Improve security on the lua scripts, add lua json library, add *77 dnd toggle feature code, speed dial *0[ext], and improve blf support for extension number alias.

resources/install/scripts/app/agent_status/index.lua

@@ -6,8 +6,14 @@
 	debug["sql"] = true;
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --set the api
 	api = freeswitch.API();
@@ -66,14 +72,19 @@
 	end
 
 --get the agent password
-	sql = "SELECT * FROM v_call_center_agents ";
-	sql = sql .. "WHERE domain_uuid = '" .. domain_uuid .."' ";
-	sql = sql .. "AND agent_id = '" .. agent_id .."' ";
+	local params = {domain_uuid = domain_uuid, agent_id = agent_id}
+	local sql = "SELECT * FROM v_call_center_agents ";
+	sql = sql .. "WHERE domain_uuid = :domain_uuid ";
+	sql = sql .. "AND agent_id = :agent_id ";
 	if (agent_authorized ~= 'true') then
-		sql = sql .. "AND agent_password = '" .. agent_password .."' ";
+		sql = sql .. "AND agent_password = :agent_password ";
+		params.agent_password = agent_password;
 	end
-	freeswitch.consoleLog("notice", "[user status] sql: " .. sql .. "\n");
-	dbh:query(sql, function(row)
+	if (debug["sql"]) then
+		freeswitch.consoleLog("notice", "[user status] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+	end
+
+	dbh:query(sql, params, function(row)
 		--set the variables
 			agent_name = row.agent_name;
 			agent_id = row.agent_id;
@@ -91,13 +102,14 @@
 
 --get the user_uuid
 	if (agent_authorized == 'true') then
-		sql = "SELECT user_uuid, user_status FROM v_users ";
-		sql = sql .. "WHERE username = '".. agent_name .."' ";
-		sql = sql .. "AND domain_uuid = '" .. domain_uuid .."' ";
+		local sql = "SELECT user_uuid, user_status FROM v_users ";
+		sql = sql .. "WHERE username = :agent_name ";
+		sql = sql .. "AND domain_uuid = :domain_uuid ";
+		local params = {agent_name = agent_name, domain_uuid = domain_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("NOTICE", "[call_center] sql: ".. sql .. "\n");
+			freeswitch.consoleLog("notice", "[call_center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--get the user info
 				user_uuid = row.user_uuid;
 				user_status = row.user_status;
@@ -113,13 +125,14 @@
 				freeswitch.consoleLog("NOTICE", "[call_center] user_status: ".. status .. "\n");
 
 			--set the user_status in the users table
-				sql = "UPDATE v_users SET ";
-				sql = sql .. "user_status = '"..status.."' ";
-				sql = sql .. "WHERE user_uuid = '" .. user_uuid .."' ";
+				local sql = "UPDATE v_users SET ";
+				sql = sql .. "user_status = :status ";
+				sql = sql .. "WHERE user_uuid = :user_uuid ";
+				local params = {status = status, user_uuid = user_uuid};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("NOTICE", "[call_center] sql: ".. sql .. "\n");
+					freeswitch.consoleLog("notice", "[call_center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				dbh:query(sql);
+				dbh:query(sql, params);
 
 			--send a login or logout to mod_callcenter
 				cmd = "callcenter_config agent set status "..agent_name.."@"..domain_name.." '"..status.."'";
@@ -166,6 +179,16 @@
 		status = "Invalid ID or Password";
 	end
 
+--set the status and presence
+	if (session:ready()) then
+		if (action == "login") then
+			session:execute("playback", sounds_dir.."/ivr/ivr-you_are_now_logged_in.wav");
+		end
+		if (action == "logout") then
+			session:execute("playback", sounds_dir.."/ivr/ivr-you_are_now_logged_out.wav");
+		end
+	end
+
 --send the status to the display
 	if (status ~= nil) then
 		reply = api:executeString("uuid_display "..uuid.." '"..status.."'");
@@ -175,15 +198,3 @@
 	if (session:ready()) then
 		session:execute("sleep", "2000");
 	end
-
---set the status and presence
-	if (session:ready()) then
-		if (action == "login") then
-			session:execute("playback", sounds_dir.."/ivr/ivr-you_are_now_logged_in.wav");
-			--session:execute("playback", "tone_stream://%(500,0,300,200,100,50,25)");
-		end
-		if (action == "logout") then
-			session:execute("playback", sounds_dir.."/ivr/ivr-you_are_now_logged_out.wav");
-			--session:execute("playback", "tone_stream://%(200,0,500,600,700)");
-		end
-	end

resources/install/scripts/app/call_block/index.lua

@@ -46,12 +46,17 @@ This method causes the script to get its manadatory arguments directly from the
 
 -- Command line parameters
 	local params = {
-			cid_num = string.match(tostring(session:getVariable("caller_id_number")), "%d+"),
-			cid_name = session:getVariable("caller_id_name"),
-			domain_name = session:getVariable("domain_name"),
-			userid = "", -- session:getVariable("id")
-			loglevel = "W" -- Warning, Debug, Info
-			}
+		cid_num = string.match(tostring(session:getVariable("caller_id_number")), "%d+"),
+		cid_name = session:getVariable("caller_id_name"),
+		domain_name = session:getVariable("domain_name"),
+		userid = "", -- session:getVariable("id")
+		loglevel = "W" -- Warning, Debug, Info
+		}
+
+--check if cid_num is numeric
+	if (tonumber(params["cid_num"]) == nil) then
+		return
+	end
 
 -- local storage
 	local sql = nil
@@ -88,8 +93,8 @@ This method causes the script to get its manadatory arguments directly from the
 	--if not cached then get the information from the database
 	if (cache == "-ERR NOT FOUND") then
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			Database = require "resources.functions.database";
+			dbh = Database.new('system');
 
 		--log if not connect
 			if dbh:connected() == false then
@@ -99,14 +104,14 @@ This method causes the script to get its manadatory arguments directly from the
 		--check if the the call block is blocked
 			sql = "SELECT * FROM v_call_block as c "
 			sql = sql .. "JOIN v_domains as d ON c.domain_uuid=d.domain_uuid "
-			sql = sql .. "WHERE c.call_block_number = '" .. params["cid_num"] .. "' AND d.domain_name = '" .. params["domain_name"] .."'"
-			status = dbh:query(sql, function(rows)
+			sql = sql .. "WHERE c.call_block_number = :cid_num AND d.domain_name = :domain_name "
+			dbh:query(sql, params, function(rows)
 				found_cid_num = rows["call_block_number"];
 				found_uuid = rows["call_block_uuid"];
 				found_enabled = rows["call_block_enabled"];
 				found_action = rows["call_block_action"];
 				found_count = rows["call_block_count"];
-				end)
+			end)
 			-- dbh:affected_rows() doesn't do anything if using core:db so this is the workaround:
 
 		--set the cache
@@ -171,7 +176,9 @@ This method causes the script to get its manadatory arguments directly from the
 				k = k + 1
 			end
 			if (source == "database") then
-				dbh:query("UPDATE v_call_block SET call_block_count = " .. found_count + 1 .. " WHERE call_block_uuid = '" .. found_uuid .. "'")
+				dbh:query("UPDATE v_call_block SET call_block_count = :call_block_count WHERE call_block_uuid = :call_block_uuid",{
+					call_block_count = found_count + 1, call_block_uuid = found_uuid
+				})
 			end
 			session:execute("set", "call_blocked=true");
 			logger("W", "NOTICE", "number " .. params["cid_num"] .. " blocked with " .. found_count .. " previous hits, domain_name: " .. params["domain_name"])

resources/install/scripts/app/conference_center/index.lua

@@ -37,8 +37,14 @@
 	debug["sql"] = false;
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --prepare the api object
 	api = freeswitch.API();
@@ -80,11 +86,11 @@
 					end
 
 				--get the moderator_pin
-					sql = [[SELECT moderator_pin FROM v_meetings
-					WHERE meeting_uuid = ']] .. meeting_uuid ..[[']];
-					freeswitch.consoleLog("notice", "[voicemail] sql: " .. sql .. "\n");
-					status = dbh:query(sql, function(row)
-					moderator_pin = string.lower(row["moderator_pin"]);
+					local sql = "SELECT moderator_pin FROM v_meetings WHERE meeting_uuid = :meeting_uuid";
+					local params = {meeting_uuid = meeting_uuid}
+					freeswitch.consoleLog("notice", "[voicemail] sql: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+					dbh:query(sql, params, function(row)
+						moderator_pin = string.lower(row["moderator_pin"]);
 					end);
 
 				--get the link_address
@@ -159,19 +165,19 @@
 			end_epoch = os.time();
 
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			dbh = Database.new('system');
 
 		--get the conference sessions
 			if (conference_session_uuid) then
-				sql = [[SELECT count(*) as num_rows
+				local sql = [[SELECT count(*) as num_rows
 					FROM v_conference_sessions
-					WHERE conference_session_uuid = ']] .. conference_session_uuid ..[[']];
-				status = dbh:query(sql, function(row)
-				num_rows = string.lower(row["num_rows"]);
+					WHERE conference_session_uuid = :conference_session_uuid]];
+				local params = {conference_session_uuid = conference_session_uuid};
+				dbh:query(sql, params, function(row)
+					num_rows = string.lower(row["num_rows"]);
 				end);
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. " Rows: "..num_rows.."\n");
+					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "; Rows: "..num_rows.."\n");
 				end
 				if (tonumber(num_rows) == 0) then
 					local sql = {}
@@ -191,22 +197,35 @@
 					table.insert(sql, ") ");
 					table.insert(sql, "VALUES ");
 					table.insert(sql, "( ");
-					table.insert(sql, "'".. conference_session_uuid .."', ");
-					table.insert(sql, "'".. domain_uuid .."', ");
-					table.insert(sql, "'".. meeting_uuid .."', ");
+					table.insert(sql, ":conference_session_uuid, ");
+					table.insert(sql, ":domain_uuid, ");
+					table.insert(sql, ":meeting_uuid, ");
 					--if (conference_recording) then
-					--	table.insert(sql, "'".. conference_recording .."', ");
+					--	table.insert(sql, ":conference_recording, ");
 					--end
 					--if (wait_mod) then
-					--	table.insert(sql, "'".. wait_mod .."', ");
+					--	table.insert(sql, ":wait_mod, ");
 					--end
-					--table.insert(sql, "'".. start_epoch .."', ");
-					table.insert(sql, "'".. profile .."' ");
+					--table.insert(sql, ":start_epoch, ");
+					table.insert(sql, ":profile ");
 					table.insert(sql, ") ");
-					SQL_STRING = table.concat(sql, "\n");
-					dbh:query(SQL_STRING);
+
+					sql = table.concat(sql, "\n");
+
+					local params = {
+						conference_session_uuid = conference_session_uuid;
+						domain_uuid = domain_uuid;
+						meeting_uuid = meeting_uuid;
+						-- conference_recording = conference_recording;
+						-- wait_mod = wait_mod;
+						-- start_epoch = start_epoch;
+						profile = profile;
+					};
+
+					dbh:query(sql, params);
+
 					if (debug["sql"]) then
-						freeswitch.consoleLog("notice", "[conference center] SQL: " .. SQL_STRING .. "\n");
+						freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 					end
 				end
 			end
@@ -233,23 +252,37 @@
 				table.insert(sql, ") ");
 				table.insert(sql, "VALUES ");
 				table.insert(sql, "( ");
-				table.insert(sql, "'".. conference_session_detail_uuid .."', ");
-				table.insert(sql, "'".. domain_uuid .."', ");
-				table.insert(sql, "'".. conference_session_uuid .."', ");
-				table.insert(sql, "'".. meeting_uuid .."', ");
-				table.insert(sql, "'".. username .."', ");
-				table.insert(sql, "'".. caller_id_name .."', ");
-				table.insert(sql, "'".. caller_id_number .."', ");
-				table.insert(sql, "'".. network_addr .."', ");
-				table.insert(sql, "'".. uuid .."', ");
+				table.insert(sql, ":conference_session_detail_uuid, ");
+				table.insert(sql, ":domain_uuid, ");
+				table.insert(sql, ":conference_session_uuid, ");
+				table.insert(sql, ":meeting_uuid, ");
+				table.insert(sql, ":username, ");
+				table.insert(sql, ":caller_id_name, ");
+				table.insert(sql, ":caller_id_number, ");
+				table.insert(sql, ":network_addr, ");
+				table.insert(sql, ":uuid, ");
 				if (conference_moderator) then
-					table.insert(sql, "'".. conference_moderator .."', ");
+					table.insert(sql, ":conference_moderator, ");
 				end
-				table.insert(sql, "'".. start_epoch .."', ");
-				table.insert(sql, "'".. end_epoch .."' ");
+				table.insert(sql, ":start_epoch, ");
+				table.insert(sql, ":end_epoch ");
 				table.insert(sql, ") ");
-				SQL_STRING = table.concat(sql, "\n");
-				dbh:query(SQL_STRING);
+				sql = table.concat(sql, "\n");
+				local params = {
+					conference_session_detail_uuid = conference_session_detail_uuid;
+					domain_uuid = domain_uuid;
+					conference_session_uuid = conference_session_uuid;
+					meeting_uuid = meeting_uuid;
+					username = username;
+					caller_id_name = caller_id_name;
+					caller_id_number = caller_id_number;
+					network_addr = network_addr;
+					uuid = uuid;
+					conference_moderator = conference_moderator;
+					start_epoch = start_epoch;
+					end_epoch = end_epoch;
+				};
+				dbh:query(sql, params);
 			end
 
 		--if the conference is empty
@@ -258,15 +291,16 @@
 				result = trim(api:executeString(cmd));
 				if (string.sub(result, -9) == "not found") then
 					--get the conference start_epoch
-						sql = [[SELECT start_epoch
+						local sql = [[SELECT start_epoch
 							FROM v_conference_session_details
-							WHERE conference_session_uuid = ']] .. conference_session_uuid ..[['
+							WHERE conference_session_uuid = :conference_session_uuid
 							ORDER BY start_epoch ASC
 							LIMIT 1]];
-						status = dbh:query(sql, function(row)
-						start_epoch = string.lower(row["start_epoch"]);
+						local params = {conference_session_uuid = conference_session_uuid};
+						dbh:query(sql, params, function(row)
+							start_epoch = string.lower(row["start_epoch"]);
 						end);
-						--freeswitch.consoleLog("notice", "[conference center] <conference_start_epoch> sql: " .. sql .. "\n");
+						--freeswitch.consoleLog("notice", "[conference center] <conference_start_epoch> sql: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 
 					--set the conference_recording
 						conference_recording = recordings_dir.."/archive/"..os.date("%Y", start_epoch).."/"..os.date("%b", start_epoch).."/"..os.date("%d", start_epoch) .."/"..conference_session_uuid;
@@ -274,15 +308,21 @@
 					--conference has ended set the end_epoch
 						local sql = {}
 						table.insert(sql, "update v_conference_sessions set ");
-						table.insert(sql, "recording = '".. conference_recording .."', ");
-						table.insert(sql, "start_epoch = '".. start_epoch .."', ");
-						table.insert(sql, "end_epoch = '".. end_epoch .."' ");
-						table.insert(sql, "where conference_session_uuid = '"..conference_session_uuid.."' ");
-						SQL_STRING = table.concat(sql, "\n");
+						table.insert(sql, "recording = :conference_recording, ");
+						table.insert(sql, "start_epoch = :start_epoch, ");
+						table.insert(sql, "end_epoch = :end_epoch ");
+						table.insert(sql, "where conference_session_uuid = :conference_session_uuid ");
+						sql = table.concat(sql, "\n");
+						local params = {
+							conference_recording = conference_recording;
+							start_epoch = start_epoch;
+							end_epoch = end_epoch;
+							conference_session_uuid = conference_session_uuid;
+						};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[conference center] SQL: " .. SQL_STRING .. "\n");
+							freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						dbh:query(SQL_STRING);
+						dbh:query(sql, params);
 					--convert the wav to an mp3
 						if (record == "true") then
 							--cmd = "sox "..conference_recording..".wav -r 16000 -c 1 "..conference_recording..".mp3";
@@ -358,21 +398,23 @@
 
 		--get the domain_uuid
 			if (domain_name ~= nil and domain_uuid == nil) then
-				sql = "SELECT domain_uuid FROM v_domains ";
-				sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
+				local sql = "SELECT domain_uuid FROM v_domains ";
+				sql = sql .. "WHERE domain_name = :domain_name ";
+				local params = {domain_name = domain_name};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "\n");
+					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				status = dbh:query(sql, function(rows)
+				dbh:query(sql, params, function(rows)
 					domain_uuid = string.lower(rows["domain_uuid"]);
 				end);
 			end
 
