@@ -39,14 +39,14 @@ function prepare_cert($cert)

 function get_logins_by_cert($cert) 

 {

-	$cert = mysql_real_escape_string(prepare_cert($cert));

+	$cert = db_escape_string(prepare_cert($cert));

 	$query = "SELECT type,username,startpage FROM system.clientcert WHERE cert='{$cert}'";

 	$result = db_query($query);

-	if (mysql_num_rows($result) < 1)

+	if ($result->rowCount() < 1)

 		return NULL;

 	else {

 		$ret = array();

-		while ($row = mysql_fetch_assoc($result)) {

+		while ($row = $result->fetch()) {

 			$ret[] = $row;

 		}

 		return $ret;

@@ -39,14 +39,14 @@ function prepare_cert($cert)

 function get_logins_by_cert($cert) 

 {

-	$cert = mysql_real_escape_string(prepare_cert($cert));

+	$cert = db_escape_string(prepare_cert($cert));

 	$query = "SELECT type,username,startpage FROM system.clientcert WHERE cert='{$cert}'";

 	$result = db_query($query);

-	if (mysql_num_rows($result) < 1)

+	if ($result->rowCount() < 1)

 		return NULL;

 	else {

 		$ret = array();

-		while ($row = mysql_fetch_assoc($result)) {

+		while ($row = $result->fetch()) {

 			$ret[] = $row;

 		}

 		return $ret;

@@ -14,7 +14,6 @@ http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/debug.php');

new file mode 100644

@@ -0,0 +1,119 @@

+<?php

+/*

+This file belongs to the Webinterface of schokokeks.org Hosting

+

+Written 2008-2013 by schokokeks.org Hosting, namely

+  Bernd Wurst <bernd@schokokeks.org>

+  Hanno Böck <hanno@schokokeks.org>

+

+To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

+

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+http://creativecommons.org/publicdomain/zero/1.0/

+

+Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

+*/

+

+require_once('inc/base.php');

+require_once('inc/error.php');

+require_once('inc/debug.php');

+

+

+class DB extends PDO {

+  function __construct() {

+    $dsn = "mysql:host=".config('db_host');

+    if (config('db_port', true)) {

+      $dsn .= ';port='.config('db_port', true);

+    }

+    $username = config('db_user', true);

+    $password = config('db_pass', true);

+    parent::__construct($dsn, $username, $password);

+  }

+

+

+  /*

+    Wenn Parameter übergeben werden, werden Queries immer als Prepared statements übertragen

+  */

+  function query($stmt, $params = NULL) {

+    if (is_array($params)) {

+      $response = parent::prepare($stmt);

+      $response->execute($params);

+      return $response;

+    } else {

+      return parent::query($stmt);

+    }

+  }

+}

+

+

+/* FIXME 

+   Das ist etwas unelegant. Soll nur übergangsweise verwendet werden bis alles auf prepared statements umgestellt ist

+*/

+function db_escape_string($string)

+{

+  global $db;

+  __ensure_connected();

+  $quoted = $db->quote($string);

+  // entferne die quotes, damit wird es drop-in-Kompatibel zu db_escape_string()

+  $ret = substr($quoted, 1, -1);

+  return $ret;

+}

+

+

+function db_insert_id()

+{

+  global $db;

+  __ensure_connected();

+  return $db->lastInsertId();

+}

+

+

+function __ensure_connected()

+{

+  /*

+    Dieses Kontrukt ist vermultich noch schlimmer als ein normales singleton

+    aber es hilft uns in unserem prozeduralen Kontext

+  */

+  global $db;

+  if (! isset($db)) {

+    try {

+      DEBUG("Neue Datenbankverbindung!");

+      $db = new DB();

+      $db->query("SET NAMES utf8");

+      $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

+      $db->setAttribute(PDO::ATTR_AUTOCOMMIT, true);

+    } catch (PDOException $e) {

+      global $debugmode;

+      if ($debugmode) {

+        system_failure("MySQL-Fehler: ".$e->getMessage());

+      } else {

+        system_failure("Fehler bei der Datenbankverbindung!");

+      }

+    }

+  }

+}

+

+

+function db_query($stmt, $params = NULL)

+{

+  global $db;

+  __ensure_connected();

+  DEBUG($stmt);

+  if ($params) {

+    DEBUG($params);

+  }

+  try {

+    $result = $db->query($stmt, $params);

+    DEBUG('=> '.$result->rowCount().' rows');

+  } catch (PDOException $e) {

+    global $debugmode;

+    if ($debugmode) {

+      system_failure("MySQL-Fehler: ".$e->getMessage());

