From 15ad3f3330ffe5991fa8530cc587788ca80f8bef Mon Sep 17 00:00:00 2001
From: bradymiller <bradymiller@users.sourceforge.net>
Date: Sat, 1 Dec 2012 17:23:56 -0800
Subject: [PATCH] Support new security model in the formSubmit function

---
 library/api.inc | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/library/api.inc b/library/api.inc
index c1752000f..274ae416f 100644
--- a/library/api.inc
+++ b/library/api.inc
@@ -3,6 +3,7 @@
 include_once("../../globals.php");
 include_once("{$GLOBALS['srcdir']}/sql.inc");
 include_once("{$GLOBALS['srcdir']}/billing.inc");
+include_once("{$GLOBALS['srcdir']}/formdata.inc.php");
 
 $GLOBALS['form_exit_url'] = $GLOBALS['concurrent_layout'] ?
 	"$rootdir/patient_file/encounter/encounter_top.php" :
@@ -29,6 +30,8 @@ function formFooter ()
 	<?php
 }
 
+// This function will escape the $values when using the new security method (ie. $sanitize_all_escapes is TRUE).
+//   Otherwise, this function expects the $values to already be escaped(original and legacy behavior).
 function formSubmit ($tableName, $values, $id, $authorized = "0")
 {
 	$sql = "insert into $tableName set pid = {$_SESSION['pid']},groupname='".$_SESSION['authProvider']."',user='".$_SESSION['authUser']."',authorized=$authorized,activity=1, date = NOW(),";
@@ -52,7 +55,14 @@ function formSubmit ($tableName, $values, $id, $authorized = "0")
 			}
 		}
 		else {
-			$sql .= " $key = '$value',";
+                        if (isset($sanitize_all_escapes) && $sanitize_all_escapes) {
+                                // using new security method, so escape the key and values here
+                                $sql .= " " . add_escape_custom($key) . " = '" . add_escape_custom($value) . "',";
+                        }
+                        else {
+                                // original method (rely on code to escape values before using this function)
+			        $sql .= " $key = '$value',";
+                        }
 		}
 	$sql = substr($sql, 0, -1);
 	return sqlInsert($sql);
-- 
2.11.4.GIT