 		--conference center details
-			sql = [[SELECT * FROM v_conference_centers
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND conference_center_extension = ']] .. destination_number .. [[']];
-			status = dbh:query(sql, function(row)
+			local sql = [[SELECT * FROM v_conference_centers
+				WHERE domain_uuid = :domain_uuid
+				AND conference_center_extension = :destination_number]];
+			local params = {domain_uuid = domain_uuid, destination_number = destination_number};
+			dbh:query(sql, params, function(row)
 				conference_center_uuid = string.lower(row["conference_center_uuid"]);
 				conference_center_greeting = row["conference_center_greeting"];
 			end);
@@ -381,29 +423,24 @@
 			end
 
 		--connect to the switch database
-			if (file_exists(database_dir.."/core.db")) then
-				dbh_switch = freeswitch.Dbh("sqlite://"..database_dir.."/core.db");
-				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[conference center] dbh_switch sqlite\n");
-				end
-			else
-				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[conference center] dbh_switch pgsql/mysql\n");
-				end
-				dbh_switch = database_handle('switch');
-			end
+			local dbh_switch = Database.new('switch')
 
 		--check if someone has already joined the conference
 			local_hostname = trim(api:execute("switchname", ""));
 			freeswitch.consoleLog("notice", "[conference center] local_hostname is " .. local_hostname .. "\n");
-			sql = "SELECT hostname FROM channels WHERE application = 'conference' AND dest = '" .. destination_number .. "' AND cid_num <> '".. caller_id_number .."' LIMIT 1";
+			sql = "SELECT hostname FROM channels WHERE application = 'conference' "
+				.. "AND dest = :destination_number AND cid_num <> :caller_id_number LIMIT 1";
+			params = {destination_number = destination_number, caller_id_number = caller_id_number};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			status = dbh_switch:query(sql, function(rows)
+			dbh_switch:query(sql, params, function(rows)
 				conference_hostname = rows["hostname"];
 			end);
 
+		--close the database connection
+			dbh_switch:release();
+
 		--if conference hosntame exist, then we bridge there
 			if (conference_hostname ~= nil) then
 				freeswitch.consoleLog("notice", "[conference center] conference_hostname is " .. conference_hostname .. "\n");
@@ -447,42 +484,46 @@
 						digit_timeout = 5000;
 						pin_number = session:playAndGetDigits(min_digits, max_digits, max_tries, digit_timeout, "#", prompt_audio_file, "", "\\d+");
 					end
-				if (pin_number ~= "") then
-					sql = [[SELECT * FROM v_conference_rooms as r, v_meetings as m
-						WHERE r.domain_uuid = ']] .. domain_uuid ..[['
-						AND r.meeting_uuid = m.meeting_uuid
-						AND m.domain_uuid = ']] .. domain_uuid ..[['
-						AND (m.moderator_pin = ']] .. pin_number ..[[' or m.participant_pin = ']] .. pin_number ..[[')
-						AND r.enabled = 'true'
-						AND m.enabled = 'true'
-						AND (
-								( r.start_datetime <> '' AND r.start_datetime is not null AND r.start_datetime <= ']] .. os.date("%Y-%m-%d %X") .. [[' ) OR
-								( r.start_datetime = '' OR r.start_datetime is null )
-							)
-						AND (
-								( r.stop_datetime <> '' AND r.stop_datetime is not null AND r.stop_datetime > ']] .. os.date("%Y-%m-%d %X") .. [[' ) OR
-								( r.stop_datetime = '' OR r.stop_datetime is null )
-							) ]];
-					if (debug["sql"]) then
-						freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "\n");
+				--use the pin_number to find the conference room
+					if (pin_number ~= "") then
+						local sql = [[SELECT * FROM v_conference_rooms as r, v_meetings as m
+							WHERE r.domain_uuid = :domain_uuid
+							AND r.meeting_uuid = m.meeting_uuid
+							AND m.domain_uuid = :domain_uuid
+							AND (m.moderator_pin = :pin_number or m.participant_pin = :pin_number)
+							AND r.enabled = 'true'
+							AND m.enabled = 'true'
+							AND (
+									( r.start_datetime <> '' AND r.start_datetime is not null AND r.start_datetime <= :timestam ) OR
+									( r.start_datetime = '' OR r.start_datetime is null )
+								)
+							AND (
+									( r.stop_datetime <> '' AND r.stop_datetime is not null AND r.stop_datetime > :timestam ) OR
+									( r.stop_datetime = '' OR r.stop_datetime is null )
+								) ]];
+						local params = {
+							domain_uuid = domain_uuid;
+							pin_number = pin_number;
+							timestam = os.date("%Y-%m-%d %X");
+						};
+						if (debug["sql"]) then
+							freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+						end
+						dbh:query(sql, params, function(row)
+							conference_room_uuid = string.lower(row["conference_room_uuid"]);
+						end);
+					end
+				--if the conference room was not found then return nil
+					if (conference_room_uuid == nil) then
+						return nil;
+					else
+						return pin_number;
 					end
-					status = dbh:query(sql, function(row)
-						conference_room_uuid = string.lower(row["conference_room_uuid"]);
-					end);
-				end
-				if (conference_room_uuid == nil) then
-					return nil;
-				else
-					return pin_number;
-				end
 			end
 
 		--get the pin
 			pin_number = session:getVariable("pin_number");
-			if (not pin_number) then
-				pin_number = nil;
-				pin_number = get_pin_number(domain_uuid, conference_center_greeting);
-			end
+			pin_number = get_pin_number(domain_uuid, conference_center_greeting);
 			if (pin_number == nil) then
 				pin_number = get_pin_number(domain_uuid, conference_center_greeting);
 			end
@@ -495,19 +536,24 @@
 				pin_number = get_pin_number(domain_uuid, conference_center_greeting);
 			end
 			if (pin_number ~= nil) then
-				sql = [[SELECT * FROM v_conference_rooms as r, v_meetings as m
-					WHERE r.domain_uuid = ']] .. domain_uuid ..[['
+				local sql = [[SELECT * FROM v_conference_rooms as r, v_meetings as m
+					WHERE r.domain_uuid = :domain_uuid
 					AND r.meeting_uuid = m.meeting_uuid
-					AND r.conference_center_uuid = ']] .. conference_center_uuid ..[['
-					AND m.domain_uuid = ']] .. domain_uuid ..[['
-					AND (m.moderator_pin = ']] .. pin_number ..[[' or m.participant_pin = ']] .. pin_number ..[[')
+					AND r.conference_center_uuid = :conference_center_uuid
+					AND m.domain_uuid = :domain_uuid
+					AND (m.moderator_pin = :pin_number or m.participant_pin = :pin_number)
 					AND r.enabled = 'true'
 					AND m.enabled = 'true'
-					]];
+				]];
+				local params = {
+					domain_uuid = domain_uuid;
+					conference_center_uuid = conference_center_uuid;
+					pin_number = pin_number;
+				};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "\n");
+					freeswitch.consoleLog("notice", "[conference center] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				status = dbh:query(sql, function(row)
+				dbh:query(sql, params, function(row)
 					conference_room_uuid = string.lower(row["conference_room_uuid"]);
 					meeting_uuid = string.lower(row["meeting_uuid"]);
 					record = string.lower(row["record"]);

resources/install/scripts/app/fax/resources/scripts/hangup_rx.lua

@@ -32,8 +32,14 @@
 	require "resources.functions.config";
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --define the explode function
 	require "resources.functions.explode";
@@ -58,8 +64,8 @@
 --get the domain_uuid using the domain name required for multi-tenant
 	if (domain_name ~= nil) then
 		sql = "SELECT domain_uuid FROM v_domains ";
-		sql = sql .. "WHERE domain_name = '" .. domain_name .. "' ";
-		status = dbh:query(sql, function(rows)
+		sql = sql .. "WHERE domain_name = :domain_name ";
+		dbh:query(sql, {domain_name = domain_name}, function(rows)
 			domain_uuid = rows["domain_uuid"];
 		end);
 	end
@@ -154,13 +160,14 @@
 	end
 
 --get the fax settings from the database
-	sql = [[SELECT * FROM v_fax
-		WHERE fax_uuid = ']] .. fax_uuid ..[['
-		AND domain_uuid = ']] .. domain_uuid ..[[']];
+	local sql = [[SELECT * FROM v_fax
+		WHERE fax_uuid = :fax_uuid
+		AND domain_uuid = :domain_uuid]];
+	local params = {fax_uuid = fax_uuid, domain_uuid = domain_uuid};
 	if (debug["sql"]) then
-		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "\n");
+		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 	end
-	status = dbh:query(sql, function(row)
+	dbh:query(sql, params, function(row)
 		dialplan_uuid = row["dialplan_uuid"];
 		fax_extension = row["fax_extension"];
 		fax_accountcode = row["accountcode"];
@@ -247,57 +254,72 @@
 	sql = sql .. ") ";
 	sql = sql .. "values ";
 	sql = sql .. "(";
-	sql = sql .. "'"..uuid.."', ";
-	sql = sql .. "'"..domain_uuid.."', ";
+	sql = sql .. ":uuid, ";
+	sql = sql .. ":domain_uuid, ";
 	if (fax_uuid ~= nil) then
-		sql = sql .. "'"..fax_uuid.."', ";
+		sql = sql .. ":fax_uuid, ";
 	end
-	sql = sql .. "'"..fax_success.."', ";
-	sql = sql .. "'"..fax_result_code .."', ";
-	sql = sql .. "'"..fax_result_text.."', ";
-	sql = sql .. "'"..fax_file.."', ";
+	sql = sql .. ":fax_success, ";
+	sql = sql .. ":fax_result_code, ";
+	sql = sql .. ":fax_result_text, ";
+	sql = sql .. ":fax_file, ";
 	if (fax_ecm_used ~= nil) then
-		sql = sql .. "'"..fax_ecm_used.."', ";
+		sql = sql .. ":fax_ecm_used, ";
 	end
 	if (fax_local_station_id ~= nil) then
-		sql = sql .. "'"..fax_local_station_id.."', ";
-	end
-	if (fax_document_transferred_pages == nil) then
-		sql = sql .. "'0', ";
-	else
-		sql = sql .. "'"..fax_document_transferred_pages.."', ";
-	end
-	if (fax_document_total_pages == nil) then
-		sql = sql .. "'0', ";
-	else
-		sql = sql .. "'"..fax_document_total_pages.."', ";
+		sql = sql .. ":fax_local_station_id, ";
 	end
+	sql = sql .. ":fax_document_transferred_pages, ";
+	sql = sql .. ":fax_document_total_pages, ";
 	if (fax_image_resolution ~= nil) then
-		sql = sql .. "'"..fax_image_resolution.."', ";
+		sql = sql .. ":fax_image_resolution, ";
 	end
 	if (fax_image_size ~= nil) then
-		sql = sql .. "'"..fax_image_size.."', ";
+		sql = sql .. ":fax_image_size, ";
 	end
 	if (fax_bad_rows ~= nil) then
-		sql = sql .. "'"..fax_bad_rows.."', ";
+		sql = sql .. ":fax_bad_rows, ";
 	end
 	if (fax_transfer_rate ~= nil) then
-		sql = sql .. "'"..fax_transfer_rate.."', ";
+		sql = sql .. ":fax_transfer_rate, ";
 	end
 	if (fax_uri ~= nil) then
-		sql = sql .. "'"..fax_uri.."', ";
+		sql = sql .. ":fax_uri, ";
 	end
 	if (database["type"] == "sqlite") then
-		sql = sql .. "'"..os.date("%Y-%m-%d %X").."', ";
+		sql = sql .. ":fax_date, ";
 	else
 		sql = sql .. "now(), ";
 	end
-	sql = sql .. "'"..os.time().."' ";
+	sql = sql .. ":fax_time ";
 	sql = sql .. ")";
+
+	local params = {
+		uuid = uuid;
+		domain_uuid = domain_uuid;
+		fax_uuid = fax_uuid;
+		fax_success = fax_success;
+		fax_result_code = fax_result_code;
+		fax_result_text = fax_result_text;
+		fax_file = fax_file;
+		fax_ecm_used = fax_ecm_used;
+		fax_local_station_id = fax_local_station_id;
+		fax_document_transferred_pages = fax_document_transferred_pages or '0';
+		fax_document_total_pages = fax_document_total_pages or '0';
+		fax_image_resolution = fax_image_resolution;
+		fax_image_size = fax_image_size;
+		fax_bad_rows = fax_bad_rows;
+		fax_transfer_rate = fax_transfer_rate;
+		fax_uri = fax_uri;
+		fax_date = os.date("%Y-%m-%d %X");
+		fax_time = os.time();
+	};
+
 	if (debug["sql"]) then
-		freeswitch.consoleLog("notice", "[fax] "..sql.."\n");
+		freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 	end
-	dbh:query(sql);
+
+	dbh:query(sql, params);
 
 --add the fax files
 	if (fax_success ~= nil) then
@@ -333,39 +355,49 @@
 			table.insert(sql, ") ");
 			table.insert(sql, "values ");
 			table.insert(sql, "(");
-			table.insert(sql, "'" .. uuid .. "', ");
-			table.insert(sql, "'" .. fax_uuid .. "', ");
+			table.insert(sql, ":uuid, ");
+			table.insert(sql, ":fax_uuid, ");
 			table.insert(sql, "'rx', ");
 			table.insert(sql, "'tif', ");
-			table.insert(sql, "'" .. fax_file .. "', ");
+			table.insert(sql, ":fax_file, ");
 			if (caller_id_name ~= nil) then
-				table.insert(sql, "'" .. caller_id_name .. "', ");
+				table.insert(sql, ":caller_id_name, ");
 			end
 			if (caller_id_number ~= nil) then
-				table.insert(sql, "'" .. caller_id_number .. "', ");
+				table.insert(sql, ":caller_id_number, ");
 			end
 			if (database["type"] == "sqlite") then
-				table.insert(sql, "'"..os.date("%Y-%m-%d %X").."', ");
+				table.insert(sql, ":fax_date, ");
 			else
 				table.insert(sql, "now(), ");
 			end
-			table.insert(sql, "'" .. os.time() .. "', ");
+			table.insert(sql, ":fax_time, ");
 			if (storage_type == "base64") then
-				table.insert(sql, "'" .. fax_base64 .. "', ");
+				table.insert(sql, ":fax_base64, ");
 			end
-			table.insert(sql, "'" .. domain_uuid .. "'");
+			table.insert(sql, ":domain_uuid");
 			table.insert(sql, ")");
 			sql = table.concat(sql, "\n");
+			local params = {
+				uuid = uuid;
+				domain_uuid = domain_uuid;
+				fax_uuid = fax_uuid;
+				fax_file = fax_file;
+				caller_id_name = caller_id_name;
+				caller_id_number = caller_id_number;
+				fax_base64 = fax_base64;
+				fax_date = os.date("%Y-%m-%d %X");
+				fax_time = os.time();
+			};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[fax] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
 			if (storage_type == "base64") then
-				local Database = require "resources.functions.database"
 				local dbh = Database.new('system', 'base64');
-				dbh:query(sql);
+				dbh:query(sql, params);
 				dbh:release();
 			else
-				result = dbh:query(sql);
+				result = dbh:query(sql, params);
 			end
 		end
 	end

resources/install/scripts/app/fax/resources/scripts/queue/retry.lua

@@ -9,6 +9,12 @@
 	local Tasks     = require "app.fax.resources.scripts.queue.tasks"
 	local send_mail = require "resources.functions.send_mail"
 
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
+
 	local fax_task_uuid  = env:getHeader('fax_task_uuid')
 	if not fax_task_uuid then
 		log.warning("No [fax_task_uuid] channel variable")
@@ -204,42 +210,49 @@
 			"fax_retry_limit";
 			"fax_retry_sleep";
 			"fax_uri";
-			"fax_date";
 			"fax_epoch";
 		}
 