+    } else {

+      system_failure("Datenbankfehler");

+    }

+  }

+  return $result;

+}

+

+

@@ -14,7 +14,6 @@ http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/debug.php');

@@ -42,7 +41,7 @@ class Domain extends KeksData

   function loadByName($name)

   {

-    $name = mysql_real_escape_string($name);

+    $name = db_escape_string($name);

     $res = $this->getData("*", "CONCAT_WS('.', domainname, tld)='{$name}' LIMIT 1");

     if (count($res) < 1)

       return false;

@@ -112,9 +111,9 @@ function get_domain_list($customerno, $uid = NULL)

   $query .= " ORDER BY domainname,tld";

   $result = db_query($query);

   $domains = array();

-  DEBUG('Result set is '.mysql_num_rows($result)." rows.<br />\n");

-  if (mysql_num_rows($result) > 0)

-    while ($domain = mysql_fetch_object($result))

+  DEBUG('Result set is '.$result->rowCount()." rows.<br />\n");

+  if ($result->rowCount() > 0)

+    while ($domain = $result->fetch(PDO::FETCH_OBJ))

       array_push($domains, new Domain((int) $domain->id));

   DEBUG($domains);

 	return $domains;	

@@ -14,7 +14,6 @@ http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/debug.php');

@@ -57,7 +56,7 @@ abstract class KeksData

   {

     $fields = array();

     $res = db_query("DESCRIBE {$this->default_table}");

-    while ($f = mysql_fetch_object($res))

+    while ($f = $res->fetch(PDO::FETCH_OBJ))

     {

       $fields[$f->Field] = $f->Default;

     }

@@ -80,7 +79,7 @@ abstract class KeksData

     $res = db_query("SELECT {$fields} FROM {$table} {$where}");

     $return = array();

-    while ($arr = mysql_fetch_assoc($res))

+    while ($arr = $res->fetch())

       array_push($return, $arr);

     return $return;

   }

@@ -102,7 +101,7 @@ abstract class KeksData

     $upd = array();

     foreach ($this->changes as $key => $value)

     {

-      $value = mysql_real_escape_string($value);

+      $value = db_escape_string($value);

       array_push($upd, "`{$key}`='{$value}'");

     }

     db_query("UPDATE {$this->default_table} SET ".implode(', ', $upd)." WHERE id={$this->data['id']};");

@@ -17,7 +17,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 require_once('config.php');

 require_once('inc/debug.php');

-require_once('inc/db_connect.php');

 require_once("inc/base.php");

 require_once("inc/theme.php");

@@ -14,7 +14,7 @@ http://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

-require_once('inc/db_connect.php');

+require_once('class/database.php');

 require_once('inc/debug.php');

 function config($key)

@@ -36,9 +36,9 @@ function config($key)

     return $config[$key];

   /* read configuration from database */

-  $options = db_query( "SELECT `key`, value FROM misc.config" );

+  $result = db_query( "SELECT `key`, value FROM misc.config" );

-  while( $object = mysql_fetch_assoc( $options ) ) {

+  while( $object = $result->fetch() ) {

     if (!array_key_exists($object['key'], $config)) {

 	    $config[$object['key']]=$object['value'];

     }

@@ -56,8 +56,9 @@ function config($key)

 function get_server_by_id($id) {

   $id = (int) $id;

-  $result = mysql_fetch_assoc(db_query("SELECT hostname FROM system.servers WHERE id='{$id}'"));

-  return $result['hostname'];

+  $result = db_query("SELECT hostname FROM system.servers WHERE id='{$id}'");

+  $ret = $result->fetch();

+  return $ret['hostname'];

 }

@@ -74,7 +75,7 @@ function my_server_id()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT server FROM system.useraccounts WHERE uid={$uid}");

-  $r = mysql_fetch_assoc($result);

+  $r = $result->fetch();

   DEBUG($r);

   return $r['server'];

 }

@@ -85,7 +86,7 @@ function additional_servers()

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT server FROM system.user_server WHERE uid={$uid}");

   $servers = array();

-  while ($s = mysql_fetch_assoc($result))

+  while ($s = $result->fetch())

     $servers[] = $s['server'];

   DEBUG($servers);

   return $servers;

@@ -96,43 +97,27 @@ function server_names()

 {

   $result = db_query("SELECT id, hostname FROM system.servers");

   $servers = array();

-  while ($s = mysql_fetch_assoc($result))

+  while ($s = $result->fetch())

     $servers[$s['id']] = $s['hostname'];

   DEBUG($servers);

   return $servers;

 }

-function db_query($query)

-{

-  DEBUG($query);

-  $result = @mysql_query($query);

