2\x75/€/gm ;
+		s/\xc2\x79/€/gm ;
+		s/\xc3\x41/€/gm ;
+		s/\xc3\x45/€/gm ;
+		s/\xc3\x49/€/gm ;
+		s/\xc3\x4f/€/gm ;
+		s/\xc3\x55/€/gm ;
+		s/\xc3\x61/€/gm ;
+		s/\xc3\x65/€/gm ;
+		s/\xc3\x69/€/gm ;
+		s/\xc3\x6f/€/gm ;
+		s/\xc3\x75/€/gm ;
+		s/\xc4\x41/€/gm ;
+		s/\xc4\x4e/€/gm ;
+		s/\xc4\x4f/€/gm ;
+		s/\xc4\x61/€/gm ;
+		s/\xc4\x6e/€/gm ;
+		s/\xc4\x6f/€/gm ;
+		s/\xc8\x45/€/gm ;
+		s/\xc8\x49/€/gm ;
+		s/\xc8\x65/€/gm ;
+		s/\xc8\x69/€/gm ;
+		s/\xc8\x76/€/gm ;
+		s/\xc9\x41/€/gm ;
+		s/\xc9\x4f/€/gm ;
+		s/\xc9\x55/€/gm ;
+		s/\xc9\x61/€/gm ;
+		s/\xc9\x6f/€/gm ;
+		s/\xc9\x75/€/gm ;
+		s/\xca\x41/€/gm ;
+		s/\xca\x61/€/gm ;
+		s/\xd0\x43/€/gm ;
+		s/\xd0\x63/€/gm ;
 		# this handles non-sorting blocks (if implementation requires this)
 		$string = nsb_clean($_) ;
 	} elsif ($encoding eq "USMARC" || $encoding eq "MARC21") {
 		if(/[\xc1-\xff]/) {
-			s/\xe1\x61/à/gm ;
-			s/\xe1\x65/è/gm ;
-			s/\xe1\x69/ì/gm ;
-			s/\xe1\x6f/ò/gm ;
-			s/\xe1\x75/ù/gm ;
-			s/\xe1\x41/À/gm ;
-			s/\xe1\x45/È/gm ;
-			s/\xe1\x49/Ì/gm ;
-			s/\xe1\x4f/Ò/gm ;
-			s/\xe1\x55/Ù/gm ;
-			s/\xe2\x41/Á/gm ;
-			s/\xe2\x45/É/gm ;
-			s/\xe2\x49/Í/gm ;
-			s/\xe2\x4f/Ó/gm ;
-			s/\xe2\x55/Ú/gm ;
-			s/\xe2\x59/Ý/gm ;
-			s/\xe2\x61/á/gm ;
-			s/\xe2\x65/é/gm ;
-			s/\xe2\x69/í/gm ;
-			s/\xe2\x6f/ó/gm ;
-			s/\xe2\x75/ú/gm ;
-			s/\xe2\x79/ý/gm ;
-			s/\xe3\x41/Â/gm ;
-			s/\xe3\x45/Ê/gm ;
-			s/\xe3\x49/Î/gm ;
-			s/\xe3\x4f/Ô/gm ;
-			s/\xe3\x55/Û/gm ;
-			s/\xe3\x61/â/gm ;
-			s/\xe3\x65/ê/gm ;
-			s/\xe3\x69/î/gm ;
-			s/\xe3\x6f/ô/gm ;
-			s/\xe3\x75/û/gm ;
-			s/\xe4\x41/Ã/gm ;
-			s/\xe4\x4e/Ñ/gm ;
-			s/\xe4\x4f/Õ/gm ;
-			s/\xe4\x61/ã/gm ;
-			s/\xe4\x6e/ñ/gm ;
-			s/\xe4\x6f/õ/gm ;
-			s/\xe8\x45/Ë/gm ;
-			s/\xe8\x49/Ï/gm ;
-			s/\xe8\x65/ë/gm ;
-			s/\xe8\x69/ï/gm ;
-			s/\xe8\x76/ÿ/gm ;
-			s/\xe9\x41/Ä/gm ;
-			s/\xe9\x4f/Ö/gm ;
-			s/\xe9\x55/Ü/gm ;
-			s/\xe9\x61/ä/gm ;
-			s/\xe9\x6f/ö/gm ;
-			s/\xe9\x75/ü/gm ;
-			s/\xea\x41/Å/gm ;
-			s/\xea\x61/å/gm ;
+			s/\xe1\x61/€/gm ;
+			s/\xe1\x65/€/gm ;
+			s/\xe1\x69/€/gm ;
+			s/\xe1\x6f/€/gm ;
+			s/\xe1\x75/€/gm ;
+			s/\xe1\x41/€/gm ;
+			s/\xe1\x45/€/gm ;
+			s/\xe1\x49/€/gm ;
+			s/\xe1\x4f/€/gm ;
+			s/\xe1\x55/€/gm ;
+			s/\xe2\x41/€/gm ;
+			s/\xe2\x45/€/gm ;
+			s/\xe2\x49/€/gm ;
+			s/\xe2\x4f/€/gm ;
+			s/\xe2\x55/€/gm ;