-		local values = {
-			"'"..uuid .. "'";
-			"'"..domain_uuid .. "'";
-			opt(fax_uuid);
-			opt(fax_success);
-			opt(fax_result_code);
-			opt(fax_result_text);
-			opt(fax_file);
-			opt(fax_ecm_used);
-			opt(fax_local_station_id);
-			opt(fax_document_transferred_pages, "'0'");
-			opt(fax_document_total_pages, "'0'");
-			opt(fax_image_resolution);
-			opt(fax_image_size);
-			opt(fax_bad_rows);
-			opt(fax_transfer_rate);
-			opt(fax_retry_attempts);
-			opt(fax_retry_limit);
-			opt(fax_retry_sleep);
-			opt(fax_uri);
-			now_sql();
-			"'"..os.time().."' ";
+		local params = {
+			fax_log_uuid                   = uuid;
+			domain_uuid                    = domain_uuid;
+			fax_uuid                       = fax_uuid or dbh.NULL;
+			fax_success                    = fax_success or dbh.NULL;
+			fax_result_code                = fax_result_code or dbh.NULL;
+			fax_result_text                = fax_result_text or dbh.NULL;
+			fax_file                       = fax_file or dbh.NULL;
+			fax_ecm_used                   = fax_ecm_used or dbh.NULL;
+			fax_local_station_id           = fax_local_station_id or dbh.NULL;
+			fax_document_transferred_pages = fax_document_transferred_pages or "'0'";
+			fax_document_total_pages       = fax_document_total_pages or "'0'";
+			fax_image_resolution           = fax_image_resolution or dbh.NULL;
+			fax_image_size                 = fax_image_size or dbh.NULL;
+			fax_bad_rows                   = fax_bad_rows or dbh.NULL;
+			fax_transfer_rate              = fax_transfer_rate or dbh.NULL;
+			fax_retry_attempts             = fax_retry_attempts or dbh.NULL;
+			fax_retry_limit                = fax_retry_limit or dbh.NULL;
+			fax_retry_sleep                = fax_retry_sleep or dbh.NULL;
+			fax_uri                        = fax_uri or dbh.NULL;
+			fax_epoch                      = os.time();
 		}
 
-		local sql = "insert into v_fax_logs(" .. table.concat(fields, ",") .. ")" ..
-			"values(" .. table.concat(values, ",") .. ")"
+		local values = ":" .. table.concat(fields, ",:")
+		fields = table.concat(fields, ",") .. ",fax_date"
 
-		if (debug["sql"]) then
-			log.noticef("SQL: %s", sql);
+		if database["type"] == "sqlite" then
+			params.fax_date = os.date("%Y-%m-%d %X");
+			values = values .. ",:fax_date"
+		else
+			values = values .. ",now()"
 		end
 
-		dbh:query(sql);
+		local sql = "insert into v_fax_logs(" .. fields .. ")values(" .. values .. ")"
+
+		if (debug["sql"]) then
+			log.noticef("SQL: %s; params: %s", sql, json.encode(params, dbh.NULL));
+		end
+
+		dbh:query(sql, params);
 	end
 
 -- add the fax files
@@ -259,49 +272,58 @@
 
 	-- build SQL
 		local sql do
-			sql = {
-				"insert into v_fax_files(";
-					"fax_file_uuid";                    ",";
-					"fax_uuid";                         ",";
-					"fax_mode";                         ",";
-					"fax_destination";                  ",";
-					"fax_file_type";                    ",";
-					"fax_file_path";                    ",";
-					"fax_caller_id_name";               ",";
-					"fax_caller_id_number";             ",";
-					"fax_date";                         ",";
-					"fax_epoch";                        ",";
-					"fax_base64";                       ",";
-					"domain_uuid";                      " ";
-				") values (";
-					opt(uuid);                          ",";
-					opt(fax_uuid);                      ",";
-					"'tx'";                             ",";
-					opt(sip_to_user);                   ",";
-					"'tif'";                            ",";
-					opt(fax_file);                      ",";
-					opt(origination_caller_id_name);    ",";
-					opt(origination_caller_id_number);  ",";
-					now_sql();                          ",";
-					"'" .. os.time() .. "'";            ",";
-					opt(fax_base64);                    ",";
-					opt(domain_uuid);                   " ";
-				")"
+
+			local fields = {
+				"fax_file_uuid";
+				"fax_uuid";
+				"fax_mode";
+				"fax_destination";
+				"fax_file_type";
+				"fax_file_path";
+				"fax_caller_id_name";
+				"fax_caller_id_number";
+				"fax_epoch";
+				"fax_base64";
+				"domain_uuid";
 			}
 
-			sql = table.concat(sql, "\n");
-			if (debug["sql"]) then
-				log.noticef("SQL: %s", sql);
-			end
-		end
+			local params = {
+				fax_file_uuid        = uuid;
+				fax_uuid             = fax_uuid or dbh.NULL;
+				fax_mode             = "tx";
+				fax_destination      = sip_to_user or dbh.NULL;
+				fax_file_type        = "tif";
+				fax_file_path        = fax_file or dbh.NULL;
+				fax_caller_id_name   = origination_caller_id_name or dbh.NULL;
+				fax_caller_id_number = origination_caller_id_number or dbh.NULL;
+				fax_epoch            = os.time();
+				fax_base64           = fax_base64 or dbh.NULL;
+				domain_uuid          = domain_uuid or dbh.NULL;
+			}
 
-		if storage_type == "base64" then
-			local Database = require "resources.functions.database"
-			local dbh = Database.new('system', 'base64');
-			dbh:query(sql);
-			dbh:release();
-		else
-			result = dbh:query(sql)
+			local values = ":" .. table.concat(fields, ",:")
+			fields = table.concat(fields, ",") .. ",fax_date"
+
+			if database["type"] == "sqlite" then
+				params.fax_date = os.date("%Y-%m-%d %X");
+				values = values .. ",:fax_date"
+			else
+				values = values .. ",now()"
+			end
+
+			local sql = "insert into v_fax_files(" .. fields .. ")values(" .. values .. ")"
+
+			if (debug["sql"]) then
+				log.noticef("SQL: %s; params: %s", sql, json.encode(params, dbh.NULL));
+			end
+
+			if storage_type == "base64" then
+				local dbh = Database.new('system', 'base64');
+				dbh:query(sql, params);
+				dbh:release();
+			else
+				dbh:query(sql, params)
+			end
 		end
 	end
 
@@ -390,7 +412,7 @@
 					os.remove(fax_file);
 				end
 
-				end
 			end
 		end
+	end
 

resources/install/scripts/app/is_local/index.lua

@@ -29,8 +29,13 @@
 	outbound_caller_id_number = session:getVariable("outbound_caller_id_number");
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --prepare the api object
 	api = freeswitch.API();
@@ -43,13 +48,18 @@
 
 --get the destination number
 	if (cache == "-ERR NOT FOUND") then
-		sql = "SELECT destination_number, destination_context "
+		local dbh = Database.new('system');
+
+		local sql = "SELECT destination_number, destination_context "
 		sql = sql .. "FROM v_destinations "
-		sql = sql .. "WHERE destination_number = '"..destination_number.."' "
+		sql = sql .. "WHERE destination_number = :destination_number "
 		sql = sql .. "AND destination_type = 'inbound' "
 		sql = sql .. "AND destination_enabled = 'true' "
-		--freeswitch.consoleLog("notice", "SQL:" .. sql .. "\n");
-		assert(dbh:query(sql, function(row)
+		local params = {destination_number = destination_number};
+		if (debug["sql"]) then
+			freeswitch.consoleLog("notice", "SQL:" .. sql .. "; params: " .. json.encode(params) .. "\n");
+		end
+		dbh:query(sql, params, function(row)
 
 			--set the outbound caller id
 				if (outbound_caller_id_name ~= nil) then
@@ -77,7 +87,8 @@
 
 			--transfer the call
 				session:transfer(row.destination_number, "XML", row.destination_context);
-		end));
+		end);
+
 	else
 		--add the function
 			require "resources.functions.explode";

resources/install/scripts/app/provision/index.lua

@@ -37,8 +37,14 @@
 	profile = "internal";
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --answer
 	session:answer();
@@ -92,14 +98,15 @@
 
 --get the device uuid for the phone that will have its configuration overridden
 	if (user ~= nil and domain ~= nil and domain_uuid ~= nil) then
-		sql = [[SELECT * FROM v_device_lines ]];
-		sql = sql .. [[WHERE user_id = ']] .. user .. [[' ]];
-		sql = sql .. [[AND server_address = ']]..domain..[[' ]];
-		sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+		local sql = [[SELECT device_uuid FROM v_device_lines ]];
+		sql = sql .. [[WHERE user_id = :user ]];
+		sql = sql .. [[AND server_address = :domain ]];
+		sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+		local params = {user = user, domain = domain, domain_uuid = domain_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+			freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--get device uuid
 			device_uuid = row.device_uuid;
 			freeswitch.consoleLog("NOTICE", "[provision] device_uuid: ".. device_uuid .. "\n");
@@ -109,14 +116,15 @@
 --get the alternate device uuid using the device username and password
 	authorized = 'false';
 	if (user_id ~= nil and password ~= nil and domain_uuid ~= nil) then
-		sql = [[SELECT * FROM v_devices ]];
-		sql = sql .. [[WHERE device_username = ']]..user_id..[[' ]];
-		sql = sql .. [[AND device_password = ']]..password..[[' ]]
-		sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+		local sql = [[SELECT device_uuid FROM v_devices ]];
+		sql = sql .. [[WHERE device_username = :user_id ]];
+		sql = sql .. [[AND device_password = :password ]]
+		sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+		local params = {user_id = user_id, password = password, domain_uuid = domain_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+			freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--get the alternate device_uuid
 				device_uuid_alternate = row.device_uuid;
 				freeswitch.consoleLog("NOTICE", "[provision] alternate device_uuid: ".. device_uuid_alternate .. "\n");
@@ -132,13 +140,14 @@
 
 --this device already has an alternate find the correct device_uuid and then override current one
 	if (authorized == 'true' and action == "login" and device_uuid_alternate ~= nil and device_uuid ~= nil and domain_uuid ~= nil) then
-		sql = [[SELECT * FROM v_devices ]];
-		sql = sql .. [[WHERE device_uuid_alternate = ']]..device_uuid..[[' ]];
-		sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+		local sql = [[SELECT * FROM v_devices ]];
+		sql = sql .. [[WHERE device_uuid_alternate = :device_uuid ]];
+		sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+		local params = {device_uuid = device_uuid, domain_uuid = domain_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+			freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			if (row.device_uuid_alternate ~= nil) then
 				device_uuid = row.device_uuid;
 			end
@@ -147,21 +156,23 @@
 
 --remove the alternate device from another device so that it can be added to this device
 	if (authorized == 'true' and action == "login" and device_uuid_alternate ~= nil and domain_uuid ~= nil) then
-		sql = [[SELECT * FROM v_device_lines ]];
-		sql = sql .. [[WHERE device_uuid = ']]..device_uuid_alternate..[[' ]];
-		sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+		local sql = [[SELECT * FROM v_device_lines ]];
+		sql = sql .. [[WHERE device_uuid = :device_uuid ]];
+		sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+		local params = {device_uuid = device_uuid_alternate, domain_uuid = domain_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+			freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--remove the previous alternate device uuid
-				sql = [[UPDATE v_devices SET device_uuid_alternate = null ]];
-				sql = sql .. [[WHERE device_uuid_alternate = ']]..device_uuid_alternate..[[' ]];
-				sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+				local sql = [[UPDATE v_devices SET device_uuid_alternate = null ]];
+				sql = sql .. [[WHERE device_uuid_alternate = :device_uuid_alternate ]];
+				sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+				local params = {device_uuid_alternate = device_uuid_alternate, domain_uuid = domain_uuid};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+					freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 				end
-				dbh:query(sql);
+				dbh:query(sql, params);
 			--send a sync command to the previous device
 				--create the event notify object
 					local event = freeswitch.Event('NOTIFY');
@@ -183,26 +194,29 @@
 			--send a hangup
 				session:hangup();
 			--add the new alternate
-				sql = [[UPDATE v_devices SET device_uuid_alternate = ']]..device_uuid_alternate..[[']];
-				sql = sql .. [[WHERE device_uuid = ']]..device_uuid..[[' ]];
-				sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+				local sql = [[UPDATE v_devices SET device_uuid_alternate = :device_uuid_alternate ]];
+				sql = sql .. [[WHERE device_uuid = :device_uuid ]];
+				sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+				local params = {device_uuid_alternate = device_uuid_alternate, 
+					device_uuid = device_uuid, domain_uuid = domain_uuid};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+					freeswitch.consoleLog("NOTICE", "[provision] SQL: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 				end
-				dbh:query(sql);
+				dbh:query(sql, params);
 		end
 	end
 
 --remove the override to the device uuid (logout)
 	if (authorized == 'true' and action == "logout") then
 		if (device_uuid_alternate ~= nil and device_uuid ~= nil and domain_uuid ~= nil) then
-			sql = [[UPDATE v_devices SET device_uuid_alternate = null ]];
-			sql = sql .. [[WHERE device_uuid_alternate = ']]..device_uuid..[[' ]];
-			sql = sql .. [[AND domain_uuid = ']]..domain_uuid..[[' ]];
+			local sql = [[UPDATE v_devices SET device_uuid_alternate = null ]];
+			sql = sql .. [[WHERE device_uuid_alternate = :device_uuid ]];
+			sql = sql .. [[AND domain_uuid = :domain_uuid ]];
+			local params = {device_uuid = device_uuid, domain_uuid = domain_uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "\n");
+				freeswitch.consoleLog("NOTICE", "[provision] sql: ".. sql .. "; params: " .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql);
+			dbh:query(sql, params);
 		end
 	end
 

resources/install/scripts/app/ring_groups/index.lua

@@ -30,8 +30,14 @@
 local log = require "resources.functions.log".ring_group
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --include functions
 	require "resources.functions.trim";
@@ -104,8 +110,9 @@ local log = require "resources.functions.log".ring_group
 	ring_group_forward_enabled = "";
 	ring_group_forward_destination = "";
 	sql = "SELECT * FROM v_ring_groups ";
-	sql = sql .. "where ring_group_uuid = '"..ring_group_uuid.."' ";
-	status = dbh:query(sql, function(row)
+	sql = sql .. "where ring_group_uuid = :ring_group_uuid ";
+	local params = {ring_group_uuid = ring_group_uuid};
+	status = dbh:query(sql, params, function(row)
 		domain_uuid = row["domain_uuid"];
 		ring_group_name = row["ring_group_name"];
 		ring_group_extension = row["ring_group_extension"];
@@ -202,19 +209,20 @@ local log = require "resources.functions.log".ring_group
 			session:execute("transfer", ring_group_forward_destination.." XML "..context);
 	else
 		--get the strategy of the ring group, if random, we use random() to order the destinations
-			sql = [[
-					SELECT
-						r.ring_group_strategy
-					FROM
-						v_ring_groups as r
-					WHERE
-						ring_group_uuid = ']]..ring_group_uuid..[['
-						AND r.domain_uuid = ']]..domain_uuid..[['
-						AND r.ring_group_enabled = 'true'
-					]];
+			local sql = [[
+				SELECT
+					r.ring_group_strategy
+				FROM
+					v_ring_groups as r
+				WHERE
+					ring_group_uuid = :ring_group_uuid
+					AND r.domain_uuid = :domain_uuid
+					AND r.ring_group_enabled = 'true'
+			]];
 
+			local params = {ring_group_uuid = ring_group_uuid, domain_uuid = domain_uuid};
 