-  if (mysql_error())

-  {

-    $error = mysql_error();

-    logger(LOG_ERR, "inc/base", "dberror", "mysql error: {$error}");

-    system_failure('Interner Datenbankfehler: »'.iconv('ISO-8859-1', 'UTF-8', $error).'«.');

-  }

-  $count = @mysql_num_rows($result);

-  if (! $count)

-    $count = 'no';

-  DEBUG("=> {$count} rows");

-  return $result; 

-}

-

-

-

+// FIXME

+// Diese Funktion funktioniert nicht für preprared statements

 function maybe_null($value)

 {

   if ($value == NULL)

     return 'NULL';

   if (strlen( (string) $value ) > 0)

-    return "'".mysql_real_escape_string($value)."'";

+    return "'".db_escape_string($value)."'";

   else

     return 'NULL';

 }

+

 #define('LOG_ERR', 3);

 #define('LOG_WARNING', 4);

 #define('LOG_INFO', 6);

@@ -148,11 +133,11 @@ function logger($severity, $scriptname, $scope, $message)

   elseif ($_SESSION['role'] & ROLE_CUSTOMER)

     $user = "'{$_SESSION['customerinfo']['customerno']}'";

-  $remote = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);

+  $remote = db_escape_string($_SERVER['REMOTE_ADDR']);

-  $scriptname = mysql_real_escape_string($scriptname);

-  $scope = mysql_real_escape_string($scope);

-  $message = mysql_real_escape_string($message);

+  $scriptname = db_escape_string($scriptname);

+  $scope = db_escape_string($scope);

+  $message = db_escape_string($message);

   db_query("INSERT INTO misc.scriptlog (remote, user,scriptname,scope,message) VALUES ('{$remote}', {$user}, '{$scriptname}', '{$scope}', '{$message}');");

 }

deleted file mode 100644

@@ -1,33 +0,0 @@

-<?php

-/*

-This file belongs to the Webinterface of schokokeks.org Hosting

-

-Written 2008-2013 by schokokeks.org Hosting, namely

-  Bernd Wurst <bernd@schokokeks.org>

-  Hanno Böck <hanno@schokokeks.org>

-

-To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

-http://creativecommons.org/publicdomain/zero/1.0/

-

-Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

-*/

-

-require_once('inc/error.php');

-

-include("config.php");

-global $config;

-

-$host = $config['db_host'];

-if ($config['db_port']) {

-  $host .= ":".$config['db_port'];

-}

-

-if (!@mysql_connect($host, $config['db_user'], $config['db_pass']))

-	die('Konnte nicht zur Datenbank verbinden. Wenn dieser Fehler wiederholt auftritt, beachrichtigen Sie bitte den Administrator.');

-	

-if (!@mysql_query('SET NAMES utf8'))

-	die('Fehler bei der Auswahl der Zeichencodierung. Bitte melden Sie diesen Fehler einem Administrator!');

-

-?>

@@ -15,7 +15,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 */

 require_once('inc/debug.php');

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/security.php');

 require_once('inc/error.php');

@@ -38,14 +37,14 @@ function get_domain_offer($domainname)

   $data = array("domainname" => $domainname, "basename" => $basename, "tld" => $tld);

   $result = db_query("SELECT tld, gebuehr, setup FROM misc.domainpreise_kunde WHERE kunde={$cid} AND tld='{$tld}' AND ruecksprache='N'");

-  if (mysql_num_rows($result) != 1) {

+  if ($result->rowCount() != 1) {

     $result = db_query("SELECT tld, gebuehr, setup FROM misc.domainpreise WHERE tld='{$tld}' AND ruecksprache='N'");

   }

-  if (mysql_num_rows($result) != 1) {

+  if ($result->rowCount() != 1) {

     warning('Die Endung »'.$tld.'« steht zur automatischen Eintragung nicht zur Verfügung.');

     return;

   }

-  $temp = mysql_fetch_assoc($result);

+  $temp = $result->fetch();

   $data["gebuehr"] = $temp["gebuehr"];

   $data["setup"] = ($temp["setup"] ? $temp["setup"] : 0.0);

@@ -93,7 +92,7 @@ function list_useraccounts()

   $customerno = (int) $_SESSION['customerinfo']['customerno'];

   $result = db_query("SELECT uid,username,name FROM system.useraccounts WHERE kunde={$customerno}");

   $ret = array();

-  while ($item = mysql_fetch_assoc($result))

+  while ($item = $result->fetch())

   {

     $ret[] = $item;

   }

@@ -19,7 +19,7 @@ require_once('inc/base.php');

 function find_customers($string) 

 {

-  $string = mysql_real_escape_string(chop($string));

+  $string = db_escape_string(chop($string));

   $return = array();

   $result = db_query("SELECT k.id FROM kundendaten.kunden AS k LEFT JOIN kundendaten.kundenkontakt AS kk ".