+			s/\xe2\x59/€/gm ;
+			s/\xe2\x61/€/gm ;
+			s/\xe2\x65/€/gm ;
+			s/\xe2\x69/€/gm ;
+			s/\xe2\x6f/€/gm ;
+			s/\xe2\x75/€/gm ;
+			s/\xe2\x79/€/gm ;
+			s/\xe3\x41/€/gm ;
+			s/\xe3\x45/€/gm ;
+			s/\xe3\x49/€/gm ;
+			s/\xe3\x4f/€/gm ;
+			s/\xe3\x55/€/gm ;
+			s/\xe3\x61/€/gm ;
+			s/\xe3\x65/€/gm ;
+			s/\xe3\x69/€/gm ;
+			s/\xe3\x6f/€/gm ;
+			s/\xe3\x75/€/gm ;
+			s/\xe4\x41/€/gm ;
+			s/\xe4\x4e/€/gm ;
+			s/\xe4\x4f/€/gm ;
+			s/\xe4\x61/€/gm ;
+			s/\xe4\x6e/€/gm ;
+			s/\xe4\x6f/€/gm ;
+			s/\xe8\x45/€/gm ;
+			s/\xe8\x49/€/gm ;
+			s/\xe8\x65/€/gm ;
+			s/\xe8\x69/€/gm ;
+			s/\xe8\x76/€/gm ;
+			s/\xe9\x41/€/gm ;
+			s/\xe9\x4f/€/gm ;
+			s/\xe9\x55/€/gm ;
+			s/\xe9\x61/€/gm ;
+			s/\xe9\x6f/€/gm ;
+			s/\xe9\x75/€/gm ;
+			s/\xea\x41/€/gm ;
+			s/\xea\x61/€/gm ;
 			# this handles non-sorting blocks (if implementation requires this)
 			$string = nsb_clean($_) ;
 		}
@@ -2217,6 +2188,9 @@ Paul POULAIN paul.poulain@free.fr
 
 # $Id$
 # $Log$
+# Revision 1.75  2003/12/03 01:42:03  slef
+# bug 662 fixes securing DBI
+#
 # Revision 1.74  2003/11/28 09:48:33  tipaul
 # bugfix : misusing prepare & execute => now using prepare(?) and execute($var)
 #
@@ -2544,3 +2518,612 @@ Paul POULAIN paul.poulain@free.fr
 # In Biblio.pm, there are some subs that permits to build a old-style record from a MARC::Record, and the opposite. There is also a sub finding a MARC-bibid from a old-biblionumber and the opposite too.
 # Note we have decided with steve that a old-biblio <=> a MARC-Biblio.
 #
+<<<<<<< Biblio.pm
+
+sub itemcount{
+  my ($biblio)=@_;
+  my $dbh = C4::Context->dbh;
+  my $query="Select count(*) from items where biblionumber=$biblio";
+#  print $query;
+  my $sth=$dbh->prepare($query);
+  $sth->execute;
+  my $data=$sth->fetchrow_hashref;
+  $sth->finish;
+  return($data->{'count(*)'});
+}
+
+=item getorder
+
+  ($order, $ordernumber) = &getorder($biblioitemnumber, $biblionumber);
+
+Looks up the order with the given biblionumber and biblioitemnumber.
+
+Returns a two-element array. C<$ordernumber> is the order number.
+C<$order> is a reference-to-hash describing the order; its keys are
+fields from the biblio, biblioitems, aqorders, and aqorderbreakdown
+tables of the Koha database.
+
+=cut
+#'
+# FIXME - This is effectively identical to &C4::Catalogue::getorder.