-			assert(dbh:query(sql, function(row)
+			assert(dbh:query(sql, params, function(row)
 				if (row.ring_group_strategy == "random") then
 					if (database["type"] == "mysql") then
 						sql_order = 'rand()'
@@ -236,16 +244,18 @@ local log = require "resources.functions.log".ring_group
 					v_ring_groups as r, v_ring_group_destinations as d
 				WHERE
 					d.ring_group_uuid = r.ring_group_uuid
-					AND d.ring_group_uuid = ']]..ring_group_uuid..[['
-					AND r.domain_uuid = ']]..domain_uuid..[['
+					AND d.ring_group_uuid = :ring_group_uuid
+					AND r.domain_uuid = :domain_uuid
 					AND r.ring_group_enabled = 'true'
 				ORDER BY
 					]]..sql_order..[[
-				]];
-			--freeswitch.consoleLog("notice", "SQL:" .. sql .. "\n");
+			]];
+			if debug["sql"] then
+				freeswitch.consoleLog("notice", "[ring group] SQL:" .. sql .. "; params:" .. json.encode(params) .. "\n");
+			end
 			destinations = {};
 			x = 1;
-			assert(dbh:query(sql, function(row)
+			assert(dbh:query(sql, params, function(row)
 				if (row.destination_prompt == "1" or row.destination_prompt == "2") then
 					prompt = "true";
 				end
@@ -283,25 +293,29 @@ local log = require "resources.functions.log".ring_group
 		--get the dialplan data and save it to a table
 			if (external) then
 				sql = [[select * from v_dialplans as d, v_dialplan_details as s
-				where (d.domain_uuid = ']] .. domain_uuid .. [[' or d.domain_uuid is null)
-				and d.app_uuid = '8c914ec3-9fc0-8ab5-4cda-6c9288bdc9a3'
-				and d.dialplan_enabled = 'true'
-				and d.dialplan_uuid = s.dialplan_uuid
-				order by
-				d.dialplan_order asc,
-				d.dialplan_name asc,
-				d.dialplan_uuid asc,
-				s.dialplan_detail_group asc,
-				CASE s.dialplan_detail_tag
-				WHEN 'condition' THEN 1
-				WHEN 'action' THEN 2
-				WHEN 'anti-action' THEN 3
-				ELSE 100 END,
-				s.dialplan_detail_order asc ]]
-				--freeswitch.consoleLog("notice", "SQL:" .. sql .. "\n");
+					where (d.domain_uuid = :domain_uuid or d.domain_uuid is null)
+					and d.app_uuid = '8c914ec3-9fc0-8ab5-4cda-6c9288bdc9a3'
+					and d.dialplan_enabled = 'true'
+					and d.dialplan_uuid = s.dialplan_uuid
+					order by
+					d.dialplan_order asc,
+					d.dialplan_name asc,
+					d.dialplan_uuid asc,
+					s.dialplan_detail_group asc,
+					CASE s.dialplan_detail_tag
+					WHEN 'condition' THEN 1
+					WHEN 'action' THEN 2
+					WHEN 'anti-action' THEN 3
+					ELSE 100 END,
+					s.dialplan_detail_order asc
+				]];
+				params = {domain_uuid = domain_uuid};
+				if debug["sql"] then
+					freeswitch.consoleLog("notice", "[ring group] SQL:" .. sql .. "; params:" .. json.encode(params) .. "\n");
+				end
 				dialplans = {};
 				x = 1;
-				assert(dbh:query(sql, function(row)
+				assert(dbh:query(sql, params, function(row)
 					dialplans[x] = row;
 					x = x + 1;
 				end));
@@ -628,10 +642,13 @@ local log = require "resources.functions.log".ring_group
 								--execute the time out action
 									session:execute(ring_group_timeout_app, ring_group_timeout_data);
 							else
-								sql = "SELECT ring_group_timeout_app, ring_group_timeout_data FROM v_ring_groups ";
-								sql = sql .. "where ring_group_uuid = '"..ring_group_uuid.."' ";
-								--freeswitch.consoleLog("notice", "[ring group] SQL:" .. sql .. "\n");
-								dbh:query(sql, function(row)
+								local sql = "SELECT ring_group_timeout_app, ring_group_timeout_data FROM v_ring_groups ";
+								sql = sql .. "where ring_group_uuid = :ring_group_uuid";
+								local params = {ring_group_uuid = ring_group_uuid};
+								if debug["sql"] then
+									freeswitch.consoleLog("notice", "[ring group] SQL:" .. sql .. "; params:" .. json.encode(params) .. "\n");
+								end
+								dbh:query(sql, params, function(row)
 									--send missed call notification
 										missed();
 									--execute the time out action

resources/install/scripts/app/ring_groups/resources/scripts/destination.lua

@@ -27,8 +27,14 @@
 	require "resources.functions.config";
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --set default variables
 	sounds_dir = "";
@@ -105,17 +111,19 @@
 		freeswitch.consoleLog("NOTICE", "[ring_group] menu_selection: "..menu_selection.."\n");
 		if (menu_selection == "1") then
 			--first, check to see if the destination is already in this ring group
-			sql = [[
+			local sql = [[
 				SELECT COUNT(*) AS in_group FROM
 					v_ring_group_destinations
 				WHERE
-					domain_uuid = ']]..domain_uuid..[['
-					AND ring_group_uuid = ']]..ring_group_uuid..[['
-					AND destination_number = ']]..destination..[['
+					domain_uuid = :domain_uuid
+					AND ring_group_uuid = :ring_group_uuid
+					AND destination_number = :destination
 			]];
-			--freeswitch.consoleLog("NOTICE", "[ring_group] SQL "..sql.."\n");
+			local params = {domain_uuid = domain_uuid, ring_group_uuid = ring_group_uuid,
+				destination = destination};
+			--freeswitch.consoleLog("NOTICE", "[ring_group] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
 
-			assert(dbh:query(sql, function(row)
+			assert(dbh:query(sql, params, function(row)
 				if (row.in_group == "0") then
 					sql = [[
 						INSERT INTO
@@ -128,15 +136,26 @@
 									destination_timeout
 								)
 						VALUES
-								(	']]..ring_group_destination_uuid..[[',
-									']]..domain_uuid..[[',
-									']]..ring_group_uuid..[[',
-									']]..destination..[[',
-									]]..destination_delay..[[,
-									]]..destination_timeout..[[
+								(	:ring_group_destination_uuid,
+									:domain_uuid,
+									:ring_group_uuid,
+									:destination,
+									:destination_delay,
+									:destination_timeout
 								)]];
-					freeswitch.consoleLog("NOTICE", "[ring_group][destination] SQL "..sql.."\n");
-					dbh:query(sql);
+
+					params = {
+						ring_group_destination_uuid = ring_group_destination_uuid;
+						domain_uuid = domain_uuid;
+						ring_group_uuid = ring_group_uuid;
+						destination = destination;
+						destination_delay = destination_delay;
+						destination_timeout = destination_timeout;
+						
+					};
+
+					freeswitch.consoleLog("NOTICE", "[ring_group][destination] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
+					dbh:query(sql, params);
 
 					freeswitch.consoleLog("NOTICE", "[ring_group][destination] LOG IN\n");
 					session:streamFile("ivr/ivr-you_are_now_logged_in.wav");
@@ -147,16 +166,18 @@
 			end));
 		end
 		if (menu_selection == "2") then
-			sql = [[
+			local sql = [[
 				DELETE FROM
 					v_ring_group_destinations
 				WHERE
-					domain_uuid =']]..domain_uuid..[['
-					AND ring_group_uuid=']]..ring_group_uuid..[['
-					AND destination_number=']]..destination..[['
+					domain_uuid =:domain_uuid
+					AND ring_group_uuid=:ring_group_uuid
+					AND destination_number=:destination
 				]];
-			freeswitch.consoleLog("NOTICE", "[ring_group][destination] SQL "..sql.."\n");
-			dbh:query(sql);
+			local params = {domain_uuid = domain_uuid, ring_group_uuid = ring_group_uuid,
+				destination = destination};
+			freeswitch.consoleLog("NOTICE", "[ring_group][destination] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
+			dbh:query(sql, params);
 
 			freeswitch.consoleLog("NOTICE", "[ring_group][destination] LOG OUT\n");
 			session:streamFile("ivr/ivr-you_are_now_logged_out.wav");

resources/install/scripts/app/speed_dial/index.lua

@@ -0,0 +1,98 @@
+--	FusionPBX
+--	Version: MPL 1.1
+
+--	The contents of this file are subject to the Mozilla Public License Version
+--	1.1 (the "License"); you may not use this file except in compliance with
+--	the License. You may obtain a copy of the License at
+--	http://www.mozilla.org/MPL/
+
+--	Software distributed under the License is distributed on an "AS IS" basis,
+--	WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+--	for the specific language governing rights and limitations under the
+--	License.
+
+--	The Original Code is FusionPBX
+
+--	The Initial Developer of the Original Code is
+--	Mark J Crane <markjcrane@fusionpbx.com>
+--	Portions created by the Initial Developer are Copyright (C) 2016
+--	the Initial Developer. All Rights Reserved.
+
+-- load config
+	require "resources.functions.config";
+
+--set debug
+	debug["sql"] = true;
+
+--load libraries
+	local log = require "resources.functions.log"["app:dialplan:outbound:speed_dial"]
+	local Database = require "resources.functions.database";
+	local cache = require "resources.functions.cache";
+	local json = require "resources.functions.lunajson";
+
+--get the variables
+	domain_name = session:getVariable("domain_name");
+	domain_uuid = session:getVariable("domain_uuid");
+	context = session:getVariable("context");
+
+--get the argv values
+	destination = argv[2];
+
+-- search in memcache first
+	local key = "app:dialplan:outbound:speed_dial:" .. destination .. "@" .. domain_name
+	local source = "memcache"
+	local value = cache.get(key)
+
+-- decode value from memcache
+	if value then
+		local t = json.decode(value)
+		if not (t and t.phone_number and t.context) then
+			log.warning("can not decode value from memcache: %s", value)
+			value = nil
+		else
+			value = t
+		end
+	end
+
+-- search in database
+	if not value then
+		-- set source flag
+			source = "database"
+
+		-- connect to database
+			local dbh = Database.new('system');
+
+		-- search for the phone number in database using the speed dial
+			local sql = "SELECT phone_number "
+			sql = sql .. "FROM v_contact_phones "
+			sql = sql .. "WHERE phone_speed_dial = :phone_speed_dial "
+			sql = sql .. "AND domain_uuid = :domain_uuid "
+
+			local params = {phone_speed_dial = destination, domain_uuid = domain_uuid};
+
+			if (debug["sql"]) then
+				log.noticef("SQL: %s; params: %s", sql, json.encode(params));
+			end
+
+			local phone_number = dbh:first_value(sql, params)
+
+		-- release database connection
+			dbh:release()
+
+		-- set the cache
+			if phone_number then
+				value = {context = context, phone_number = phone_number}
+				cache.set(key, json.encode(value), expire["speed_dial"])
+			end
+	end
+
+-- transfer
+	if value then
+		--log the result
+			log.noticef("%s XML %s source: %s", destination, context, source)
+
+		--transfer the call
+			session:transfer(value.phone_number, "XML", context);
+	else
+		log.warningf('can not find number: %s in domain: %s', destination, domain_name)
+	end

resources/install/scripts/app/voicemail/index.lua

@@ -50,8 +50,13 @@
 	password_tries = 0;
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library (as global object)
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --set the api
 	api = freeswitch.API();
@@ -69,6 +74,9 @@
 			destination_number = session:getVariable("destination_number");
 			caller_id_name = session:getVariable("caller_id_name");
 			caller_id_number = session:getVariable("caller_id_number");
+			if (string.sub(caller_id_number, 1, 1) == "/") then
+				caller_id_number = string.sub(caller_id_number, 2, -1);
+			end
 			voicemail_greeting_number = session:getVariable("voicemail_greeting_number");
 			skip_instructions = session:getVariable("skip_instructions");
 			skip_greeting = session:getVariable("skip_greeting");
@@ -101,12 +109,13 @@
 				if (domain_uuid == nil) then
 					--get the domain_uuid using the domain name required for multi-tenant
 						if (domain_name ~= nil) then
-							sql = "SELECT domain_uuid FROM v_domains ";
-							sql = sql .. "WHERE domain_name = '" .. domain_name .. "' ";
+							local sql = "SELECT domain_uuid FROM v_domains ";
+							sql = sql .. "WHERE domain_name = :domain_name ";
+							local params = {domain_name = domain_name};
 							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 							end
-							status = dbh:query(sql, function(rows)
+							dbh:query(sql, params, function(rows)
 								domain_uuid = rows["domain_uuid"];
 							end);
 						end
@@ -149,6 +158,17 @@
 					end
 				end
 			end
+
+			if settings['voicemail'] then
+				if settings['voicemail']['voicemail_to_sms'] then
+					voicemail_to_sms = (settings['voicemail']['voicemail_to_sms']['boolean'] == 'true');
+				end
+				if settings['voicemail']['voicemail_to_sms_did'] then
+					voicemail_to_sms_did = settings['voicemail']['voicemail_to_sms_did']['text'];
+				end
+				voicemail_to_sms_did = voicemail_to_sms_did or '';
+			end
+
 			if (not temp_dir) or (#temp_dir == 0) then
 				if (settings['server'] ~= nil) then
 					if (settings['server']['temp'] ~= nil) then
@@ -163,17 +183,19 @@
 			if (voicemail_id ~= nil) then
 				if (session:ready()) then
 					--get the information from the database
-						sql = [[SELECT * FROM v_voicemails
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_id = ']] .. voicemail_id ..[['
+						local sql = [[SELECT * FROM v_voicemails
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_id = :voicemail_id
 							AND voicemail_enabled = 'true' ]];
+						local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql, function(row)
+						dbh:query(sql, params, function(row)
 							voicemail_uuid = string.lower(row["voicemail_uuid"]);
 							voicemail_password = row["voicemail_password"];
 							greeting_id = row["greeting_id"];
+							voicemail_alternate_greet_id = row["voicemail_alternate_greet_id"];
 							voicemail_mail_to = row["voicemail_mail_to"];
 							voicemail_attach_file = row["voicemail_attach_file"];
 							voicemail_local_after_email = row["voicemail_local_after_email"];
@@ -230,6 +252,7 @@
 	require "app.voicemail.resources.functions.listen_to_recording";
 	require "app.voicemail.resources.functions.message_waiting";
 	require "app.voicemail.resources.functions.send_email";
+	require "app.voicemail.resources.functions.send_sms";
 	require "app.voicemail.resources.functions.delete_recording";
 	require "app.voicemail.resources.functions.message_saved";
 	require "app.voicemail.resources.functions.return_call";
@@ -253,11 +276,12 @@
 			debug["info"] = "true";
 
 		--get voicemail message details
-			sql = [[SELECT * FROM v_domains WHERE domain_name = ']] .. domain_name ..[[']]
+			local sql = [[SELECT * FROM v_domains WHERE domain_name = :domain_name]];
+			local params = {domain_name = domain_name};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			status = dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				domain_uuid = string.lower(row["domain_uuid"]);
 			end);
 
@@ -299,13 +323,14 @@
 		--check the voicemail quota
 			if (vm_disk_quota) then
 				--get voicemail message seconds
-					sql = [[SELECT coalesce(sum(message_length), 0) as message_sum FROM v_voicemail_messages
-						WHERE domain_uuid = ']] .. domain_uuid ..[['
-						AND voicemail_uuid = ']] .. voicemail_uuid ..[[']]
-						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-						end
-					status = dbh:query(sql, function(row)
+					local sql = [[SELECT coalesce(sum(message_length), 0) as message_sum FROM v_voicemail_messages
+						WHERE domain_uuid = :domain_uuid
+						AND voicemail_uuid = :voicemail_uuid]]
+					local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+					if (debug["sql"]) then
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+					end
+					dbh:query(sql, params, function(row)
 						message_sum = row["message_sum"];
 					end);
 					if (tonumber(vm_disk_quota) <= tonumber(message_sum)) then
@@ -349,13 +374,14 @@
 