                      "ON (kk.kundennr = k.id) LEFT JOIN system.useraccounts AS u ON (k.id=u.kunde) WHERE ".

@@ -30,7 +30,7 @@ function find_customers($string)

                      "notizen LIKE '%{$string}%' OR kk.name LIKE '%{$string}%' OR ".

                      "kk.wert LIKE '%{$string}%' OR u.name LIKE '%{$string}%' OR ".

                      "u.username LIKE '%{$string}%' OR k.id='{$string}' OR u.uid='{$string}';");

-  while ($entry = mysql_fetch_assoc($result))

+  while ($entry = $result->fetch())

     $return[] = $entry['id'];

   return $return;

@@ -43,7 +43,7 @@ function find_users_for_customer($id)

   $return = array();

   $result = db_query("SELECT uid, username FROM system.useraccounts WHERE ".

                      "kunde='{$id}';");

-  while ($entry = mysql_fetch_assoc($result))

+  while ($entry = $result->fetch())

     $return[$entry['uid']] = $entry['username'];

   return $return;

@@ -56,7 +56,7 @@ function hosting_contracts($cid)

   $cid = (int) $cid;

   $result = db_query("SELECT u.username, werber, beschreibung, betrag, brutto, monate, anzahl, startdatum, startdatum + INTERVAL laufzeit MONTH - INTERVAL 1 DAY AS mindestlaufzeit, kuendigungsdatum, gesperrt, notizen FROM kundendaten.hosting AS h LEFT JOIN system.useraccounts AS u ON (h.hauptuser=u.uid) WHERE h.kunde=".$cid);

   $ret = array();

-  while ($x = mysql_fetch_assoc($result))

+  while ($x = $result->fetch())

     array_push($ret, $x);

   DEBUG($ret);

@@ -15,7 +15,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 */

 require_once('inc/debug.php');

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/security.php');

 require_once('inc/error.php');

@@ -28,7 +27,7 @@ function get_dyndns_accounts()

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT * FROM dns.dyndns WHERE uid={$uid}");

   $list = array();

-  while ($item = mysql_fetch_assoc($result)) {

+  while ($item = $result->fetch()) {

     array_push($list, $item);

   }

   DEBUG($list);

@@ -41,11 +40,11 @@ function get_dyndns_account($id)

   $id = (int) $id;

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT * FROM dns.dyndns WHERE id={$id} AND uid={$uid}");

-  if (mysql_num_rows($result) != 1) {

+  if ($result->rowCount() != 1) {

     logger(LOG_WARNING, "modules/dns/include/dnsinclude", "dyndns", "account »{$id}« invalid for uid »{$uid}«.");

     system_failure("Account ungültig");

   }

-  $item = mysql_fetch_assoc($result);

+  $item = $result->fetch();

   DEBUG($item);

   return $item;

 }

@@ -58,8 +57,8 @@ function create_dyndns_account($handle, $password_http, $sshkey)

   if ($password_http == '' && $sshkey == '')

     system_failure('Sie müssen entweder einen SSH-Key oder ein Passwort zum Web-Update eingeben.');  

-  $handle = maybe_null(mysql_real_escape_string(filter_input_username($handle)));

-  $sshkey = maybe_null(mysql_real_escape_string(filter_input_general($sshkey)));

+  $handle = maybe_null(db_escape_string(filter_input_username($handle)));

+  $sshkey = maybe_null(db_escape_string(filter_input_general($sshkey)));

   $pwhash = 'NULL';

   if ($password_http)

@@ -73,8 +72,8 @@ function create_dyndns_account($handle, $password_http, $sshkey)

 function edit_dyndns_account($id, $handle, $password_http, $sshkey)

 {

   $id = (int) $id;

-  $handle = maybe_null(mysql_real_escape_string(filter_input_username($handle)));

-  $sshkey = maybe_null(mysql_real_escape_string(filter_input_general($sshkey)));

+  $handle = maybe_null(db_escape_string(filter_input_username($handle)));

+  $sshkey = maybe_null(db_escape_string(filter_input_general($sshkey)));

   $pwhash = 'NULL';

   if ($password_http)

@@ -104,7 +103,7 @@ function get_dyndns_records($id)

   $id = (int) $id;

   $result = db_query("SELECT hostname, domain, type, ttl, lastchange, id FROM dns.custom_records WHERE dyndns={$id}");

