plugins/note: use PDO

plugins/note/init.php

@@ -1,5 +1,7 @@
 <?php
 class Note extends Plugin {
+
+	/* @var PluginHost $host */
 	private $host;
 
 	function about() {
@@ -27,12 +29,15 @@ class Note extends Plugin {
 	}
 
 	function edit() {
-		$param = db_escape_string($_REQUEST['param']);
+		$param = $_REQUEST['param'];
+
+		$sth = $this->pdo->prepare("SELECT note FROM ttrss_user_entries WHERE
+			ref_id = ? AND owner_uid = ?");
+		$sth->execute([$param, $_SESSION['uid']]);
 
-		$result = db_query("SELECT note FROM ttrss_user_entries WHERE
+		if ($row = $sth->fetch()) {
-			ref_id = '$param' AND owner_uid = " . $_SESSION['uid']);
 
-		$note = db_fetch_result($result, 0, "note");
+			$note = $row['note'];
 
 			print_hidden("id", "$param");
 			print_hidden("op", "pluginhandler");
@@ -46,6 +51,8 @@ class Note extends Plugin {
 				name='note'>$note</textarea>";
 			print "</td></tr></table>";
 
+		}
+
 		print "<div class='dlgButtons'>";
 		print "<button dojoType=\"dijit.form.Button\"
 			onclick=\"dijit.byId('editNoteDlg').execute()\">".__('Save')."</button> ";
@@ -56,11 +63,12 @@ class Note extends Plugin {
 	}
 
 	function setNote() {
-		$id = db_escape_string($_REQUEST["id"]);
+		$id = $_REQUEST["id"];
-		$note = trim(strip_tags(db_escape_string($_REQUEST["note"])));
+		$note = trim(strip_tags($_REQUEST["note"]));
 
-		db_query("UPDATE ttrss_user_entries SET note = '$note'
+		$sth = $this->pdo->prepare("UPDATE ttrss_user_entries SET note = ?
-			WHERE ref_id = '$id' AND owner_uid = " . $_SESSION["uid"]);
+			WHERE ref_id = ? AND owner_uid = ?");
+		$sth->execute([$note, $id, $_SESSION['uid']]);
 
 		$formatted_note = Article::format_article_note($id, $note);