Moved to using mysqli and prepared statements

1 files changed, 70 insertions, 38 deletions

diff --git a/daemon.php b/daemon.php
index 1936864..5fa09b2 100644
--- a/daemon.php
+++ b/daemon.php
@@ -17,16 +17,22 @@
     {
         $result = trim($result);
         echo "A job finished with return code ".$returncode.": ".$result."\n";
-        $db = mysql_connect(MYSQL_HOSTNAME, MYSQL_USERNAME, MYSQL_PASSWORD);
-        if (!$db) {
-            die("Could not connect to database ".mysql_error());
+       
+        $db = new mysqli(MYSQL_HOSTNAME, MYSQL_USERNAME,
+                         MYSQL_PASSWORD, MYSQL_DATABASE);
+        if (mysqli_connect_errno()) {
+           die("Could not connect to database ".mysqli_connect_error());
         }
-        mysql_select_db(MYSQL_DATABASE);
-        $result = mysql_real_escape_string($result);
-        $query = "UPDATE builds".
-        " SET result = '".$result."', returncode = '".$returncode.
-        "' WHERE handle = '".mysql_real_escape_string($handle)."'";
-        mysql_query($query);
+        
+        $query = "UPDATE builds SET result = ?, returncode = ? ".
+                 "WHERE handle = ?";
+        
+        $stmt = $db->prepare($query);
+        $stmt->bind_param("sds", $result, $returncode, $handle);
+        $stmt->execute();
+        $stmt->close();
+        $db->close();
+
         return serialize(array($returncode, $result));
     }
 
@@ -103,26 +109,42 @@
         $insert = false;
         $update = false;
         
-        $db = mysql_connect(MYSQL_HOSTNAME, MYSQL_USERNAME, MYSQL_PASSWORD);
-        if (!$db) {
-            die("Could not connect to database ".mysql_error());
+        $db = new mysqli(MYSQL_HOSTNAME, MYSQL_USERNAME,
+                         MYSQL_PASSWORD, MYSQL_DATABASE);
+        if (mysqli_connect_errno()) {
+           die("Could not connect to database ".mysqli_connect_error());
         }
-        mysql_select_db(MYSQL_DATABASE);
+        
+        $query = "UPDATE builds SET result = ?, returncode = ? ".
+                 "WHERE handle = ?";
+        
+        $stmt = $db->prepare($query);
+        $stmt->bind_param("sds", $result, $returncode, $handle);
+        $stmt->execute();
+        $stmt->close();
+        $db->close();
+        
         $query = "SELECT port FROM ports ORDER BY port DESC LIMIT 1";
-        $result = mysql_query($query);
-        if (mysql_num_rows($result) == 0) {
+        $stmt = $db->prepare($query);
+        $stmt->execute();
+        if ($stmt->num_rows == 0) {
             // no ports! assign a new one
+            $stmt->close();
             $port = LOW_PORT;
             $insert = true;
             echo "No ports! Assigning ".$port."\n";
         } else {
             // we have a port! let's check if our vm has one
-            $ports = mysql_fetch_array($result);
-            $lastport = $ports[0];
-            $query = "SELECT port, pid FROM ports WHERE id = '".$buildID."'";
-            $result = mysql_query($query);
-            if (mysql_num_rows($result) == 0) {
+            $stmt->bind_result($lastport);
+            $stmt->fetch();
+            $stmt->close();
+            $query = "SELECT port, pid FROM ports WHERE id = ?";
+            $stmt = $db->prepare($query);
+            $stmt->bind_param("s", $buildID);
+            $stmt->execute();
+            if ($stmt->num_rows == 0) {
                 // vm doesn't have one, assign one!
+                $stmt->close();
                 $port = $lastport+1;
                 if ($port > HIGH_PORT) {
                     $port = LOW_PORT;
@@ -131,18 +153,18 @@
                 echo "Assigning new port ".$port."\n";
             } else {
                 // vm already has one, return it
-                $ports = mysql_fetch_array($result);
-                   $port = $ports[0];
-                   $pid = $ports[1];
-                   $running = true;
-                   if (!check_pid($pid)) {
-                       $running = false;
-                       $update = true;
-                       echo "VM is not running, PID ".$pid." is dead!\n";
-                   } else {
-                       echo "VM is running on PID ".$pid."\n";
-                   }
-                   echo "VM already has port ".$port."\n";
+                $stmt->bind_result($port, $pid);
+                $stmt->fetch();
+                $stmt->close();
+                $running = true;
+                if (!check_pid($pid)) {
+                   $running = false;
+                   $update = true;
+                   echo "VM is not running, PID ".$pid." is dead!\n";
+                } else {
+                   echo "VM is running on PID ".$pid."\n";
+                }
+                echo "VM already has port ".$port."\n";
             }
         }
         
@@ -162,17 +184,27 @@
         $pid = $pid + 2;
         
         if ($insert) {
-            $query = "DELETE FROM ports WHERE port = ".$port;
-            $result = mysql_query($query);
-            $query = "INSERT INTO ports (id, port, pid) VALUES('".mysql_real_escape_string($buildID)."', ".$port.", ".$pid.")";
-            $result = mysql_query($query);
+            $query = "DELETE FROM ports WHERE port = ?";
+            $stmt = $db->prepare($query);
+            $stmt->bind_param("d", $port);
+            $stmt->execute();
+            $stmt->close();
+            $query = "INSERT INTO ports (id, port, pid) VALUES(?, ?, ?)";
+            $stmt = $db->prepare($query);
+            $stmt->bind_param("sdd", $buildID, $port, $pid);
+            $stmt->execute();
+            $stmt->close();
             echo "Doing insert!\n";
         } elseif ($update) {
-               $query = "UPDATE ports SET pid = ".$pid." WHERE id = '".$buildID."'";
-            $result = mysql_query($query);
+            $query = "UPDATE ports SET pid = ? WHERE id = ?";
+            $stmt = $db->prepare($query);
+            $stmt->bind_param("ds", $pid, $buildID);
+            $stmt->execute();
+            $stmt->close();
             echo "Doing update\n";
         }
         
+        $db->close();
         $port = $port+1000;
         return serialize(array(EXTERNAL_HOST, $port));
     }