   $data = array();

-  while ($entry = mysql_fetch_assoc($result)) {

+  while ($entry = $result->fetch()) {

     $dom = new Domain((int) $entry['domain']);

     $dom->ensure_userdomain();

     $entry['fqdn'] = $entry['hostname'].'.'.$dom->fqdn;

@@ -144,9 +143,9 @@ function get_dns_record($id)

 {

   $id = (int) $id;

   $result = db_query("SELECT hostname, domain, type, ip, dyndns, spec, data, ttl FROM dns.custom_records WHERE id={$id}");

-  if (mysql_num_rows($result) != 1)

+  if ($result->rowCount() != 1)

     system_failure('illegal ID');

-  $data = mysql_fetch_assoc($result);

+  $data = $result->fetch();

   $dom = new Domain( (int) $data['domain']);

   $dom->ensure_userdomain();

   DEBUG($data);

@@ -159,7 +158,7 @@ function get_domain_records($dom)

   $dom = (int) $dom;

   $result = db_query("SELECT hostname, domain, type, ip, dyndns, spec, data, ttl, id FROM dns.custom_records WHERE domain={$dom}");

   $data = array();

-  while ($entry = mysql_fetch_assoc($result)) {

+  while ($entry = $result->fetch()) {

     $dom = new Domain((int) $entry['domain']);

     $dom->ensure_userdomain();

     $entry['fqdn'] = $entry['hostname'].'.'.$dom->fqdn;

@@ -173,11 +172,11 @@ function get_domain_records($dom)

 function get_domain_auto_records($domainname)

 {

-  $domainname = mysql_real_escape_string($domainname);

+  $domainname = db_escape_string($domainname);

   //$result = db_query("SELECT hostname, domain, CONCAT_WS('.', hostname, domain) AS fqdn, type, ip, spec, data, TRIM(ttl) FROM dns.v_autogenerated_records WHERE domain='{$domainname}'");

   $result = db_query("SELECT hostname, domain, CONCAT_WS('.', hostname, domain) AS fqdn, type, ip, spec, data, ttl FROM dns.tmp_autorecords WHERE domain='{$domainname}'");

   $data = array();

-  while ($entry = mysql_fetch_assoc($result)) {

+  while ($entry = $result->fetch()) {

     array_push($data, $entry);

   }

   DEBUG($data);

@@ -329,7 +328,7 @@ function domain_is_maildomain($domain)

 {

   $domain = (int) $domain;

   $result = db_query("SELECT mail FROM kundendaten.domains WHERE id={$domain}");

-  $dom = mysql_fetch_assoc($result);

+  $dom = $result->fetch();

   return ($dom['mail'] != 'none');

 }

@@ -27,7 +27,7 @@ function mailman_subdomains($domain)

   $domain = (int) $domain;

   $result = db_query("SELECT id, hostname FROM mail.mailman_domains WHERE domain={$domain}");

   $ret = array();

-  while ($line = mysql_fetch_assoc($result))

+  while ($line = $result->fetch())

   {

     $ret[] = $line;

   }

@@ -40,7 +40,7 @@ function dns_in_use($domain)

     return false;

   $domain = (int) $domain;

   $result = db_query("SELECT id FROM dns.custom_records WHERE domain={$domain}");

-  return (mysql_num_rows($result) > 0);

+  return ($result->rowCount() > 0);

 }

@@ -52,16 +52,16 @@ function mail_in_use($domain)

   }

   $domain = (int) $domain;

   $result = db_query("SELECT mail FROM kundendaten.domains WHERE id={$domain}");

-  if (mysql_num_rows($result) < 1)

+  if ($result->rowCount() < 1)

     system_failure("Domain not found");

-  $d = mysql_fetch_assoc($result);

+  $d = $result->fetch();

   if ($d['mail'] == 'none')

     return false; // manually disabled

   $result = db_query("SELECT id FROM mail.virtual_mail_domains WHERE domain={$domain}");

-  if (mysql_num_rows($result) < 1)

+  if ($result->rowCount() < 1)

     return true; // .courier

   $result = db_query("SELECT acc.id FROM mail.vmail_accounts acc LEFT JOIN mail.virtual_mail_domains dom ON (acc.domain=dom.id) WHERE dom.domain={$domain}");

-  return (mysql_num_rows($result) > 0);

+  return ($result->rowCount() > 0);

 }

 function web_in_use($domain)

@@ -72,12 +72,12 @@ function web_in_use($domain)

   $domain = (int) $domain;

   $result = db_query("SELECT id FROM kundendaten.domains WHERE id={$domain} AND webserver=1");