+# Pick one and stick with it.
+sub getorder{
+  my ($bi,$bib)=@_;
+  my $dbh = C4::Context->dbh;
+  my $query="Select ordernumber
+ 	from aqorders
+ 	where biblionumber=? and biblioitemnumber=?";
+  my $sth=$dbh->prepare($query);
+  $sth->execute($bib,$bi);
+  # FIXME - Use fetchrow_array(), since we're only interested in the one
+  # value.
+  my $ordnum=$sth->fetchrow_hashref;
+  $sth->finish;
+  my $order=getsingleorder($ordnum->{'ordernumber'});
+#  print $query;
+  return ($order,$ordnum->{'ordernumber'});
+}
+
+=item getsingleorder
+
+  $order = &getsingleorder($ordernumber);
+
+Looks up an order by order number.
+
+Returns a reference-to-hash describing the order. The keys of
+C<$order> are fields from the biblio, biblioitems, aqorders, and
+aqorderbreakdown tables of the Koha database.
+
+=cut
+#'
+# FIXME - This is effectively identical to
+# &C4::Catalogue::getsingleorder.
+# Pick one and stick with it.
+sub getsingleorder {
+  my ($ordnum)=@_;
+  my $dbh = C4::Context->dbh;
+  my $query="Select * from biblio,biblioitems,aqorders,aqorderbreakdown
+  where aqorders.ordernumber=?
+  and biblio.biblionumber=aqorders.biblionumber and
+  biblioitems.biblioitemnumber=aqorders.biblioitemnumber and
+  aqorders.ordernumber=aqorderbreakdown.ordernumber";
+  my $sth=$dbh->prepare($query);
+  $sth->execute($ordnum);
+  my $data=$sth->fetchrow_hashref;
+  $sth->finish;
+  return($data);
+}
+
+sub newbiblio {
+	my ($biblio) = @_;
+	my $dbh    = C4::Context->dbh;
+	my $bibnum=OLDnewbiblio($dbh,$biblio);
+	# finds new (MARC bibid
+# 	my $bibid = &MARCfind_MARCbibid_from_oldbiblionumber($dbh,$bibnum);
+	my $record = &MARCkoha2marcBiblio($dbh,$bibnum);
+	MARCaddbiblio($dbh,$record,$bibnum);
+	return($bibnum);
+}
+
+=item modbiblio
+
+  $biblionumber = &modbiblio($biblio);
+
+Update a biblio record.
+
+C<$biblio> is a reference-to-hash whose keys are the fields in the
+biblio table in the Koha database. All fields must be present, not
+just the ones you wish to change.
+
+C<&modbiblio> updates the record defined by
+C<$biblio-E<gt>{biblionumber}> with the values in C<$biblio>.
+
+C<&modbiblio> returns C<$biblio-E<gt>{biblionumber}> whether it was
+successful or not.
+
+=cut
+
+sub modbiblio {
+	my ($biblio) = @_;
+	my $dbh  = C4::Context->dbh;
+	my $biblionumber=OLDmodbiblio($dbh,$biblio);
+	my $record = MARCkoha2marcBiblio($dbh,$biblionumber,$biblionumber);
+	# finds new (MARC bibid
+	my $bibid = &MARCfind_MARCbibid_from_oldbiblionumber($dbh,$biblionumber);
+	MARCmodbiblio($dbh,$bibid,$record,0);
+	return($biblionumber);
+} # sub modbiblio
+
+=item modsubtitle
+
+  &modsubtitle($biblionumber, $subtitle);
+
+Sets the subtitle of a book.
+
+C<$biblionumber> is the biblionumber of the book to modify.
+
+C<$subtitle> is the new subtitle.
+
+=cut
+
+sub modsubtitle {
+  my ($bibnum, $subtitle) = @_;
+  my $dbh   = C4::Context->dbh;
+  &OLDmodsubtitle($dbh,$bibnum,$subtitle);
+} # sub modsubtitle
+
+=item modaddauthor
+
+  &modaddauthor($biblionumber, $author);
+
+Replaces all additional authors for the book with biblio number
+C<$biblionumber> with C<$author>. If C<$author> is the empty string,
+C<&modaddauthor> deletes all additional authors.
