Upload 2 files

db.php

@@ -238,6 +238,67 @@ class SQLite_DB {
         return addcslashes($text, '\\%_');
     }
     
+    public function _escape($data) {
+        if (is_array($data)) {
+            return array_map(array($this, '_escape'), $data);
+        }
+        
+        if (is_string($data)) {
+            return addslashes($data);
+        }
+        
+        return $data;
+    }
+    
+    public function _real_escape($data) {
+        if (!is_scalar($data)) {
+            return '';
+        }
+        
+        // For SQLite, we use addslashes as there's no equivalent to mysqli_real_escape_string
+        $escaped = addslashes($data);
+        return $this->add_placeholder_escape($escaped);
+    }
+    
+    public function _weak_escape($data) {
+        if (func_num_args() === 1 && function_exists('_deprecated_function')) {
+            _deprecated_function(__METHOD__, '3.6.0', 'wpdb::prepare() or esc_sql()');
+        }
+        return addslashes($data);
+    }
+    
+    public function escape($data) {
+        if (func_num_args() === 1 && function_exists('_deprecated_function')) {
+            _deprecated_function(__METHOD__, '3.6.0', 'wpdb::prepare() or esc_sql()');
+        }
+        if (is_array($data)) {
+            foreach ($data as $k => $v) {
+                if (is_array($v)) {
+                    $data[$k] = $this->escape($v);
+                } else {
+                    $data[$k] = $this->_weak_escape($v);
+                }
+            }
+        } else {
+            $data = $this->_weak_escape($data);
+        }
+        return $data;
+    }
+    
+    public function add_placeholder_escape($query) {
+        // Replace % with placeholder to prevent SQLi attacks
+        return str_replace('%', $this->placeholder_escape(), $query);
+    }
+    
+    public function placeholder_escape() {
+        static $placeholder;
+        if (!$placeholder) {
+            // Generate a unique placeholder
+            $placeholder = '{' . wp_generate_password(20, false) . '}';
+        }
+        return $placeholder;
+    }
+    
     public function print_error($str = '') {
         global $EZSQL_ERROR;
         

test-php.php

@@ -61,7 +61,7 @@ if (file_exists('/var/www/html/wp-content/db.php')) {
         echo "<p>✓ SQLite_DB class loaded successfully</p>";
         
         // Test required methods
-        $methods = ['set_prefix', 'get_results', 'get_row', 'get_var', 'get_col', 'prepare', 'insert', 'update', 'delete', 'suppress_errors', 'show_errors', 'hide_errors', 'bail', 'timer_start', 'timer_stop', 'get_blog_prefix'];
+        $methods = ['set_prefix', 'get_results', 'get_row', 'get_var', 'get_col', 'prepare', 'insert', 'update', 'delete', 'suppress_errors', 'show_errors', 'hide_errors', 'bail', 'timer_start', 'timer_stop', 'get_blog_prefix', '_escape', '_real_escape', '_weak_escape', 'escape', 'add_placeholder_escape', 'placeholder_escape'];
         foreach ($methods as $method) {
             if (method_exists($test_db, $method)) {
                 echo "<p style='color: green;'>✓ Method $method exists</p>";
@@ -112,7 +112,7 @@ if ($db->ready) {
     $option_count = $db->get_var("SELECT COUNT(*) FROM {$db->prefix}options");
     echo "<p>Total options in database: $option_count</p>";
     
-    $test_options = array('siteurl', 'home', 'blogname', 'admin_email');
+    $test_options = array('siteurl', 'home', 'blogname', 'blogdescription', 'users_can_register', 'admin_email');
     foreach ($test_options as $option) {
         $value = $db->get_var($db->prepare("SELECT option_value FROM {$db->prefix}options WHERE option_name = %s", $option));
         if ($value !== null) {
@@ -121,6 +121,22 @@ if ($db->ready) {
             echo "<p style='color: red;'>✗ Option '$option' not found</p>";
         }
     }
+    
+    echo "<h3>Escape Methods Test</h3>";
+    // Test escape methods
+    $test_string = "Test's \"quoted\" string with % symbols";
+    $test_array = array('key1' => "value's", 'key2' => 'value"with"quotes');
+    
+    echo "<p><strong>Original string:</strong> " . htmlspecialchars($test_string) . "</p>";
+    echo "<p><strong>_escape():</strong> " . htmlspecialchars($db->_escape($test_string)) . "</p>";
+    echo "<p><strong>_real_escape():</strong> " . htmlspecialchars($db->_real_escape($test_string)) . "</p>";
+    echo "<p><strong>_weak_escape():</strong> " . htmlspecialchars($db->_weak_escape($test_string)) . "</p>";
+    
+    echo "<p><strong>Array escape test:</strong></p>";
+    $escaped_array = $db->_escape($test_array);
+    foreach ($escaped_array as $key => $value) {
+        echo "<p style='margin-left: 20px;'>$key: " . htmlspecialchars($value) . "</p>";
+    }
 } else {
     echo "<p style='color: red;'>✗ Database connection failed</p>";
 }