Clean up code for modifying screenshots

sections/torrents/screenshotedit.php

@@ -11,30 +11,27 @@ if (!check_perms('torrents_edit') && !check_perms('screenshots_add') && !check_p
   $DB->query("
     SELECT UserID
     FROM torrents
-    WHERE GroupID = $GroupID");
+    WHERE GroupID = ?", $GroupID);
   if (!in_array($LoggedUser['ID'], $DB->collect('UserID'))) {
     error(403);
   }
 }
 
-$Screenshots = isset($_POST['screenshots']) ? $_POST['screenshots'] : [];
+$Screenshots = $_POST['screenshots'] ?? [];
+$Screenshots = array_map("trim", $Screenshots);
+$Screenshots = array_filter($Screenshots, function($s) {
+  return preg_match('/^'.IMAGE_REGEX.'$/i', $s);
+});
+$Screenshots = array_unique($Screenshots);
 
 if (count($Screenshots) > 10) {
-  error(0);
-}
-
-$ScreenshotsEscaped = [];
-
-foreach ($Screenshots as $i => $Screenshot) {
-  if (!preg_match('/^'.IMAGE_REGEX.'$/i', trim($Screenshot)))
-    error(0);
-  $Screenshots[$i] = db_string(trim($Screenshot));
+  error("You cannot add more than 10 screenshots to a group");
 }
 
 $DB->query("
   SELECT UserID, Image
   FROM torrents_screenshots
-  WHERE GroupID = $GroupID");
+  WHERE GroupID = ?", $GroupID);
 
 // $Old is an array of the form URL => UserID where UserID is the ID of the User who originally uploaded that image.
 $Old = [];
@@ -53,8 +50,6 @@ if (!empty($Old)) {
 
 // Deletion
 if (!empty($Deleted)) {
-  $sql = "DELETE FROM torrents_screenshots WHERE Image IN ('";
-
   if (check_perms('screenshots_delete') || check_perms('torrents_edit')) {
     $DeleteList = $Deleted;
   } else {
@@ -70,29 +65,33 @@ if (!empty($Deleted)) {
   }
 
   if (!empty($DeleteList)) {
-    $sql .= implode("', '", $DeleteList) . "')";
-    $DB->query($sql);
-  }
+    $ScreenDel = '';
+    $DB->prepare_query("DELETE FROM torrents_screenshots WHERE Image = ?", $ScreenDel);
+    foreach ($DeleteList as $ScreenDel) {
+      $DB->exec_prepared_query();
+    }
 
+    Torrents::write_group_log($GroupID, 0, $LoggedUser['ID'], "Deleted screenshot(s) ".implode(' , ', $DeleteList), 0);
+    Misc::write_log("Screenshots ( ".implode(' , ', $DeleteList)." ) deleted from Torrent Group ".$GroupID." by ".$LoggedUser['Username']);
+  }
 }
 
 // New screenshots
-foreach ($New as $Screenshot) {
-  $DB->query("
+if (!empty($New)) {
+  $Screenshot = '';
+  $DB->prepare_query("
     INSERT INTO torrents_screenshots
       (GroupID, UserID, Time, Image)
     VALUES
-      ($GroupID, $LoggedUser[ID], NOW(), '$Screenshot')");
-}
+      (?, ?, NOW(), ?)",
+    $GroupID, $LoggedUser['ID'], $Screenshot);
+  foreach ($New as $Screenshot) {
+    $DB->exec_prepared_query();
+  }
 
-if (!empty($New)) {
   Torrents::write_group_log($GroupID, 0, $LoggedUser['ID'], "Added screenshot(s) ".implode(' , ', $New), 0);
   Misc::write_log("Screenshots ( ".implode(' , ', $New)." ) added to Torrent Group ".$GroupID." by ".$LoggedUser['Username']);
 }
-if (!empty($DeleteList)) {
-  Torrents::write_group_log($GroupID, 0, $LoggedUser['ID'], "Deleted screenshot(s) ".implode(' , ', $DeleteList), 0);
-  Misc::write_log("Screenshots ( ".implode(' , ', $DeleteList)." ) deleted from Torrent Group ".$GroupID." by ".$LoggedUser['Username']);
-}
 
 $Cache->delete_value("torrents_details_".$GroupID);
 header("Location: torrents.php?id=$GroupID");