+
+=cut
+
+sub modaddauthor {
+    my ($bibnum, $author) = @_;
+    my $dbh   = C4::Context->dbh;
+    &OLDmodaddauthor($dbh,$bibnum,$author);
+} # sub modaddauthor
+
+=item modsubject
+
+  $error = &modsubject($biblionumber, $force, @subjects);
+
+$force - a subject to force
+
+$error - Error message, or undef if successful.
+
+=cut
+
+sub modsubject {
+  my ($bibnum, $force, @subject) = @_;
+  my $dbh   = C4::Context->dbh;
+  my $error= &OLDmodsubject($dbh,$bibnum,$force, @subject);
+  return($error);
+} # sub modsubject
+
+sub modbibitem {
+    my ($biblioitem) = @_;
+    my $dbh   = C4::Context->dbh;
+    &OLDmodbibitem($dbh,$biblioitem);
+} # sub modbibitem
+
+sub modnote {
+  my ($bibitemnum,$note)=@_;
+  my $dbh = C4::Context->dbh;
+  &OLDmodnote($dbh,$bibitemnum,$note);
+}
+
+sub newbiblioitem {
+	my ($biblioitem) = @_;
+	my $dbh   = C4::Context->dbh;
+	my $bibitemnum = &OLDnewbiblioitem($dbh,$biblioitem);
+	my $MARCbiblio= MARCkoha2marcBiblio($dbh,0,$bibitemnum); # the 0 means "do NOT retrieve biblio, only biblioitem, in the MARC record
+	my $bibid = &MARCfind_MARCbibid_from_oldbiblionumber($dbh,$biblioitem->{biblionumber});
+	&MARCaddbiblio($dbh,$MARCbiblio,$biblioitem->{biblionumber},$bibid);
+	return($bibitemnum);
+}
+
+sub newsubject {
+  my ($bibnum)=@_;
+  my $dbh = C4::Context->dbh;
+  &OLDnewsubject($dbh,$bibnum);
+}
+
+sub newsubtitle {
+    my ($bibnum, $subtitle) = @_;
+    my $dbh   = C4::Context->dbh;
+    &OLDnewsubtitle($dbh,$bibnum,$subtitle);
+}
+
+sub newitems {
+  my ($item, @barcodes) = @_;
+  my $dbh   = C4::Context->dbh;
+  my $errors;
+  my $itemnumber;
+  my $error;
+  foreach my $barcode (@barcodes) {
+      ($itemnumber,$error)=&OLDnewitems($dbh,$item,uc($barcode));
+      $errors .=$error;
+      my $MARCitem = &MARCkoha2marcItem($dbh,$item->{biblionumber},$itemnumber);
+      &MARCadditem($dbh,$MARCitem,$item->{biblionumber});
+  }
+  return($errors);
+}
+
+sub moditem {
+    my ($item) = @_;
+    my $dbh = C4::Context->dbh;
+    &OLDmoditem($dbh,$item);
+    my $MARCitem = &MARCkoha2marcItem($dbh,$item->{'biblionumber'},$item->{'itemnum'});
+    my $bibid = &MARCfind_MARCbibid_from_oldbiblionumber($dbh,$item->{biblionumber});
+    &MARCmoditem($dbh,$MARCitem,$bibid,$item->{itemnum},0);
+}
+
+sub checkitems{
+  my ($count,@barcodes)=@_;
+  my $dbh = C4::Context->dbh;
+  my $error;
+  for (my $i=0;$i<$count;$i++){
+    $barcodes[$i]=uc $barcodes[$i];
+    my $query="Select * from items where barcode='$barcodes[$i]'";
+    my $sth=$dbh->prepare($query);
+    $sth->execute;
+    if (my $data=$sth->fetchrow_hashref){
+      $error.=" Duplicate Barcode: $barcodes[$i]";
+    }
+    $sth->finish;
+  }
+  return($error);
+}
+
+sub countitems{
+  my ($bibitemnum)=@_;
+  my $dbh = C4::Context->dbh;
+  my $query="Select count(*) from items where biblioitemnumber='$bibitemnum'";
+  my $sth=$dbh->prepare($query);
+  $sth->execute;
+  my $data=$sth->fetchrow_hashref;
+  $sth->finish;
+  return($data->{'count(*)'});
+}
+
+sub delitem{
+  my ($itemnum)=@_;
+  my $dbh = C4::Context->dbh;
+  &OLDdelitem($dbh,$itemnum);
+}
+
+sub deletebiblioitem {
+    my ($biblioitemnumber) = @_;
+    my $dbh   = C4::Context->dbh;
+    &OLDdeletebiblioitem($dbh,$biblioitemnumber);
+} # sub deletebiblioitem
+
+
+sub delbiblio {
+	my ($biblio)=@_;
+	my $dbh = C4::Context->dbh;
+	&OLDdelbiblio($dbh,$biblio);
+	my $bibid = &MARCfind_MARCbibid_from_oldbiblionumber($dbh,$biblio);
+	&MARCdelbiblio($dbh,$bibid,0);
