From 6ac04e29cdacda18e4dcfa72aa3754ef1460b6cd Mon Sep 17 00:00:00 2001
From: Alexey Melnichuk <alexeymelnichuck@gmail.com>
Date: Tue, 22 Nov 2016 21:19:04 +0300
Subject: [PATCH] Add. Use params in vm/message_saved.lua (#2133)

---
 .../resources/functions/message_saved.lua     | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/resources/install/scripts/app/voicemail/resources/functions/message_saved.lua b/resources/install/scripts/app/voicemail/resources/functions/message_saved.lua
index 2604684b29..15bec62635 100644
--- a/resources/install/scripts/app/voicemail/resources/functions/message_saved.lua
+++ b/resources/install/scripts/app/voicemail/resources/functions/message_saved.lua
@@ -30,21 +30,23 @@
 		--flush dtmf digits from the input buffer
 			session:flushDigits();
 		--get the voicemail_uuid
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. voicemail_id ..[[']];
-			status = dbh:query(sql, function(row)
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
+			dbh:query(sql, params, function(row)
 				db_voicemail_uuid = row["voicemail_uuid"];
 			end);
 		--delete from the database
 			sql = [[UPDATE v_voicemail_messages SET message_status = 'saved'
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_uuid = ']] .. db_voicemail_uuid ..[['
-				AND voicemail_message_uuid = ']] .. uuid ..[[']];
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_uuid = :voicemail_uuid
+				AND voicemail_message_uuid = :uuid]];
+			params = {domain_uuid = domain_uuid, voicemail_uuid = db_voicemail_uuid, uuid = uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql);
+			dbh:query(sql, params);
 		--log to console
 			if (debug["info"]) then
 				freeswitch.consoleLog("notice", "[voicemail][saved] id: " .. voicemail_id .. " message: "..uuid.."\n");