 				--get the voicemail destinations
 					sql = [[select * from v_voicemail_destinations
-					where voicemail_uuid = ']]..voicemail_uuid..[[']]
-					--freeswitch.consoleLog("notice", "[voicemail][destinations] SQL:" .. sql .. "\n");
+					where voicemail_uuid = :voicemail_uuid]]
+					params = {voicemail_uuid=voicemail_uuid};
+					--freeswitch.consoleLog("notice", "[voicemail][destinations] SQL:" .. sql .. "; params:" .. json.encode(params) .. "\n");
 					destinations = {};
 					x = 1;
 					table.insert(destinations, {domain_uuid=domain_uuid,voicemail_destination_uuid=voicemail_uuid,voicemail_uuid=voicemail_uuid,voicemail_uuid_copy=voicemail_uuid});
 					x = x + 1;
-					assert(dbh:query(sql, function(row)
+					assert(dbh:query(sql, params, function(row)
 						destinations[x] = row;
 						x = x + 1;
 					end));
@@ -388,68 +414,90 @@
 								if (storage_type == "base64") then
 									table.insert(sql, "message_base64, ");
 								end
+								if (transcribe_enabled == "true") then
+									table.insert(sql, "message_transcription, ");
+								end
 								table.insert(sql, "message_length ");
 								--table.insert(sql, "message_status, ");
 								--table.insert(sql, "message_priority, ");
 								table.insert(sql, ") ");
 								table.insert(sql, "VALUES ");
 								table.insert(sql, "( ");
-								table.insert(sql, "'"..voicemail_message_uuid.."', ");
-								table.insert(sql, "'"..domain_uuid.."', ");
-								table.insert(sql, "'"..row.voicemail_uuid_copy.."', ");
-								table.insert(sql, "'"..start_epoch.."', ");
-								table.insert(sql, "'"..caller_id_name.."', ");
-								table.insert(sql, "'"..caller_id_number.."', ");
+								table.insert(sql, ":voicemail_message_uuid, ");
+								table.insert(sql, ":domain_uuid, ");
+								table.insert(sql, ":voicemail_uuid, ");
+								table.insert(sql, ":start_epoch, ");
+								table.insert(sql, ":caller_id_name, ");
+								table.insert(sql, ":caller_id_number, ");
 								if (storage_type == "base64") then
-									table.insert(sql, "'"..message_base64.."', ");
+									table.insert(sql, ":message_base64, ");
 								end
-								table.insert(sql, "'"..message_length.."' ");
-								--table.insert(sql, "'"..message_status.."', ");
-								--table.insert(sql, "'"..message_priority.."' ");
+								if (transcribe_enabled == "true") then
+									table.insert(sql,  ":transcription, ");
+								end
+								table.insert(sql, ":message_length ");
+								--table.insert(sql, ":message_status, ");
+								--table.insert(sql, ":message_priority ");
 								table.insert(sql, ") ");
 								sql = table.concat(sql, "\n");
+								local params = {
+									voicemail_message_uuid = voicemail_message_uuid;
+									domain_uuid = domain_uuid;
+									voicemail_uuid = row.voicemail_uuid_copy;
+									start_epoch = start_epoch;
+									caller_id_name = caller_id_name;
+									caller_id_number = caller_id_number;
+									message_base64 = message_base64;
+									transcription = transcription;
+									message_length = message_length;
+									--message_status = message_status;
+									--message_priority = message_priority;
+								};
 								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 								end
 								if (storage_type == "base64") then
 									local Database = require "resources.functions.database"
 									local dbh = Database.new('system', 'base64');
-									dbh:query(sql);
+									dbh:query(sql, params);
 									dbh:release();
 								else
-									dbh:query(sql);
+									dbh:query(sql, params);
 								end
 							end
 
-						--get saved and new message counts
+							local params = {domain_uuid = domain_uuid, voicemail_uuid = row.voicemail_uuid_copy};
+
+						--get new message count
 							sql = [[SELECT count(*) as new_messages FROM v_voicemail_messages
-								WHERE domain_uuid = ']] .. domain_uuid ..[['
-								AND voicemail_uuid = ']] .. row.voicemail_uuid_copy ..[['
+								WHERE domain_uuid = :domain_uuid
+								AND voicemail_uuid = :voicemail_uuid
 								AND (message_status is null or message_status = '') ]];
-								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-								end
-							status = dbh:query(sql, function(result)
+							if (debug["sql"]) then
+								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+							end
+							dbh:query(sql, params, function(result)
 								new_messages = result["new_messages"];
 							end);
+
+						--get saved message count
 							sql = [[SELECT count(*) as saved_messages FROM v_voicemail_messages
-								WHERE domain_uuid = ']] .. domain_uuid ..[['
-								AND voicemail_uuid = ']] .. row.voicemail_uuid_copy ..[['
+								WHERE domain_uuid = :domain_uuid
+								AND voicemail_uuid = :voicemail_uuid
 								AND message_status = 'saved' ]];
-								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-								end
-							status = dbh:query(sql, function(result)
+							if (debug["sql"]) then
+								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+							end
+							dbh:query(sql, params, function(result)
 								saved_messages = result["saved_messages"];
 							end);
 
 						--get the voicemail_id
-							sql = [[SELECT voicemail_id FROM v_voicemails
-								WHERE voicemail_uuid = ']] .. row.voicemail_uuid_copy ..[[']];
-								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-								end
-							status = dbh:query(sql, function(result)
+							sql = [[SELECT voicemail_id FROM v_voicemails WHERE voicemail_uuid = :voicemail_uuid]];
+							if (debug["sql"]) then
+								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+							end
+							dbh:query(sql, params, function(result)
 								voicemail_id_copy = result["voicemail_id"];
 							end);
 
@@ -473,6 +521,9 @@
 						--send the email with the voicemail recording attached
 							if (tonumber(message_length) > 2) then
 								send_email(voicemail_id_copy, voicemail_message_uuid);
+								if (voicemail_to_sms) then
+									send_sms(voicemail_id_copy, voicemail_message_uuid);
+								end
 							end
 					end --for
 

resources/install/scripts/app/voicemail/resources/functions/change_password.lua

@@ -32,15 +32,17 @@
 				dtmf_digits = '';
 				password = macro(session, "password_new", 20, 5000, '');
 			--update the voicemail password
-				sql = [[UPDATE v_voicemails
-					set voicemail_password = ']] .. password ..[['
-					WHERE domain_uuid = ']] .. domain_uuid ..[['
-					AND voicemail_id = ']] .. voicemail_id ..[['
+				local sql = [[UPDATE v_voicemails
+					set voicemail_password = :password
+					WHERE domain_uuid = :domain_uuid
+					AND voicemail_id = :voicemail_id 
 					AND voicemail_enabled = 'true' ]];
+				local params = {password = password, domain_uuid = domain_uuid,
+					voicemail_id = voicemail_id};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				dbh:query(sql);
+				dbh:query(sql, params);
 			--has been changed to
 				dtmf_digits = '';
 				macro(session, "password_changed", 20, 3000, password);

resources/install/scripts/app/voicemail/resources/functions/check_password.lua

@@ -44,14 +44,15 @@
 			--get the voicemail settings from the database
 				if (voicemail_id) then
 					if (session:ready()) then
-						sql = [[SELECT * FROM v_voicemails
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_id = ']] .. voicemail_id ..[['
+						local sql = [[SELECT * FROM v_voicemails
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_id = :voicemail_id
 							AND voicemail_enabled = 'true' ]];
+						local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql, function(row)
+						dbh:query(sql, params, function(row)
 							voicemail_uuid = string.lower(row["voicemail_uuid"]);
 							voicemail_password = row["voicemail_password"];
 							greeting_id = row["greeting_id"];

resources/install/scripts/app/voicemail/resources/functions/choose_greeting.lua

@@ -40,11 +40,13 @@
 		--check to see if the greeting file exists
 			if (storage_type == "base64" or storage_type == "http_cache") then
 				greeting_invalid = true;
-				sql = [[SELECT * FROM v_voicemail_greetings
-					WHERE domain_uuid = ']] .. domain_uuid ..[['
-					AND voicemail_id = ']].. voicemail_id.. [['
-					AND greeting_id = ']].. greeting_id.. [[' ]];
-				status = dbh:query(sql, function(row)
+				local sql = [[SELECT * FROM v_voicemail_greetings
+					WHERE domain_uuid = :domain_uuid
+					AND voicemail_id = :voicemail_id
+					AND greeting_id = :greeting_id]];
+				local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id,
+					greeting_id = greeting_id};
+				dbh:query(sql, params, function(row)
 					--greeting found
 					greeting_invalid = false;
 				end);
@@ -74,31 +76,39 @@
 
 				--valid greeting_id update the database
 					if (session:ready()) then
+						local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+						local sql = "UPDATE v_voicemails SET "
 						if (greeting_id == "0") then
-							sql = [[UPDATE v_voicemails SET greeting_id = null ]];
+							sql = sql .. "greeting_id = null ";
 						else
-							sql = [[UPDATE v_voicemails SET greeting_id = ']]..greeting_id..[[' ]];
+							sql = sql .. "greeting_id = :greeting_id ";
+							params.greeting_id = greeting_id;
 						end
-						sql = sql ..[[WHERE domain_uuid = ']] .. domain_uuid ..[[' ]]
-						sql = sql ..[[AND voicemail_uuid = ']] .. voicemail_uuid ..[[' ]];
+						sql = sql .. "WHERE domain_uuid = :domain_uuid ";
+						sql = sql .. "AND voicemail_uuid = :voicemail_uuid ";
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						dbh:query(sql);
+						dbh:query(sql, params);
 					end
 
 				--get the greeting from the database
 					if (storage_type == "base64") then
 						local dbh = Database.new('system', 'base64/read')
-
-						sql = [[SELECT * FROM v_voicemail_greetings
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_id = ']].. voicemail_id.. [['
-							AND greeting_id = ']].. greeting_id.. [[' ]];
+						local sql = [[SELECT greeting_base64
+							FROM v_voicemail_greetings
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_id = :voicemail_id
+							AND greeting_id = :greeting_id]];
+						local params = {
+							domain_uuid = domain_uuid;
+							voicemail_id = voicemail_id;
+							greeting_id = greeting_id;
+						};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql, function(row)
+						dbh:query(sql, params, function(row)
 							--set the voicemail message path
 								greeting_location = voicemail_dir.."/"..voicemail_id.."/greeting_"..greeting_id..".wav"; --vm_message_ext;
 

resources/install/scripts/app/voicemail/resources/functions/delete_recording.lua

@@ -32,11 +32,13 @@
 					macro(session, "message_deleted", 1, 100, '');
 				end
 			end
+
 		--get the voicemail_uuid
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. voicemail_id ..[[']];
-			status = dbh:query(sql, function(row)
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
+			dbh:query(sql, params, function(row)
 				db_voicemail_uuid = row["voicemail_uuid"];
 			end);
 		--flush dtmf digits from the input buffer
@@ -46,13 +48,14 @@
 			os.remove(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid.."."..vm_message_ext);
 		--delete from the database
 			sql = [[DELETE FROM v_voicemail_messages
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_uuid = ']] .. db_voicemail_uuid ..[['
-				AND voicemail_message_uuid = ']] .. uuid ..[[']];
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_uuid = :voicemail_uuid
+				AND voicemail_message_uuid = :uuid]];
+			params = {domain_uuid = domain_uuid, voicemail_uuid = db_voicemail_uuid, uuid = uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql);
+			dbh:query(sql, params);
 		--log to console
 			if (debug["info"]) then
 				freeswitch.consoleLog("notice", "[voicemail][deleted] message: " .. uuid .. "\n");

resources/install/scripts/app/voicemail/resources/functions/forward_add_intro.lua

@@ -95,21 +95,25 @@
 
 				--save the merged file into the database as base64
 					if (storage_type == "base64") then
+							local file = require "resources.functions.file"
+
 						--get the content of the file
-							local f = io.open(message_intro_location, "rb");
-							local file_content = f:read("*all");
-							f:close();
+							local file_content = assert(file.read_base64(message_intro_location));
 
 						--save the merged file as base64
-							local sql = {}
-							sql = [[UPDATE SET v_voicemail_messages
-									SET message_intro_base64 = ']].. base64.encode(file_content) ..[[' 
-									WHERE domain_uuid = ']] .. domain_uuid ..[['
-									AND voicemail_message_uuid = ']].. uuid.. [[' ]];
-							sql = table.concat(sql, "\n");
+							local sql = [[UPDATE SET v_voicemail_messages
+									SET message_intro_base64 = :file_content 
+									WHERE domain_uuid = :domain_uuid
+									AND voicemail_message_uuid = :uuid]];
+							local params = {file_content = file_content, domain_uuid = domain_uuid, uuid = uuid};
+
 							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
 							end
+
+							local dbh = Database.new('system', 'base64')
+							dbh:query(sql, params)
+							dbh:release()
 					end
 		end
 

resources/install/scripts/app/voicemail/resources/functions/forward_to_extension.lua

@@ -52,14 +52,15 @@
 
 		--get voicemail message details
 			if (session:ready()) then
-				sql = [[SELECT * FROM v_voicemail_messages
-					WHERE domain_uuid = ']] .. domain_uuid ..[['
-					AND voicemail_uuid = ']] .. voicemail_uuid ..[['
-					AND voicemail_message_uuid = ']] .. uuid ..[[']]
+				local sql = [[SELECT * FROM v_voicemail_messages
+					WHERE domain_uuid = :domain_uuid
+					AND voicemail_uuid = :voicemail_uuid
+					AND voicemail_message_uuid = :uuid]]
+				local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid, uuid = uuid};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				status = dbh:query(sql, function(row)
+				dbh:query(sql, params, function(row)
 					--get the values from the database
 						created_epoch = row["created_epoch"];
 						caller_id_name = row["caller_id_name"];
@@ -72,14 +73,15 @@
 			end
 
 		--get the voicemail settings
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. forward_voicemail_id ..[['
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id
 				AND voicemail_enabled = 'true' ]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = forward_voicemail_id};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			status = dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				forward_voicemail_uuid = string.lower(row["voicemail_uuid"]);
 				forward_voicemail_mail_to = row["voicemail_mail_to"];
 				forward_voicemail_attach_file = row["voicemail_attach_file"];
@@ -108,33 +110,41 @@
 			table.insert(sql, ") ");
 			table.insert(sql, "VALUES ");
 			table.insert(sql, "( ");
-			table.insert(sql, "'".. voicemail_message_uuid .."', ");
-			table.insert(sql, "'".. domain_uuid .."', ");
-			table.insert(sql, "'".. forward_voicemail_uuid .."', ");
+			table.insert(sql, ":voicemail_message_uuid, ");
+			table.insert(sql, ":domain_uuid, ");
+			table.insert(sql, ":forward_voicemail_uuid, ");
 			if (storage_type == "base64") then
-				table.insert(sql, "'".. message_base64 .."', ");
+				table.insert(sql, ":message_base64, ");
 			end
-			table.insert(sql, "'".. created_epoch .."', ");
-			table.insert(sql, "'".. caller_id_name .."', ");
-			table.insert(sql, "'".. caller_id_number .."', ");
-			table.insert(sql, "'".. message_length .."' ");
-			--table.insert(sql, "'".. message_status .."', ");
-			--table.insert(sql, "'".. message_priority .."' ");
+			table.insert(sql, ":created_epoch, ");
+			table.insert(sql, ":caller_id_name, ");
+			table.insert(sql, ":caller_id_number, ");
+			table.insert(sql, ":message_length ");
+			--table.insert(sql, ":message_status, ");
+			--table.insert(sql, ":message_priority ");
 			table.insert(sql, ") ");
 			sql = table.concat(sql, "\n");
+			local params = {
+				voicemail_message_uuid = voicemail_message_uuid;
+				domain_uuid = domain_uuid;
+				forward_voicemail_uuid = forward_voicemail_uuid;
+				message_base64 = message_base64;
+				created_epoch = created_epoch;
+				caller_id_name = caller_id_name;
+				caller_id_number = caller_id_number;
+				message_length = message_length;
+				-- message_status = message_status;
+				-- message_priority = message_priority;
+			};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
 			if (storage_type == "base64") then
-				array = explode("://", database["system"]);
-				local luasql = require "luasql.postgres";
-				local env = assert (luasql.postgres());
-				local dbh = env:connect(array[2]);
-				res, serr = dbh:execute(sql);
-				dbh:close();
-				env:close();
+				local dbh = Database.new('system', 'base64')
+				dbh:query(sql, params);
+				dbh:release();
 			else
-				dbh:query(sql);
+				dbh:query(sql, params);
 			end
 
 		--offer to add an intro to the forwarded message

resources/install/scripts/app/voicemail/resources/functions/listen_to_recording.lua

@@ -23,8 +23,6 @@
 --	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 --	POSSIBILITY OF SUCH DAMAGE.
 