+}
+
+sub getitemtypes {
+  my $dbh   = C4::Context->dbh;
+  my $query = "select * from itemtypes order by description";
+  my $sth   = $dbh->prepare($query);
+    # || die "Cannot prepare $query" . $dbh->errstr;
+  my $count = 0;
+  my @results;
+
+  $sth->execute;
+    # || die "Cannot execute $query\n" . $sth->errstr;
+  while (my $data = $sth->fetchrow_hashref) {
+    $results[$count] = $data;
+    $count++;
+  } # while
+
+  $sth->finish;
+  return($count, @results);
+} # sub getitemtypes
+
+sub getbiblio {
+    my ($biblionumber) = @_;
+    my $dbh   = C4::Context->dbh;
+    my $query = "Select * from biblio where biblionumber = $biblionumber";
+    my $sth   = $dbh->prepare($query);
+      # || die "Cannot prepare $query\n" . $dbh->errstr;
+    my $count = 0;
+    my @results;
+
+    $sth->execute;
+      # || die "Cannot execute $query\n" . $sth->errstr;
+    while (my $data = $sth->fetchrow_hashref) {
+      $results[$count] = $data;
+      $count++;
+    } # while
+
+    $sth->finish;
+    return($count, @results);
+} # sub getbiblio
+
+sub getbiblioitem {
+    my ($biblioitemnum) = @_;
+    my $dbh   = C4::Context->dbh;
+    my $query = "Select * from biblioitems where
+biblioitemnumber = $biblioitemnum";
+    my $sth   = $dbh->prepare($query);
+    my $count = 0;
+    my @results;
+
+    $sth->execute;
+
+    while (my $data = $sth->fetchrow_hashref) {
+        $results[$count] = $data;
+	$count++;
+    } # while
+
+    $sth->finish;
+    return($count, @results);
+} # sub getbiblioitem
+
+sub getbiblioitembybiblionumber {
+    my ($biblionumber) = @_;
+    my $dbh   = C4::Context->dbh;
+    my $query = "Select * from biblioitems where biblionumber =
+$biblionumber";
+    my $sth   = $dbh->prepare($query);
+    my $count = 0;
+    my @results;
+
+    $sth->execute;
+
+    while (my $data = $sth->fetchrow_hashref) {
+        $results[$count] = $data;
+	$count++;
+    } # while
+
+    $sth->finish;
+    return($count, @results);
+} # sub
+
+sub getitemsbybiblioitem {
+    my ($biblioitemnum) = @_;
+    my $dbh   = C4::Context->dbh;
+    my $query = "Select * from items, biblio where
+biblio.biblionumber = items.biblionumber and biblioitemnumber
+= $biblioitemnum";
+    my $sth   = $dbh->prepare($query);
+      # || die "Cannot prepare $query\n" . $dbh->errstr;
+    my $count = 0;
+    my @results;
+
+    $sth->execute;
+      # || die "Cannot execute $query\n" . $sth->errstr;
+    while (my $data = $sth->fetchrow_hashref) {
+      $results[$count] = $data;
+      $count++;
+    } # while
+
+    $sth->finish;
+    return($count, @results);
+} # sub getitemsbybiblioitem
+
+
+sub logchange {
+# Subroutine to log changes to databases
+# Eventually, this subroutine will be used to create a log of all changes made,
+# with the possibility of "undo"ing some changes
+    my $database=shift;
+    if ($database eq 'kohadb') {
+	my $type=shift;
+	my $section=shift;
+	my $item=shift;
+	my $original=shift;
+	my $new=shift;
+#	print STDERR "KOHA: $type $section $item $original $new\n";
+    } elsif ($database eq 'marc') {
+	my $type=shift;
+	my $Record_ID=shift;
+	my $tag=shift;
+	my $mark=shift;
+	my $subfield_ID=shift;
+	my $original=shift;
+	my $new=shift;
+#	print STDERR "MARC: $type $Record_ID $tag $mark $subfield_ID $original $new\n";
+    }
+}
+
+#------------------------------------------------
+
+
+#---------------------------------------
+# Find a biblio entry, or create a new one if it doesn't exist.