-  if (mysql_num_rows($result) < 1)

+  if ($result->rowCount() < 1)

     return false;

   $result = db_query("SELECT id FROM vhosts.vhost WHERE domain={$domain}");

   $result2 = db_query("SELECT id FROM vhosts.alias WHERE domain={$domain}");

-  return (mysql_num_rows($result) > 0 || mysql_num_rows($result2) > 0);

+  return ($result->rowCount() > 0 || $result2->rowCount() > 0);

 }

@@ -20,8 +20,8 @@ function user_has_accounts()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT id from `mail`.`mailaccounts` WHERE uid=$uid");

-  DEBUG(mysql_num_rows($result)." accounts");

-  return (mysql_num_rows($result) > 0);

+  DEBUG($result->rowCount()." accounts");

+  return ($result->rowCount() > 0);

 }

 if (! function_exists("user_has_vmail_domain"))

@@ -34,7 +34,7 @@ if (! function_exists("user_has_vmail_domain"))

         }

         $uid = (int) $_SESSION['userinfo']['uid'];

         $result = db_query("SELECT COUNT(*) FROM mail.v_vmail_domains WHERE useraccount='{$uid}'");

-        $row = mysql_fetch_array($result);

+        $row = $result->fetch();

         $count = $row[0];

         DEBUG("User has {$count} vmail-domains");

         return ( (int) $count > 0 );

@@ -24,7 +24,7 @@ if (! function_exists("user_has_vmail_domain"))

 	}

 	$uid = (int) $_SESSION['userinfo']['uid'];

 	$result = db_query("SELECT COUNT(*) FROM mail.v_vmail_domains WHERE useraccount='{$uid}'");

-	$row = mysql_fetch_array($result);

+	$row = $result->fetch();

 	$count = $row[0];

 	DEBUG("User has {$count} vmail-domains");

 	return ( (int) $count > 0 );

@@ -42,7 +42,7 @@ if (! function_exists("user_has_dotcourier_domain"))

 	$uid = (int) $_SESSION['userinfo']['uid'];

 	$result = db_query("select 1 from mail.custom_mappings as c left join mail.v_domains as d on (d.id=c.domain) where d.user={$uid} or c.uid={$uid} UNION ". 

             "SELECT 1 FROM mail.v_domains AS d WHERE d.user={$uid} AND d.id != ALL(SELECT domain FROM mail.virtual_mail_domains);");

-  $ret = (mysql_num_rows($result) > 0);

+  $ret = ($result->rowCount() > 0);

   if ($ret)

     DEBUG("User {$uid} has dotcourier-domains");

   return $ret;

@@ -15,7 +15,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 */

 require_once('inc/debug.php');

-require_once('inc/db_connect.php');

 require_once('inc/base.php');

 require_once('inc/security.php');

@@ -27,10 +26,10 @@ function mailaccounts($uid)

 {

   $uid = (int) $uid;

   $result = db_query("SELECT m.id,concat_ws('@',`m`.`local`,if(isnull(`m`.`domain`),'".config('masterdomain')."',`d`.`domainname`)) AS `account`, `m`.`password` AS `cryptpass`,`m`.`maildir` AS `maildir`,aktiv from (`mail`.`mailaccounts` `m` left join `mail`.`v_domains` `d` on((`d`.`id` = `m`.`domain`))) WHERE m.uid=$uid ORDER BY if(isnull(`m`.`domain`),'".config('masterdomain')."',`d`.`domainname`), local");

-  DEBUG("Found ".@mysql_num_rows($result)." rows!");

+  DEBUG("Found ".@$result->rowCount()." rows!");

   $accounts = array();

-  if (@mysql_num_rows($result) > 0)

-    while ($acc = @mysql_fetch_object($result))

+  if (@$result->rowCount() > 0)

+    while ($acc = @$result->fetch(PDO::FETCH_OBJ))

       array_push($accounts, array('id'=> $acc->id, 'account' => $acc->account, 'mailbox' => $acc->maildir, 'cryptpass' => $acc->cryptpass, 'enabled' => ($acc->aktiv == 1)));

   return $accounts;

 }

@@ -40,10 +39,10 @@ function get_mailaccount($id)

   $id = (int) $id;

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT concat_ws('@',`m`.`local`,if(isnull(`m`.`domain`),'".config('masterdomain')."',`d`.`domainname`)) AS `account`, `m`.`password` AS `cryptpass`,`m`.`maildir` AS `maildir`,aktiv from (`mail`.`mailaccounts` `m` left join `mail`.`v_domains` `d` on((`d`.`id` = `m`.`domain`))) WHERE m.id=$id AND m.uid={$uid}");