-	local Database = require "resources.functions.database"
-
 --define function to listen to the recording
 	function listen_to_recording (message_number, uuid, created_epoch, caller_id_name, caller_id_number)
 
@@ -76,13 +74,14 @@
 			if (storage_type == "base64") then
 				local dbh = Database.new('system', 'base64/read')
 
-				sql = [[SELECT * FROM v_voicemail_messages
-					WHERE domain_uuid = ']] .. domain_uuid ..[['
-					AND voicemail_message_uuid = ']].. uuid.. [[' ]];
+				local sql = [[SELECT * FROM v_voicemail_messages
+					WHERE domain_uuid = :domain_uuid
+					AND voicemail_message_uuid = :uuid]];
+				local params = {domain_uuid = domain_uuid, uuid = uuid};
 				if (debug["sql"]) then
-					freeswitch.consoleLog("notice", "[ivr_menu] SQL: " .. sql .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 				end
-				status = dbh:query(sql, function(row)
+				dbh:query(sql, params, function(row)
 					--set the voicemail message path
 						mkdir(voicemail_dir.."/"..voicemail_id);
 						message_intro_location = voicemail_dir.."/"..voicemail_id.."/intro_"..uuid.."."..vm_message_ext;

resources/install/scripts/app/voicemail/resources/functions/macro.lua

@@ -1,5 +1,5 @@
 --	Part of FusionPBX
---	Copyright (C) 2013-2016 Mark J Crane <markjcrane@fusionpbx.com>
+--	Copyright (C) 2013 - 2016 Mark J Crane <markjcrane@fusionpbx.com>
 --	All rights reserved.
 --
 --	Redistribution and use in source and binary forms, with or without

resources/install/scripts/app/voicemail/resources/functions/main_menu.lua

@@ -32,14 +32,15 @@
 				session:flushDigits();
 			--new voicemail count
 				if (session:ready()) then
-					sql = [[SELECT count(*) as new_messages FROM v_voicemail_messages
-						WHERE domain_uuid = ']] .. domain_uuid ..[['
-						AND voicemail_uuid = ']] .. voicemail_uuid ..[['
+					local sql = [[SELECT count(*) as new_messages FROM v_voicemail_messages
+						WHERE domain_uuid = :domain_uuid
+						AND voicemail_uuid = :voicemail_uuid
 						AND (message_status is null or message_status = '') ]];
-						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-						end
-					status = dbh:query(sql, function(row)
+					local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+					if (debug["sql"]) then
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+					end
+					dbh:query(sql, params, function(row)
 						new_messages = row["new_messages"];
 					end);
 					dtmf_digits = macro(session, "new_messages", 1, 100, new_messages);
@@ -48,32 +49,34 @@
 				if (session:ready()) then
 					if (string.len(dtmf_digits) == 0) then
 						sql = [[SELECT count(*) as saved_messages FROM v_voicemail_messages
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_uuid = ']] .. voicemail_uuid ..[['
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_uuid = :voicemail_uuid
 							AND message_status = 'saved' ]];
-							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-							end
-						status = dbh:query(sql, function(row)
+						local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
+						if (debug["sql"]) then
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+						end
+						dbh:query(sql, params, function(row)
 							saved_messages = row["saved_messages"];
 						end);
 						dtmf_digits = macro(session, "saved_messages", 1, 100, saved_messages);
 					end
 				end
-            --get domain timezone
-                if (session:ready()) then
-                    if (string.len(dtmf_digits) == 0) then
-                        sql = [[SELECT domain_setting_value as current_time_zone FROM v_domain_settings
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-                            AND domain_setting_subcategory='time_zone' ]];
-                            if (debug["sql"]) then
-                                freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
-                            end
-                        status = dbh:query(sql, function(row)
-                            current_time_zone = row["current_time_zone"];
-                        end);
-                    end
-                end
+			--get domain timezone
+				if (session:ready()) then
+					if (string.len(dtmf_digits) == 0) then
+						local sql = [[SELECT domain_setting_value as current_time_zone FROM v_domain_settings
+							WHERE domain_uuid = :domain_uuid
+							AND domain_setting_subcategory='time_zone' ]];
+						local params = {domain_uuid = domain_uuid};
+						if (debug["sql"]) then
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+						end
+						dbh:query(sql, params, function(row)
+							current_time_zone = row["current_time_zone"];
+						end);
+					end
+				end
 			--to listen to new message
 				if (session:ready() and new_messages ~= '0') then
 					if (string.len(dtmf_digits) == 0) then

resources/install/scripts/app/voicemail/resources/functions/menu_messages.lua

@@ -41,19 +41,21 @@
 		--message_status new,saved
 			if (session:ready()) then
 				if (voicemail_id ~= nil) then
-					sql = [[SELECT voicemail_message_uuid, created_epoch, caller_id_name, caller_id_number FROM v_voicemail_messages
-						WHERE domain_uuid = ']] .. domain_uuid ..[['
-						AND voicemail_uuid = ']] .. voicemail_uuid ..[[']]
+					local sql = [[SELECT voicemail_message_uuid, created_epoch, caller_id_name, caller_id_number 
+						FROM v_voicemail_messages
+						WHERE domain_uuid = :domain_uuid
+						AND voicemail_uuid = :voicemail_uuid ]]
 					if (message_status == "new") then
 						sql = sql .. [[AND (message_status is null or message_status = '') ]];
 					elseif (message_status == "saved") then
 						sql = sql .. [[AND message_status = 'saved' ]];
 					end
 					sql = sql .. [[ORDER BY created_epoch desc;]];
+					local params = {domain_uuid = domain_uuid, voicemail_uuid = voicemail_uuid};
 					if (debug["sql"]) then
-						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 					end
-					status = dbh:query(sql, function(row)
+					dbh:query(sql, params, function(row)
 						--get the values from the database
 							--row["voicemail_message_uuid"];
 							--row["created_epoch"];

resources/install/scripts/app/voicemail/resources/functions/message_count.lua

@@ -5,13 +5,13 @@ local log = require "resources.functions.log"["voicemail-count"]
 local message_count_by_uuid_sql = [[SELECT
 ( SELECT count(*)
   FROM v_voicemail_messages
-  WHERE voicemail_uuid = '%s' 
+  WHERE voicemail_uuid = :voicemail_uuid
   AND (message_status is null or message_status = '')
 ) as new_messages,
 
 ( SELECT count(*)
   FROM v_voicemail_messages
-  WHERE voicemail_uuid = '%s'
+  WHERE voicemail_uuid = :voicemail_uuid
   AND message_status = 'saved'
 ) as saved_messages
 ]]
@@ -19,15 +19,13 @@ local message_count_by_uuid_sql = [[SELECT
 function message_count_by_uuid(voicemail_uuid)
 	local new_messages, saved_messages = "0", "0"
 
-	local sql = string.format(message_count_by_uuid_sql,
-		voicemail_uuid, voicemail_uuid
-	)
+	local params = {voicemail_uuid = voicemail_uuid};
 
 	if debug["sql"] then
-		log.noticef("SQL: %s", sql)
+		log.noticef("SQL: %s; params: %s", message_count_by_uuid_sql, json.encode(params))
 	end
 
-	dbh:query(sql, function(row)
+	dbh:query(message_count_by_uuid_sql, params, function(row)
 		new_messages, saved_messages = row.new_messages, row.saved_messages
 	end)
 
@@ -42,14 +40,14 @@ local message_count_by_id_sql = [[SELECT
 ( SELECT count(*)
   FROM v_voicemail_messages as m inner join v_voicemails as v
   on v.voicemail_uuid = m.voicemail_uuid
-  WHERE v.voicemail_id = '%s' AND v.domain_uuid = '%s'
+  WHERE v.voicemail_id = :voicemail_id AND v.domain_uuid = :domain_uuid
   AND (m.message_status is null or m.message_status = '')
 ) as new_messages,
 
 ( SELECT count(*)
   FROM v_voicemail_messages as m inner join v_voicemails as v
   on v.voicemail_uuid = m.voicemail_uuid
-  WHERE v.voicemail_id = '%s' AND v.domain_uuid = '%s'
+  WHERE v.voicemail_id = :voicemail_id AND v.domain_uuid = :domain_uuid
   AND m.message_status = 'saved'
 ) as saved_messages
 ]]
@@ -57,15 +55,13 @@ local message_count_by_id_sql = [[SELECT
 function message_count_by_id(voicemail_id, domain_uuid)
 	local new_messages, saved_messages = "0", "0"
 
-	local sql = string.format(message_count_by_id_sql,
-		voicemail_id, domain_uuid, voicemail_id, domain_uuid
-	)
+	local params = {voicemail_id = voicemail_id, domain_uuid = domain_uuid};
 
 	if debug["sql"] then
-		log.noticef("SQL: %s", sql)
+		log.noticef("SQL: %s; params: %s", message_count_by_id_sql, json.encode(params))
 	end
 
-	dbh:query(sql, function(row)
+	dbh:query(message_count_by_id_sql, params, function(row)
 		new_messages, saved_messages = row.new_messages, row.saved_messages
 	end)
 

resources/install/scripts/app/voicemail/resources/functions/message_saved.lua

@@ -30,21 +30,23 @@
 		--flush dtmf digits from the input buffer
 			session:flushDigits();
 		--get the voicemail_uuid
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. voicemail_id ..[[']];
-			status = dbh:query(sql, function(row)
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id};
+			dbh:query(sql, params, function(row)
 				db_voicemail_uuid = row["voicemail_uuid"];
 			end);
 		--delete from the database
 			sql = [[UPDATE v_voicemail_messages SET message_status = 'saved'
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_uuid = ']] .. db_voicemail_uuid ..[['
-				AND voicemail_message_uuid = ']] .. uuid ..[[']];
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_uuid = :voicemail_uuid
+				AND voicemail_message_uuid = :uuid]];
+			params = {domain_uuid = domain_uuid, voicemail_uuid = db_voicemail_uuid, uuid = uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql);
+			dbh:query(sql, params);
 		--log to console
 			if (debug["info"]) then
 				freeswitch.consoleLog("notice", "[voicemail][saved] id: " .. voicemail_id .. " message: "..uuid.."\n");

resources/install/scripts/app/voicemail/resources/functions/message_waiting.lua

@@ -34,16 +34,18 @@
 
 		--get the voicemail id and all related mwi accounts
 			local sql = [[SELECT extension, number_alias from v_extensions
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
+				WHERE domain_uuid = :domain_uuid
 				AND (
-					mwi_account = ']]..voicemail_id..[[' 
-					or mwi_account = ']]..voicemail_id..[[@]]..domain_name..[['
-					or number_alias = ']]..voicemail_id..[['
-					)]];
+					mwi_account = :voicemail_id
+					or mwi_account = :mwi_account
+					or number_alias = :voicemail_id
+				)]];
+			local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id, 
+				mwi_account = voicemail_id .. "@" .. domain_name};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				table.insert(accounts, row["extension"]);
 			end);
 

resources/install/scripts/app/voicemail/resources/functions/play_greeting.lua

@@ -51,15 +51,17 @@
 							if (storage_type == "base64") then
 								local dbh = Database.new('system', 'base64/read')
 
-								sql = [[SELECT * FROM v_voicemail_greetings
-									WHERE domain_uuid = ']] .. domain_uuid ..[['
-									AND voicemail_id = ']].. voicemail_id.. [['
-									AND greeting_id = ']].. greeting_id.. [[' ]];
+								local sql = [[SELECT * FROM v_voicemail_greetings
+									WHERE domain_uuid = :domain_uuid
+									AND voicemail_id = :voicemail_id
+									AND greeting_id = :greeting_id ]];
+								local params = {domain_uuid = domain_uuid, voicemail_id = voicemail_id,
+									greeting_id = greeting_id};
 								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 								end
 								local saved
-								status = dbh:query(sql, function(row)
+								dbh:query(sql, params, function(row)
 									--set the voicemail message path
 										mkdir(voicemail_dir.."/"..voicemail_id);
 										greeting_location = voicemail_dir.."/"..voicemail_id.."/greeting_"..greeting_id..".wav"; --vm_message_ext;
@@ -104,4 +106,4 @@
 					end
 			end
 		end
-end
+	end

resources/install/scripts/app/voicemail/resources/functions/record_menu.lua

@@ -90,12 +90,14 @@
 									end
 
 								--delete the previous recording
-									sql = "delete from v_voicemail_greetings ";
-									sql = sql .. "where domain_uuid = '".. domain_uuid .. "' ";
-									sql = sql .. "and voicemail_id = '".. voicemail_id .."' ";
-									sql = sql .. "and greeting_id = '".. greeting_id .."' ";
+									local sql = "delete from v_voicemail_greetings ";
+									sql = sql .. "where domain_uuid = :domain_uuid ";
+									sql = sql .. "and voicemail_id = :voicemail_id ";
+									sql = sql .. "and greeting_id = :greeting_id ";
+									local params = {domain_uuid = domain_uuid, 
+										voicemail_id = voicemail_id, greeting_id = greeting_id};
 									--freeswitch.consoleLog("notice", "[SQL] DELETING: " .. greeting_id .. "\n");
-									dbh:query(sql);
+									dbh:query(sql, params);
 
 								--get a new uuid
 									voicemail_greeting_uuid = api:execute("create_uuid");
@@ -116,38 +118,48 @@
 									table.insert(array, ") ");
 									table.insert(array, "VALUES ");
 									table.insert(array, "( ");
-									table.insert(array, "'"..voicemail_greeting_uuid.."', ");
-									table.insert(array, "'"..domain_uuid.."', ");
-									table.insert(array, "'"..voicemail_id.."', ");
-									table.insert(array, "'"..greeting_id.."', ");
+									table.insert(array, ":greeting_uuid, ");
+									table.insert(array, ":domain_uuid, ");
+									table.insert(array, ":voicemail_id, ");
+									table.insert(array, ":greeting_id, ");
 									if (storage_type == "base64") then
-										table.insert(array, "'"..greeting_base64.."', ");
+										table.insert(array, ":greeting_base64, ");
 									end
-									table.insert(array, "'Greeting "..greeting_id.."', ");
-									table.insert(array, "'greeting_"..greeting_id..".wav' ");
+									table.insert(array, ":greeting_name, ");
+									table.insert(array, ":greeting_filename ");
 									table.insert(array, ") ");
 									sql = table.concat(array, "\n");
+									params = {
+										greeting_uuid = voicemail_greeting_uuid;
+										domain_uuid = domain_uuid;
+										voicemail_id = voicemail_id;
+										greeting_id = greeting_id;
+										greeting_base64 = greeting_base64;
+										greeting_name = "Greeting "..greeting_id;
+										greeting_filename = "greeting_"..greeting_id..".wav"
+									};
 									--freeswitch.consoleLog("notice", "[SQL] INSERTING: " .. greeting_id .. "\n");
 									if (debug["sql"]) then
-										freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+										freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 									end
 									if (storage_type == "base64") then
-										local Database = require "resources.functions.database"
 										local dbh = Database.new('system', 'base64');
-										dbh:query(sql);
+										dbh:query(sql, params);
 										dbh:release();
 									else
-										dbh:query(sql);
+										dbh:query(sql, params);
 									end
 
 								--use the new greeting
-									local array = {}
-									table.insert(array, "update v_voicemails ");
-									table.insert(array, "set greeting_id = '".. greeting_id .."' ");
-									table.insert(array, "where domain_uuid = '".. domain_uuid .."' ");
-									table.insert(array, "and voicemail_id = '".. voicemail_id .."' ");
-									sql = table.concat(array, "\n");
-									dbh:query(sql);
+									sql = {}
+									table.insert(sql, "update v_voicemails ");
+									table.insert(sql, "set greeting_id = :greeting_id ");
+									table.insert(sql, "where domain_uuid = :domain_uuid ");
+									table.insert(sql, "and voicemail_id = :voicemail_id ");
+									sql = table.concat(sql, "\n");
+									params = {domain_uuid = domain_uuid, greeting_id = greeting_id,
+										voicemail_id = voicemail_id};
+									dbh:query(sql, params);
 
 								advanced();
 							end

resources/install/scripts/app/voicemail/resources/functions/record_message.lua

@@ -26,6 +26,62 @@
 --load libraries
 	local Database = require "resources.functions.database"
 	local Settings = require "resources.functions.lazy_settings"
+	local JSON = require "resources.functions.lunajson"
+
+--define uuid function
+	local random = math.random;
+	local function gen_uuid()
+		local template ='xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx';
+		return string.gsub(template, '[xy]', function (c)
+			local v = (c == 'x') and random(0, 0xf) or random(8, 0xb);
+			return string.format('%x', v);
+		end)
+	end
+
+	local function transcribe(file_path,settings)
+		--transcription variables
+		local transcribe_provider = settings:get('voicemail', 'transcribe_provider', 'text') or '';
+		transcribe_language = settings:get('voicemail', 'transcribe_language', 'text') or 'en-US';
+
+		if (debug["info"]) then
+			freeswitch.consoleLog("notice", "[voicemail] transcribe_provider: " .. transcribe_provider .. "\n");
+			freeswitch.consoleLog("notice", "[voicemail] transcribe_language: " .. transcribe_language .. "\n");
+
+		end	
+
+		if (transcribe_provider == "microsoft") then
+			local api_key1 = settings:get('voicemail', 'microsoft_key1', 'text') or '';
+			local api_key2 = settings:get('voicemail', 'microsoft_key2', 'text') or '';
+			if (api_key1 ~= '' and api_key2 ~= '') then
+				access_token_cmd = "curl -X POST \"https://api.cognitive.microsoft.com/sts/v1.0/issueToken\" -H \"Content-type: application/x-www-form-urlencoded\" -H \"Content-Length: 0\" -H \"Ocp-Apim-Subscription-Key: "..api_key1.."\""
+				local handle = io.popen(access_token_cmd);
+				local access_token_result = handle:read("*a");
+				handle:close();
+				if (debug["info"]) then
+					freeswitch.consoleLog("notice", "[voicemail] CMD: " .. access_token_cmd .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] RESULT: " .. access_token_result .. "\n");
+				end
+				transcribe_cmd = "curl -X POST \"https://speech.platform.bing.com/recognize?scenarios=smd&appid=D4D52672-91D7-4C74-8AD8-42B1D98141A5&locale=en-US&device.os=Freeswitch&version=3.0&format=json&instanceid=" .. gen_uuid() .. "&requestid=" .. gen_uuid() .. "\" -H 'Authorization: Bearer " .. access_token_result .. "' -H 'Content-type: audio/wav; codec=\"audio/pcm\"; samplerate=8000; trustsourcerate=false' --data-binary @"..file_path
+				local handle = io.popen(transcribe_cmd);
+				local transcribe_result = handle:read("*a");
+				handle:close();
+				local transcribe_json = JSON.decode(transcribe_result);
+				if (debug["info"]) then
+					freeswitch.consoleLog("notice", "[voicemail] CMD: " .. transcribe_cmd .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] RESULT: " .. transcribe_result .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] TRANSCRIPTION: " .. transcribe_json["results"][1]["name"] .. "\n");
+					freeswitch.consoleLog("notice", "[voicemail] CONFIDENCE: " .. transcribe_json["results"][1]["confidence"] .. "\n");
+				end
+							
+				transcription = transcribe_json["results"][1]["name"];
+				transcription = transcription:gsub("<profanity>.*<%/profanity>","...");
+				confidence = transcribe_json["results"][1]["confidence"];
+			end
+			return transcription;
+		end
+		
+		return '';
+	end
 