+#  If a "subtitle" entry is in hash, add it to subtitle table
+sub getoraddbiblio {
+	# input params
+	my (
+	  $dbh,		# db handle
+			# FIXME - Unused argument
+	  $biblio,	# hash ref to fields
+	)=@_;
+
+	# return
+	my $biblionumber;
+
+	my $debug=0;
+	my $sth;
+	my $error;
+
+	#-----
+    	$dbh = C4::Context->dbh;
+
+	print "<PRE>Looking for biblio </PRE>\n" if $debug;
+	$sth=$dbh->prepare("select biblionumber
+		from biblio
+		where title=? and author=?
+		  and copyrightdate=? and seriestitle=?");
+	$sth->execute(
+		$biblio->{title}, $biblio->{author},
+		$biblio->{copyright}, $biblio->{seriestitle} );
+	if ($sth->rows) {
+	    ($biblionumber) = $sth->fetchrow;
+	    print "<PRE>Biblio exists with number $biblionumber</PRE>\n" if $debug;
+	} else {
+	    # Doesn't exist.  Add new one.
+	    print "<PRE>Adding biblio</PRE>\n" if $debug;
+	    ($biblionumber,$error)=&newbiblio($biblio);
+	    if ( $biblionumber ) {
+	      print "<PRE>Added with biblio number=$biblionumber</PRE>\n" if $debug;
+	      if ( $biblio->{subtitle} ) {
+	    	&newsubtitle($biblionumber,$biblio->{subtitle} );
+	      } # if subtitle
+	    } else {
+		print "<PRE>Couldn't add biblio: $error</PRE>\n" if $debug;
+	    } # if added
+	}
+
+	return $biblionumber,$error;
+
+} # sub getoraddbiblio
+
+sub char_decode {
+	# converts ISO 5426 coded string to ISO 8859-1
+	# sloppy code : should be improved in next issue
+	my ($string,$encoding) = @_ ;
+	$_ = $string ;
+# 	$encoding = C4::Context->preference("marcflavour") unless $encoding;
+	if ($encoding eq "UNIMARC") {
+		s/\xe1/€/gm ;
+		s/\xe2/€/gm ;
+		s/\xe9/€/gm ;
+		s/\xec/€/gm ;
+		s/\xf1/€/gm ;
+		s/\xf3/€/gm ;
+		s/\xf9/€/gm ;
+		s/\xfb/€/gm ;
+		s/\xc1\x61/€/gm ;
+		s/\xc1\x65/€/gm ;
+		s/\xc1\x69/€/gm ;
+		s/\xc1\x6f/€/gm ;
+		s/\xc1\x75/€/gm ;
+		s/\xc1\x41/€/gm ;
+		s/\xc1\x45/€/gm ;
+		s/\xc1\x49/€/gm ;
+		s/\xc1\x4f/€/gm ;
+		s/\xc1\x55/€/gm ;
+		s/\xc2\x41/€/gm ;
+		s/\xc2\x45/€/gm ;
+		s/\xc2\x49/€/gm ;
+		s/\xc2\x4f/€/gm ;
+		s/\xc2\x55/€/gm ;
+		s/\xc2\x59/€/gm ;
+		s/\xc2\x61/€/gm ;
+		s/\xc2\x65/€/gm ;
+		s/\xc2\x69/€/gm ;
+		s/\xc2\x6f/€/gm ;
+		s/\xc2\x75/€/gm ;
+		s/\xc2\x79/€/gm ;
+		s/\xc3\x41/€/gm ;
+		s/\xc3\x45/€/gm ;
+		s/\xc3\x49/€/gm ;
+		s/\xc3\x4f/€/gm ;
+		s/\xc3\x55/€/gm ;
+		s/\xc3\x61/€/gm ;
+		s/\xc3\x65/€/gm ;
+		s/\xc3\x69/€/gm ;
+		s/\xc3\x6f/€/gm ;
+		s/\xc3\x75/€/gm ;
