From b9528c5cba0fd0311683866001736f8965a69081 Mon Sep 17 00:00:00 2001
From: Ori Avtalion <ori@avtalion.name>
Date: Tue, 10 Dec 2024 09:48:12 +0200
Subject: [PATCH] Use bind parameters in dbTagList query, remove loop

---
 www/viewgame | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/www/viewgame b/www/viewgame
index f40a8a8b..f3312b48 100644
--- a/www/viewgame
+++ b/www/viewgame
@@ -2731,32 +2731,28 @@ if ($embargoCnt > 0)
 <script type="module" nonce="<?php global $nonce; echo $nonce; ?>">
 import {initTagTable} from './viewgame.js';
 
-var dbTagList = [
-<?php
-        $isMine = ($curuser
-                   ? "sum(userid = '$curuser' and gameid = '$qid')"
-                   : "0");
-        $result = mysql_query(
+var dbTagList = <?php
+        if ($curuser) {
+            $isMine = "cast(sum(userid = ? and gameid = ?) as int)";
+            $isMineParams = [$curuser, $id];
+        } else {
+            $isMine = "0";
+            $isMineParams = [];
+        }
+        $result = mysqli_execute_query($db,
             "select
                tag,
-               sum(gameid = '$qid') as tagcnt,
+               cast(sum(gameid = ?) as int) as tagcnt,
                count(distinct gameid) as gamecnt,
                $isMine as isMine
              from gametags
-             where tag in (select tag from gametags where gameid = '$qid')
+             where tag in (select tag from gametags where gameid = ?)
              group by tag
-             order by tag", $db);
-        $cnt = mysql_num_rows($result);
-
-        for ($i = 0 ; $i < $cnt ; $i++) {
-            list($tag, $tagcnt, $gamecnt, $isMine) = mysql_fetch_row($result);
-            $tag = jsSpecialChars($tag);
-            echo ($i > 0 ? "," : "")
-                . "{tag: \"$tag\", tagcnt: $tagcnt, "
-                . "gamecnt: $gamecnt, isMine: $isMine}";
-        }
+             order by tag", [$id, ...$isMineParams, $id]);
+
+        echo json_encode(mysqli_fetch_all($result, MYSQLI_ASSOC));
 ?>
-];
+;
 
 initTagTable("<?php echo $id ?>", dbTagList, <?php echo $adminPriv ?>);
 //-->