-  DEBUG("Found ".mysql_num_rows($result)." rows!");

-  if (mysql_num_rows($result) != 1)

+  DEBUG("Found ".$result->rowCount()." rows!");

+  if ($result->rowCount() != 1)

     system_failure('Dieser Mailaccount existiert nicht oder gehört Ihnen nicht');

-  $acc = mysql_fetch_object($result);

+  $acc = $result->fetch(PDO::FETCH_OBJ);

   $ret = array('account' => $acc->account, 'mailbox' => $acc->maildir,  'enabled' => ($acc->aktiv == 1));

   DEBUG(print_r($ret, true));

   return $ret;

@@ -73,13 +72,13 @@ function change_mailaccount($id, $arr)

         array_push($conditions, "domain={$domain->id}");

       }

     }

-    array_push($conditions, "local='".mysql_real_escape_string($local)."'");

+    array_push($conditions, "local='".db_escape_string($local)."'");

   }

   if (isset($arr['mailbox']))

     if ($arr['mailbox'] == '')

       array_push($conditions, "`maildir`=NULL");

     else

-      array_push($conditions, "`maildir`='".mysql_real_escape_string($arr['mailbox'])."'");

+      array_push($conditions, "`maildir`='".db_escape_string($arr['mailbox'])."'");

   if (isset($arr['password']))

   {

@@ -121,13 +120,13 @@ function create_mailaccount($arr)

     }

   }

-  $values['local'] = "'".mysql_real_escape_string($local)."'";

+  $values['local'] = "'".db_escape_string($local)."'";

   if (isset($arr['mailbox']))

     if ($arr['mailbox'] == '')

       $values['maildir'] = 'NULL';

     else

-      $values['maildir']= "'".mysql_real_escape_string($arr['mailbox'])."'";

+      $values['maildir']= "'".db_escape_string($arr['mailbox'])."'";

   if (isset($arr['password']))

@@ -149,13 +148,13 @@ function get_mailaccount_id($accountname)

 {

   list($local, $domain) = explode('@', $accountname, 2);

-  $local = mysql_real_escape_string($local);

-  $domain = mysql_real_escape_string($domain);

+  $local = db_escape_string($local);

+  $domain = db_escape_string($domain);

   $result = db_query("SELECT acc.id FROM mail.mailaccounts AS acc LEFT JOIN mail.v_domains AS dom ON (dom.id=acc.domain) WHERE local='{$local}' AND dom.domainname='{$domain}'");

-  if (mysql_num_rows($result) != 1)

+  if ($result->rowCount() != 1)

     system_failure('account nicht eindeutig');

-  $acc = mysql_fetch_assoc($result);

+  $acc = $result->fetch();

   return $acc['id'];

 }

@@ -214,7 +213,7 @@ function imap_on_vmail_domain()

 {

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT m.id FROM mail.mailaccounts AS m INNER JOIN mail.virtual_mail_domains AS vd USING (domain) WHERE m.uid={$uid}");

-  if (mysql_num_rows($result) > 0)

+  if ($result->rowCount() > 0)

     return true;

   return false;

 }

@@ -224,11 +223,11 @@ function user_has_only_vmail_domains()

   $uid = (int) $_SESSION['userinfo']['uid'];

   $result = db_query("SELECT id FROM mail.v_vmail_domains WHERE useraccount={$uid}");

   // User hat keine VMail-Domains

-  if (mysql_num_rows($result) == 0)

+  if ($result->rowCount() == 0)

     return false;

   $result = db_query("SELECT d.id FROM mail.v_domains AS d LEFT JOIN mail.v_vmail_domains AS vd USING (domainname) WHERE vd.id IS NULL AND d.user={$uid}");

   // User hat keine Domains die nicht vmail-Domains sind

-  if (mysql_num_rows($result) == 0)

+  if ($result->rowCount() == 0)

     return true;

   return false;

 }

@@ -58,9 +58,9 @@ Ihre E-Mail wird nicht weitergeleitet.',

 function get_vmail_id_by_emailaddr($emailaddr) 

 {

-  $emailaddr = mysql_real_escape_string( $emailaddr );

+  $emailaddr = db_escape_string( $emailaddr );

   $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE CONCAT(local, '@', domainname) = '{$emailaddr}'");

-  $entry = mysql_fetch_assoc($result);

+  $entry = $result->fetch();

   return (int) $entry['id'];

 }

@@ -74,10 +74,10 @@ function get_account_details($id, $checkuid = true)

     $uid_check = "useraccount='{$uid}' AND ";