+		s/\xc4\x41/€/gm ;
+		s/\xc4\x4e/€/gm ;
+		s/\xc4\x4f/€/gm ;
+		s/\xc4\x61/€/gm ;
+		s/\xc4\x6e/€/gm ;
+		s/\xc4\x6f/€/gm ;
+		s/\xc8\x45/€/gm ;
+		s/\xc8\x49/€/gm ;
+		s/\xc8\x65/€/gm ;
+		s/\xc8\x69/€/gm ;
+		s/\xc8\x76/€/gm ;
+		s/\xc9\x41/€/gm ;
+		s/\xc9\x4f/€/gm ;
+		s/\xc9\x55/€/gm ;
+		s/\xc9\x61/€/gm ;
+		s/\xc9\x6f/€/gm ;
+		s/\xc9\x75/€/gm ;
+		s/\xca\x41/€/gm ;
+		s/\xca\x61/€/gm ;
+		s/\xd0\x43/€/gm ;
+		s/\xd0\x63/€/gm ;
+		# this handles non-sorting blocks (if implementation requires this)
+		$string = nsb_clean($_) ;
+	} elsif ($encoding eq "USMARC" || $encoding eq "MARC21") {
+		if(/[\xc1-\xff]/) {
+			s/\xe1\x61/€/gm ;
+			s/\xe1\x65/€/gm ;
+			s/\xe1\x69/€/gm ;
+			s/\xe1\x6f/€/gm ;
+			s/\xe1\x75/€/gm ;
+			s/\xe1\x41/€/gm ;
+			s/\xe1\x45/€/gm ;
+			s/\xe1\x49/€/gm ;
+			s/\xe1\x4f/€/gm ;
+			s/\xe1\x55/€/gm ;
+			s/\xe2\x41/€/gm ;
+			s/\xe2\x45/€/gm ;
+			s/\xe2\x49/€/gm ;
+			s/\xe2\x4f/€/gm ;
+			s/\xe2\x55/€/gm ;
+			s/\xe2\x59/€/gm ;
+			s/\xe2\x61/€/gm ;
+			s/\xe2\x65/€/gm ;
+			s/\xe2\x69/€/gm ;
+			s/\xe2\x6f/€/gm ;
+			s/\xe2\x75/€/gm ;
+			s/\xe2\x79/€/gm ;
+			s/\xe3\x41/€/gm ;
+			s/\xe3\x45/€/gm ;
+			s/\xe3\x49/€/gm ;
+			s/\xe3\x4f/€/gm ;
+			s/\xe3\x55/€/gm ;
+			s/\xe3\x61/€/gm ;
+			s/\xe3\x65/€/gm ;
+			s/\xe3\x69/€/gm ;
+			s/\xe3\x6f/€/gm ;
+			s/\xe3\x75/€/gm ;
+			s/\xe4\x41/€/gm ;
+			s/\xe4\x4e/€/gm ;
+			s/\xe4\x4f/€/gm ;
+			s/\xe4\x61/€/gm ;
+			s/\xe4\x6e/€/gm ;
+			s/\xe4\x6f/€/gm ;
+			s/\xe8\x45/€/gm ;
+			s/\xe8\x49/€/gm ;
+			s/\xe8\x65/€/gm ;
+			s/\xe8\x69/€/gm ;
+			s/\xe8\x76/€/gm ;
+			s/\xe9\x41/€/gm ;
+			s/\xe9\x4f/€/gm ;
+			s/\xe9\x55/€/gm ;
+			s/\xe9\x61/€/gm ;
+			s/\xe9\x6f/€/gm ;
+			s/\xe9\x75/€/gm ;
+			s/\xea\x41/€/gm ;
+			s/\xea\x61/€/gm ;
+			# this handles non-sorting blocks (if implementation requires this)
+			$string = nsb_clean($_) ;
+		}
+	}
+	return($string) ;
+}
+
+sub nsb_clean {
+	my $NSB = '\x88' ;		# NSB : begin Non Sorting Block
+	my $NSE = '\x89' ;		# NSE : Non Sorting Block end
+	# handles non sorting blocks
+	my ($string) = @_ ;
+	$_ = $string ;
+	s/$NSB/(/gm ;
+	s/[ ]{0,1}$NSE/) /gm ;
+	$string = $_ ;
+	return($string) ;
+}
+
+END { }       # module clean-up code here (global destructor)
+
+=back
+
+=head1 AUTHOR
+
+Koha Developement team <info@koha.org>
+
+Paul POULAIN paul.poulain@free.fr
+
+=cut
+
+=======
+>>>>>>> 1.74
-- 
2.39.2