 --save the recording
 	function record_message()
@@ -33,7 +89,12 @@
 		local settings = Settings.new(db, domain_name, domain_uuid)
 
 		local max_len_seconds = settings:get('voicemail', 'message_max_length', 'numeric') or 300;
-
+		transcribe_enabled = settings:get('voicemail', 'transcribe_enabled', 'boolean') or "false";
+		
+		if (debug["info"]) then
+			freeswitch.consoleLog("notice", "[voicemail] transcribe_enabled: " .. transcribe_enabled .. "\n");
+		end
+		
 		--record your message at the tone press any key or stop talking to end the recording
 			if (skip_instructions == "true") then
 				--skip the instructions
@@ -73,12 +134,13 @@
 							session:hangup();
 						else
 							--get the voicemail options
-								sql = [[SELECT * FROM v_voicemail_options WHERE voicemail_uuid = ']] .. voicemail_uuid ..[[' ORDER BY voicemail_option_order asc ]];
+								local sql = [[SELECT * FROM v_voicemail_options WHERE voicemail_uuid = :voicemail_uuid ORDER BY voicemail_option_order asc ]];
+								local params = {voicemail_uuid = voicemail_uuid};
 								if (debug["sql"]) then
-									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+									freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 								end
 								count = 0;
-								status = dbh:query(sql, function(row)
+								dbh:query(sql, params, function(row)
 									--check for matching options
 										if (tonumber(row.voicemail_option_digits) ~= nil) then
 											row.voicemail_option_digits = "^"..row.voicemail_option_digits.."$";
@@ -157,13 +219,16 @@
 				mkdir(voicemail_dir.."/"..voicemail_id);
 				if (vm_message_ext == "mp3") then
 					shout_exists = trim(api:execute("module_exists", "mod_shout"));
-					if (shout_exists == "true") then
+					if (shout_exists == "true" and transcribe_enabled == "false") then
 						freeswitch.consoleLog("notice", "using mod_shout for mp3 encoding\n");
 						--record in mp3 directly
 							result = session:recordFile(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid..".mp3", max_len_seconds, record_silence_threshold, silence_seconds);
 					else
 						--create initial wav recording
 							result = session:recordFile(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid..".wav", max_len_seconds, record_silence_threshold, silence_seconds);
+							if (transcribe_enabled == "true") then
+								transcription = transcribe(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid..".wav",settings);
+							end
 						--use lame to encode, if available
 							if (file_exists("/usr/bin/lame")) then
 								freeswitch.consoleLog("notice", "using lame for mp3 encoding\n");
@@ -183,6 +248,9 @@
 					end
 				else
 					result = session:recordFile(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid.."."..vm_message_ext, max_len_seconds, record_silence_threshold, silence_seconds);
+					if (transcribe_enabled == "true") then
+						transcription = transcribe(voicemail_dir.."/"..voicemail_id.."/msg_"..uuid.."."..vm_message_ext,settings);
+					end
 				end
 			end
 

resources/install/scripts/app/voicemail/resources/functions/record_name.lua

@@ -62,20 +62,21 @@
 							voicemail_name_base64 = assert(file.read_base64(voicemail_name_location));
 
 					--update the voicemail name
-						sql = "UPDATE v_voicemails ";
-						sql = sql .. "set voicemail_name_base64 = '".. voicemail_name_base64 .. "' ";
-						sql = sql .. "where domain_uuid = '".. domain_uuid .. "' ";
-						sql = sql .. "and voicemail_id = '".. voicemail_id .."'";
+						local sql = "UPDATE v_voicemails ";
+						sql = sql .. "set voicemail_name_base64 = :voicemail_name_base64 ";
+						sql = sql .. "where domain_uuid = :domain_uuid ";
+						sql = sql .. "and voicemail_id = :voicemail_id";
+						local params = {voicemail_name_base64 = voicemail_name_base64,
+							domain_uuid = domain_uuid, voicemail_id = voicemail_id};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[recording] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[recording] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
 						if (storage_type == "base64") then
-							local Database = require "resources.functions.database"
 							local dbh = Database.new('system', 'base64');
-							dbh:query(sql);
+							dbh:query(sql, params);
 							dbh:release();
 						else
-							dbh:query(sql);
+							dbh:query(sql, params);
 						end
 				elseif (storage_type == "http_cache") then
 					freeswitch.consoleLog("notice", "[voicemail] ".. storage_type .. " ".. storage_path .."\n");

resources/install/scripts/app/voicemail/resources/functions/send_email.lua

@@ -34,13 +34,14 @@
 		local settings = Settings.new(db, domain_name, domain_uuid)
 
 		--get voicemail message details
-			sql = [[SELECT * FROM v_voicemails
-				WHERE domain_uuid = ']] .. domain_uuid ..[['
-				AND voicemail_id = ']] .. id ..[[']]
+			local sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = :domain_uuid
+				AND voicemail_id = :voicemail_id]]
+			local params = {domain_uuid = domain_uuid, voicemail_id = id};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			status = dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				db_voicemail_uuid = string.lower(row["voicemail_uuid"]);
 				--voicemail_password = row["voicemail_password"];
 				--greeting_id = row["greeting_id"];
@@ -71,13 +72,14 @@
 					end
 
 				--get voicemail message details
-					sql = [[SELECT * FROM v_voicemail_messages
-						WHERE domain_uuid = ']] .. domain_uuid ..[['
-						AND voicemail_message_uuid = ']] .. uuid ..[[']]
+					local sql = [[SELECT * FROM v_voicemail_messages
+						WHERE domain_uuid = :domain_uuid
+						AND voicemail_message_uuid = :uuid]]
+					local params = {domain_uuid = domain_uuid, uuid = uuid};
 					if (debug["sql"]) then
-						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 					end
-					status = dbh:query(sql, function(row)
+					dbh:query(sql, params, function(row)
 						--get the values from the database
 							--uuid = row["voicemail_message_uuid"];
 							created_epoch = row["created_epoch"];
@@ -115,8 +117,13 @@
 					local message_date = os.date("%A, %d %b %Y %I:%M %p", created_epoch)
 
 				--prepare the files
-					file_subject = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_subject.tpl";
-					file_body = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_body.tpl";
+					if (transcription ~= nil) then
+						file_subject = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_subject.tpl";
+						file_body = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_body_transcription.tpl";					
+					else
+						file_subject = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_subject.tpl";
+						file_body = scripts_dir.."/app/voicemail/resources/templates/"..default_language.."/"..default_dialect.."/email_body.tpl";
+					end
 					if (not file_exists(file_subject)) then
 						file_subject = scripts_dir.."/app/voicemail/resources/templates/en/us/email_subject.tpl";
 						file_body = scripts_dir.."/app/voicemail/resources/templates/en/us/email_body.tpl";
@@ -166,6 +173,9 @@
 					body = body:gsub("${caller_id_name}", caller_id_name);
 					body = body:gsub("${caller_id_number}", caller_id_number);
 					body = body:gsub("${message_date}", message_date);
+					if (transcription ~= nil) then
+						body = body:gsub("${message_text}", transcription);
+					end
 					body = body:gsub("${message_duration}", message_length_formatted);
 					body = body:gsub("${account}", voicemail_name_formatted);
 					body = body:gsub("${voicemail_id}", id);
@@ -203,14 +213,16 @@
 			if (string.len(voicemail_mail_to) > 2) then
 				if (voicemail_local_after_email == "false") then
 					--delete the voicemail message details
-						sql = [[DELETE FROM v_voicemail_messages
-							WHERE domain_uuid = ']] .. domain_uuid ..[['
-							AND voicemail_uuid = ']] .. db_voicemail_uuid ..[['
-							AND voicemail_message_uuid = ']] .. uuid ..[[']]
+						local sql = [[DELETE FROM v_voicemail_messages
+							WHERE domain_uuid = :domain_uuid
+							AND voicemail_uuid = :voicemail_uuid
+							AND voicemail_message_uuid = :uuid]]
+						local params = {domain_uuid = domain_uuid,
+							voicemail_uuid = db_voicemail_uuid, uuid = uuid};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql);
+						dbh:query(sql, params);
 					--delete voicemail recording file
 						if (file_exists(file)) then
 							os.remove(file);

resources/install/scripts/app/voicemail/resources/functions/send_sms.lua

@@ -0,0 +1,99 @@
+--	Part of FusionPBX
+--	Copyright (C) 2013 Mark J Crane <markjcrane@fusionpbx.com>
+--	All rights reserved.
+--
+--	Redistribution and use in source and binary forms, with or without
+--	modification, are permitted provided that the following conditions are met:
+--
+--	1. Redistributions of source code must retain the above copyright notice,
+--	  this list of conditions and the following disclaimer.
+--
+--	2. Redistributions in binary form must reproduce the above copyright
+--	  notice, this list of conditions and the following disclaimer in the
+--	  documentation and/or other materials provided with the distribution.
+--
+--	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+--	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+--	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+--	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+--	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+--	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+--	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+--	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+--	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+--	POSSIBILITY OF SUCH DAMAGE.
+
+--define a function to send sms
+	function send_sms(id, uuid)
+		debug["info"] = true;
+		api = freeswitch.API();
+
+		--get voicemail message details
+			sql = [[SELECT * FROM v_voicemails
+				WHERE domain_uuid = ']] .. domain_uuid ..[['
+				AND voicemail_id = ']] .. id ..[[']]
+			if (debug["sql"]) then
+				freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+			end
+			status = dbh:query(sql, function(row)
+				db_voicemail_uuid = string.lower(row["voicemail_uuid"]);
+				voicemail_sms_to = row["voicemail_sms_to"];
+				voicemail_file = row["voicemail_file"];
+			end);
+
+		--get the sms_body template
+			if (settings['voicemail']['voicemail_sms_body'] ~= nil) then
+				if (settings['voicemail']['voicemail_sms_body']['text'] ~= nil) then
+					sms_body = settings['voicemail']['voicemail_sms_body']['text'];
+				end
+			else
+				sms_body = 'You have a new voicemail from: ${caller_id_name} - ${caller_id_number} length ${message_length_formatted}';
+			end
+
+
+		--require the sms address to send to
+			if (string.len(voicemail_sms_to) > 2) then
+				--include languages file
+					local Text = require "resources.functions.text"
+					local text = Text.new("app.voicemail.app_languages")
+
+				--get voicemail message details
+					sql = [[SELECT * FROM v_voicemail_messages
+						WHERE domain_uuid = ']] .. domain_uuid ..[['
+						AND voicemail_message_uuid = ']] .. uuid ..[[']]
+					if (debug["sql"]) then
+						freeswitch.consoleLog("notice", "[voicemail] SQL: " .. sql .. "\n");
+					end
+					status = dbh:query(sql, function(row)
+						--get the values from the database
+							--uuid = row["voicemail_message_uuid"];
+							created_epoch = row["created_epoch"];
+							caller_id_name = row["caller_id_name"];
+							caller_id_number = row["caller_id_number"];
+							message_length = row["message_length"];
+					end);
+
+				--format the message length and date
+					message_length_formatted = format_seconds(message_length);
+					if (debug["info"]) then
+						freeswitch.consoleLog("notice", "[voicemail] message length: " .. message_length .. "\n");
+						freeswitch.consoleLog("notice", "[voicemail] domain_name: " .. domain_name .. "\n");
+					end
+					local message_date = os.date("%A, %d %b %Y %I:%M %p", created_epoch)
+
+					sms_body = sms_body:gsub("${caller_id_name}", caller_id_name);
+					sms_body = sms_body:gsub("${caller_id_number}", caller_id_number);
+					sms_body = sms_body:gsub("${message_date}", message_date);
+					sms_body = sms_body:gsub("${message_duration}", message_length_formatted);
+					sms_body = sms_body:gsub("${account}", id);
+					sms_body = sms_body:gsub("${domain_name}", domain_name);
+					sms_body = sms_body:gsub("${sip_to_user}", id);
+					sms_body = sms_body:gsub("${dialed_user}", id);
+
+--					sms_body = "hello";
+					cmd = "luarun app.lua sms outbound " .. voicemail_sms_to .. "@" .. domain_name .. " " .. voicemail_to_sms_did .. " '" .. sms_body .. "'";
+					api:executeString(cmd);
+
+			end
+
+	end

resources/install/scripts/app/voicemail/resources/scripts/mwi.lua

@@ -40,8 +40,8 @@
 	runonce = false;
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
 
 --used to stop the lua service
 	local file = assert(io.open(run_file, "w"));

resources/install/scripts/app/voicemail/resources/scripts/mwi_subscribe.lua

@@ -14,7 +14,7 @@ local vm_message_count do
 
 local vm_to_uuid_sql = [[SELECT v.voicemail_uuid
 FROM v_voicemails as v inner join v_domains as d on v.domain_uuid = d.domain_uuid
-WHERE v.voicemail_id = '%s' and d.domain_name = '%s']]
+WHERE v.voicemail_id = :voicemail_id and d.domain_name = :domain_name]]
 
 local vm_messages_sql = [[SELECT
 ( SELECT count(*)
@@ -50,7 +50,9 @@ function vm_message_count(account, use_cache)
 			local sql = string.format(vm_to_uuid_sql,
 				dbh:escape(id), dbh:escape(domain_name)
 			)
-			uuid = dbh:first_value(sql)
+			uuid = dbh:first_value(vm_to_uuid_sql, {
+				voicemail_id = id, domain_name = domain_name
+			})
 
 			if uuid and #uuid > 0 then
 				cache.set('voicemail_uuid:' .. account, uuid, 3600)
@@ -58,22 +60,21 @@ function vm_message_count(account, use_cache)
 		end
 	end
 
-	local sql 
+	local row
 	if uuid and #uuid > 0 then
-		sql = string.format(vm_messages_sql,
-			dbh:quoted(uuid), dbh:quoted(uuid)
-		)
+		local sql = string.format(vm_messages_sql, ":voicemail_uuid", ":voicemail_uuid")
+		row = dbh:first_row(sql, {voicemail_uuid = uuid})
 	else
-		local uuid_sql = '(' .. string.format(vm_to_uuid_sql,
-			dbh:escape(id), dbh:escape(domain_name)
-		) .. ')'
+		local uuid_sql = '(' .. vm_to_uuid_sql .. ')'
 
-		sql = string.format(vm_messages_sql,
+		local sql = string.format(vm_messages_sql,
 			uuid_sql, uuid_sql
 		)
-	end
 
-	local row = sql and dbh:first_row(sql)
+		row = dbh:first_row(sql, {
+			voicemail_id = id, domain_name = domain_name
+		})
+	end
 
 	dbh:release()
 

resources/install/scripts/app/voicemail/resources/templates/en/us/email_body_transcription.tpl