   }

   $result = db_query("SELECT id, local, domain, password, spamfilter, forwards, autoresponder, server, quota, COALESCE(quota_used, 0) AS quota_used, quota_threshold from mail.v_vmail_accounts WHERE {$uid_check}id={$id} LIMIT 1");

-	if (mysql_num_rows($result) == 0)

+	if ($result->rowCount() == 0)

 		system_failure('Ungültige ID oder kein eigener Account');

 	$acc = empty_account();

-	$res = mysql_fetch_assoc($result);

+	$res = $result->fetch();

 	foreach ($res AS $key => $value) {

 	  if ($key == 'forwards')

 	    continue;

@@ -85,13 +85,13 @@ function get_account_details($id, $checkuid = true)

 	}

 	if ($acc['forwards'] > 0) {

 	  $result = db_query("SELECT id, spamfilter, destination FROM mail.vmail_forward WHERE account={$acc['id']};");

-	  while ($item = mysql_fetch_assoc($result)){

+	  while ($item = $result->fetch()){

 	    array_push($acc['forwards'], array("id" => $item['id'], 'spamfilter' => $item['spamfilter'], 'destination' => $item['destination']));

 	  }

 	}

   if ($acc['autoresponder'] > 0) {

     $result = db_query("SELECT id, IF(valid_from IS NULL OR valid_from > NOW() OR valid_until < NOW(), 0, 1) AS active, DATE(valid_from) AS valid_from, DATE(valid_until) AS valid_until, fromname, fromaddr, subject, message, quote FROM mail.vmail_autoresponder WHERE account={$acc['id']}");

-    $item = mysql_fetch_assoc($result);

+    $item = $result->fetch();

     DEBUG($item);

     $acc['autoresponder'] = $item;

   } else {

@@ -108,7 +108,7 @@ function get_vmail_accounts()

 	$uid = (int) $_SESSION['userinfo']['uid'];

 	$result = db_query("SELECT * from mail.v_vmail_accounts WHERE useraccount='{$uid}' ORDER BY domainname,local ASC");

 	$ret = array();

-	while ($line = mysql_fetch_assoc($result))

+	while ($line = $result->fetch())

 	{

 		array_push($ret, $line);

 	}

@@ -122,10 +122,10 @@ function get_vmail_domains()

 {

 	$uid = (int) $_SESSION['userinfo']['uid'];

 	$result = db_query("SELECT id, domainname, server FROM mail.v_vmail_domains WHERE useraccount='{$uid}' ORDER BY domainname");

-	if (mysql_num_rows($result) == 0)

+	if ($result->rowCount() == 0)

 		system_failure('Sie haben keine Domains für virtuelle Mail-Verarbeitung');

 	$ret = array();

-	while ($tmp = mysql_fetch_assoc($result))

+	while ($tmp = $result->fetch())

 		array_push($ret, $tmp);

 	return $ret;

 }

@@ -133,7 +133,7 @@ function get_vmail_domains()

 function find_account_id($accname)

 {

-  $accname = mysql_real_escape_string($accname);

+  $accname = db_escape_string($accname);

   DEBUG($accname);

   $tmp = explode('@', $accname, 2);

   DEBUG($tmp);

@@ -142,9 +142,9 @@ function find_account_id($accname)

   list( $local, $domainname) = $tmp;

   $result = db_query("SELECT id FROM mail.v_vmail_accounts WHERE local='{$local}' AND domainname='{$domainname}' LIMIT 1");

-  if (mysql_num_rows($result) == 0)

+  if ($result->rowCount() == 0)

     system_failure("Der Account konnte nicht gefunden werden");

-  $tmp = mysql_fetch_array($result);

+  $tmp = $result->fetch();

   return $tmp[0];

 }

@@ -152,7 +152,7 @@ function find_account_id($accname)

 function change_vmail_password($accname, $newpass)

 {

   $accid = find_account_id($accname);

-  $encpw = mysql_real_escape_string(encrypt_mail_password($newpass));

+  $encpw = db_escape_string(encrypt_mail_password($newpass));

   db_query("UPDATE mail.vmail_accounts SET password='{$encpw}' WHERE id={$accid} LIMIT 1;");

 }

@@ -177,7 +177,7 @@ function get_max_mailboxquota($server, $oldquota) {

   $uid = (int) $_SESSION['userinfo']['uid'];

   $server = (int) $server;

   $result = db_query("SELECT systemquota - (COALESCE(systemquota_used,0) + COALESCE(mailquota,0)) AS free FROM system.v_quota WHERE uid='{$uid}' AND server='{$server}'");

-  $item = mysql_fetch_assoc($result);

+  $item = $result->fetch();