From e9da9f5bb69ef6d8286d3e4e7f2684558af20515 Mon Sep 17 00:00:00 2001
From: Petr Skoda <skodak@moodle.org>
Date: Tue, 21 Sep 2010 21:57:03 +0000
Subject: [PATCH] MDL-24318 fixed incorrect sql conversion

---
 mod/data/lib.php | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/mod/data/lib.php b/mod/data/lib.php
index a24b392e09c..00d2321fbb9 100755
--- a/mod/data/lib.php
+++ b/mod/data/lib.php
@@ -1591,28 +1591,31 @@ function data_get_post_actions() {
 }
 
 /**
- * @global object
- * @global object
  * @param string $name
  * @param int $dataid
  * @param int $fieldid
  * @return bool
  */
-function data_fieldname_exists($name, $dataid, $fieldid=0) {
-    global $CFG, $DB;
+function data_fieldname_exists($name, $dataid, $fieldid = 0) {
+    global $DB;
 
-    if(!is_numeric($name)) {
-        $like = $DB->sql_like('df.name', $name, false);
+    if (!is_numeric($name)) {
+        $like = $DB->sql_like('df.name', ':name', false);
     } else {
-        $like = "df.name = $name";
+        $like = "df.name = :name";
     }
+    $params = array('name'=>$name);
     if ($fieldid) {
+        $params['dataid']   = $dataid;
+        $params['fieldid1'] = $fieldid;
+        $params['fieldid2'] = $fieldid;
         return $DB->record_exists_sql("SELECT * FROM {data_fields} df
-                                        WHERE ".$like." AND df.dataid = ?
-                                              AND ((df.id < ?) OR (df.id > ?))", array($dataid, $fieldid, $fieldid));
+                                        WHERE $like AND df.dataid = :dataid
+                                              AND ((df.id < :fieldid1) OR (df.id > :fieldid2))", $params);
     } else {
+        $params['dataid']   = $dataid;
         return $DB->record_exists_sql("SELECT * FROM {data_fields} df
-                                        WHERE ".$like." AND df.dataid = ?", array($dataid));
+                                        WHERE $like AND df.dataid = :dataid", $params);
     }
 }