@@ -0,0 +1,69 @@
+<html>
+	<table width="400" border="0" cellspacing="0" cellpadding="0" align="center"
+	style="border: 1px solid #cbcfd5;-moz-border-radius: 4px;
+	-webkit-border-radius: 4px; border-radius: 4px;">
+		<tr>
+			<td valign="middle" align="center" bgcolor="#e5e9f0" style="background-color: #e5e9f0;
+			color: #000; font-family: Arial; font-size: 14px; padding: 7px;-moz-border-radius: 4px;
+			-webkit-border-radius: 4px; border-radius: 4px;">
+				<strong>New Voicemail</strong>
+			</td>
+		</tr>
+		<tr>
+			<td valign="top" style="padding: 15px;">
+				<table width="100%" border="0" cellspacing="0" cellpadding="0">
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							<strong>To</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							${voicemail_name_formatted}
+						</td>
+					</tr>
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;" width="20%">
+							<strong>From</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;" width="80%">
+							${caller_id_number}
+						</td>
+					</tr>
+					<!--
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							<strong>Received</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							${message_date}
+						</td>
+					</tr>
+					-->
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							<strong>Message</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							${message}
+						</td>
+					</tr>
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							<strong>Message Text</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							${message_text}
+						</td>
+					</tr>
+					<tr>
+						<td style="color: #333; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							<strong>Length</strong>
+						</td>
+						<td style="color: #666; font-family: Arial; font-size: 12px; padding-bottom: 11px;">
+							${message_duration}
+						</td>
+					</tr>
+				</table>
+			</td>
+		</tr>
+	</table>
+</html>

resources/install/scripts/app/xml_handler/resources/scripts/configuration/acl.conf.lua

@@ -48,8 +48,14 @@
 			end
 
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			local Database = require "resources.functions.database";
+			dbh = Database.new('system');
+
+		--include json library
+			local json
+			if (debug["sql"]) then
+				json = require "resources.functions.lunajson"
+			end
 
 		--exits the script if we didn't connect properly
 			assert(dbh:connected());
@@ -76,12 +82,13 @@
 
 				--get the nodes
 					sql = "select * from v_access_control_nodes ";
-					sql = sql .. "where access_control_uuid = '"..row.access_control_uuid.."' ";
+					sql = sql .. "where access_control_uuid = :access_control_uuid";
+					local params = {access_control_uuid = row.access_control_uuid}
 					if (debug["sql"]) then
-						freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+						freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 					end
 					x = 0;
-					dbh:query(sql, function(field)
+					dbh:query(sql, params, function(field)
 						if (string.len(field.node_domain) > 0) then
 							table.insert(xml, [[					<node type="]] .. field.node_type .. [[" domain="]] .. field.node_domain .. [[" description="]] .. field.node_description .. [["/>]]);
 						else

resources/install/scripts/app/xml_handler/resources/scripts/configuration/callcenter.conf.lua

@@ -39,8 +39,8 @@
 	if (XML_STRING == "-ERR NOT FOUND") or (XML_STRING == "-ERR CONNECTION FAILURE") then
 
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			local Database = require "resources.functions.database";
+			dbh = Database.new('system');
 
 		--exits the script if we didn't connect properly
 			assert(dbh:connected());

resources/install/scripts/app/xml_handler/resources/scripts/configuration/conference.conf.lua

@@ -25,8 +25,14 @@
 --	POSSIBILITY OF SUCH DAMAGE.
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --exits the script if we didn't connect properly
 	assert(dbh:connected());
@@ -45,19 +51,20 @@
 	if (debug["sql"]) then
 		freeswitch.consoleLog("notice", "[conference_control] SQL: " .. sql .. "\n");
 	end
-	status = dbh:query(sql, function(field)
+	dbh:query(sql, function(field)
 		conference_control_uuid = field["conference_control_uuid"];
 		table.insert(xml, [[				<group name="]]..field["control_name"]..[[">]]);
 
 		--get the conference control details from the database
 		sql = [[SELECT * FROM v_conference_control_details
-			WHERE conference_control_uuid = ']] .. conference_control_uuid ..[['
+			WHERE conference_control_uuid = :conference_control_uuid
 			AND control_enabled = 'true' ]];
+		local params = {conference_control_uuid = conference_control_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("notice", "[conference_control] SQL: " .. sql .. "\n");
+			freeswitch.consoleLog("notice", "[conference_control] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 		end
 
-		status = dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--conference_control_uuid = row["conference_control_uuid"];
 			--conference_control_detail_uuid = row["conference_control_detail_uuid"];
 			table.insert(xml, [[					<control digits="]]..row["control_digits"]..[[" action="]]..row["control_action"]..[[" data="]]..row["control_data"]..[["/>]]);
@@ -74,19 +81,20 @@
 	if (debug["sql"]) then
 		freeswitch.consoleLog("notice", "[conference_profiles] SQL: " .. sql .. "\n");
 	end
-	status = dbh:query(sql, function(field)
+	dbh:query(sql, function(field)
 		conference_profile_uuid = field["conference_profile_uuid"];
 		table.insert(xml, [[				<profile name="]]..field["profile_name"]..[[">]]);
 
 		--get the conference profile parameters from the database
 		sql = [[SELECT * FROM v_conference_profile_params
-			WHERE conference_profile_uuid = ']] .. conference_profile_uuid ..[['
+			WHERE conference_profile_uuid = :conference_profile_uuid
 			AND profile_param_enabled = 'true' ]];
+		local params = {conference_profile_uuid = conference_profile_uuid};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("notice", "[conference_profiles] SQL: " .. sql .. "\n");
+			freeswitch.consoleLog("notice", "[conference_profiles] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 		end
 
-		status = dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--conference_profile_uuid = row["conference_profile_uuid"];
 			--conference_profile_param_uuid = row["conference_profile_param_uuid"];
 			--profile_param_description = row["profile_param_description"];

resources/install/scripts/app/xml_handler/resources/scripts/configuration/ivr.conf.lua

@@ -41,6 +41,10 @@
 		--required includes
 			local Database = require "resources.functions.database"
 			local Settings = require "resources.functions.lazy_settings"
+			local json
+			if (debug["sql"]) then
+				json = require "resources.functions.lunajson"
+			end
 
 		--set the sound prefix
 			sound_prefix = sounds_dir.."/${default_language}/${default_dialect}/${default_voice}/";
@@ -52,14 +56,15 @@
 			assert(dbh:connected());
 
 		--get the ivr menu from the database
-			sql = [[SELECT * FROM v_ivr_menus
-				WHERE ivr_menu_uuid = ']] .. ivr_menu_uuid ..[['
+			local sql = [[SELECT * FROM v_ivr_menus
+				WHERE ivr_menu_uuid = :ivr_menu_uuid
 				AND ivr_menu_enabled = 'true' ]];
+			local params = {ivr_menu_uuid = ivr_menu_uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[ivr_menu] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[ivr_menu] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
 
-			status = dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				domain_uuid = row["domain_uuid"];
 				ivr_menu_name = row["ivr_menu_name"];
 				ivr_menu_extension = row["ivr_menu_extension"];
@@ -109,13 +114,14 @@
 
 						if not file_exists(path) then
 							local sql = "SELECT recording_base64 FROM v_recordings " .. 
-								"WHERE domain_uuid = '" .. domain_uuid .. "' " ..
-								"AND recording_filename = '" .. name .. "' "
+								"WHERE domain_uuid = :domain_uuid " ..
+								"AND recording_filename = :name "
+							local params = {domain_uuid = domain_uuid, name = name};
 							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[ivr_menu] SQL: "..sql.."\n");
+								freeswitch.consoleLog("notice", "[ivr_menu] SQL: "..sql.."; params:" .. json.encode(params) .. "\n");
 							end
 
-							dbh:query(sql, function(row)
+							dbh:query(sql, params, function(row)
 							--get full path to recording
 								is_base64, name = true, path
 
@@ -226,11 +232,12 @@
 			table.insert(xml, [[				>]]);
 
 		--get the ivr menu options
-			sql = [[SELECT * FROM v_ivr_menu_options WHERE ivr_menu_uuid = ']] .. ivr_menu_uuid ..[[' ORDER BY ivr_menu_option_order asc ]];
+			local sql = [[SELECT * FROM v_ivr_menu_options WHERE ivr_menu_uuid = :ivr_menu_uuid ORDER BY ivr_menu_option_order asc ]];
+			local params = {ivr_menu_uuid = ivr_menu_uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[ivr_menu] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[ivr_menu] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 			end
-			status = dbh:query(sql, function(r)
+			dbh:query(sql, params, function(r)
 				ivr_menu_option_digits = r.ivr_menu_option_digits
 				ivr_menu_option_action = r.ivr_menu_option_action
 				ivr_menu_option_param = r.ivr_menu_option_param

resources/install/scripts/app/xml_handler/resources/scripts/configuration/local_stream.conf.lua

@@ -1,7 +1,7 @@
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
 
 --exits the script if we didn't connect properly
 	assert(dbh:connected());

resources/install/scripts/app/xml_handler/resources/scripts/configuration/sofia.conf.lua

@@ -41,8 +41,14 @@
 			end
 
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			local Database = require "resources.functions.database";
+			dbh = Database.new('system');
+
+		--include json library
+			local json
+			if (debug["sql"]) then
+				json = require "resources.functions.lunajson"
+			end
 
 		--exits the script if we didn't connect properly
 			assert(dbh:connected());
@@ -52,11 +58,12 @@
 				--get the domain_uuid
 					if (domain_name ~= nil) then
 						sql = "SELECT domain_uuid FROM v_domains ";
-						sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
+						sql = sql .. "WHERE domain_name = :domain_name";
+						local params = {domain_name = domain_name};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql, function(rows)
+						dbh:query(sql, params, function(rows)
 							domain_uuid = rows["domain_uuid"];
 						end);
 					end
@@ -88,14 +95,15 @@
 			sql = sql .. "from v_sip_profiles as p, v_sip_profile_settings as s ";
 			sql = sql .. "where s.sip_profile_setting_enabled = 'true' ";
 			sql = sql .. "and p.sip_profile_enabled = 'true' ";
-			sql = sql .. "and (p.sip_profile_hostname = '" .. hostname.. "' or p.sip_profile_hostname is null or p.sip_profile_hostname = '') ";
+			sql = sql .. "and (p.sip_profile_hostname = :hostname or p.sip_profile_hostname is null or p.sip_profile_hostname = '') ";
 			sql = sql .. "and p.sip_profile_uuid = s.sip_profile_uuid ";
 			sql = sql .. "order by p.sip_profile_name asc ";
+			local params = {hostname = hostname};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
 			end
 			x = 0;
-			dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				--set as variables
 					sip_profile_name = row.sip_profile_name;
 					--sip_profile_description = row.sip_profile_description;
@@ -117,19 +125,20 @@
 						--get the gateways
 							if (domain_count > 1) then
 								sql = "select * from v_gateways as g, v_domains as d ";
-								sql = sql .. "where g.profile = '"..sip_profile_name.."' ";
+								sql = sql .. "where g.profile = :profile ";
 								sql = sql .. "and g.enabled = 'true' ";
 								sql = sql .. "and (g.domain_uuid = d.domain_uuid or g.domain_uuid is null) ";
 							else
 								sql = "select * from v_gateways as g ";
-								sql = sql .. "where g.enabled = 'true' and g.profile = '"..sip_profile_name.."' ";
+								sql = sql .. "where g.enabled = 'true' and g.profile = :profile ";
 							end
-							sql = sql .. "and (g.hostname = '" .. hostname.. "' or g.hostname is null or g.hostname = '') ";
+							sql = sql .. "and (g.hostname = :hostname or g.hostname is null or g.hostname = '') ";
+							local params = {profile = sip_profile_name, hostname = hostname};
 							if (debug["sql"]) then
-								freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+								freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 							end
 							x = 0;
-							dbh:query(sql, function(field)
+							dbh:query(sql, params, function(field)
 								table.insert(xml, [[						<gateway name="]] .. string.lower(field.gateway_uuid) .. [[">]]);
 
 								if (string.len(field.username) > 0) then

resources/install/scripts/app/xml_handler/resources/scripts/dialplan/dialplan.lua

@@ -47,8 +47,14 @@
 	if not XML_STRING then
 
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			local Database = require "resources.functions.database";
+			dbh = Database.new('system');
+
+		--include json library
+			local json
+			if (debug["sql"]) then
+				json = require "resources.functions.lunajson"
+			end
 
 		--exits the script if we didn't connect properly
 			assert(dbh:connected());

resources/install/scripts/app/xml_handler/resources/scripts/directory/action/acl.lua

@@ -3,6 +3,12 @@
 	local log      = require "resources.functions.log"["directory_acl"]
 	local dbh = Database.new('system')
 
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
+
 --build the xml
 	local xml = {}
 	table.insert(xml, [[<?xml version="1.0" encoding="UTF-8" standalone="no"?>]])
@@ -13,18 +19,19 @@
 	local sql = "SELECT * FROM v_domains as d, v_extensions as e "
 	sql = sql .. "where d.domain_uuid = e.domain_uuid and e.cidr is not null and e.cidr <> '' "
 	if domain_name then
-		sql = sql .. "and d.domain_name = '"..domain_name.."' "
+		sql = sql .. "and d.domain_name = :domain_name "
 	else
 		sql = sql .. "order by d.domain_name"
 	end
+	local params = {domain_name = domain_name}
 
 	if debug['sql'] then
-		log.noticef("SQL - %s", sql)
+		log.noticef("SQL: %s; params: %s", sql, json.encode(params))
 	end
 
 	local prev_domain_name
 
-	dbh:query(sql, function(row)
+	dbh:query(sql, params, function(row)
 		if prev_domain_name ~= row.domain_name then
 			if prev_domain_name then
 				table.insert(xml, [[					</users>]])

resources/install/scripts/app/xml_handler/resources/scripts/directory/action/directory.lua

@@ -1,8 +1,15 @@
+
 --connect to the database
 	local Database = require "resources.functions.database"
 	local log      = require "resources.functions.log"["directory_dir"]
 	local dbh = Database.new('system')
 
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
+
 --build the xml
 	local xml = {}
 	table.insert(xml, [[<?xml version="1.0" encoding="UTF-8" standalone="no"?>]])
@@ -11,16 +18,17 @@
 
 --process when the sip profile is rescanned, sofia is reloaded, or sip redirect
 	local sql = "SELECT * FROM v_domains as d, v_extensions as e "
-	sql = sql .. "where d.domain_uuid = e.domain_uuid and "
-	sql = sql .. "(e.directory_visible = 'true' or e.directory_exten_visible='true') "
+	sql = sql .. "where d.domain_uuid = e.domain_uuid "
+	sql = sql .. "and (e.directory_visible = 'true' or e.directory_exten_visible='true') "
 	if domain_name then
-		sql = sql .. "and d.domain_name = '"..domain_name.."' "
+		sql = sql .. "and d.domain_name = :domain_name "
 	else
-		sql = sql .. "order by d.domain_name"
+		sql = sql .. "order by d.domain_name "
 	end
+	local sql_params = {domain_name = domain_name}
 
 	if debug['sql'] then
-		log.noticef("SQL - %s", sql)
+		log.noticef("SQL: %s; params: %s", sql, json.encode(sql_params))
 	end
 
 -- export this params
@@ -37,7 +45,7 @@
 
 	local prev_domain_name
 
-	dbh:query(sql, function(row)
+	dbh:query(sql, sql_params, function(row)
 		if prev_domain_name ~= row.domain_name then
 			if prev_domain_name then
 				table.insert(xml, [[					</users>]])

resources/install/scripts/app/xml_handler/resources/scripts/directory/action/domains.lua

@@ -25,8 +25,8 @@
 --	POSSIBILITY OF SUCH DAMAGE.
 
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
 
 --exits the script if we didn't connect properly
 	assert(dbh:connected());
@@ -36,7 +36,7 @@
 	table.insert(xml, [[<?xml version="1.0" encoding="UTF-8" standalone="no"?>]]);
 	table.insert(xml, [[<document type="freeswitch/xml">]]);
 	table.insert(xml, [[	<section name="directory">]]);
-	sql = "SELECT domain_name FROM v_domains ";
+	local sql = "SELECT domain_name FROM v_domains ";
 	dbh:query(sql, function(row)
 		table.insert(xml, [[		<domain name="]]..row.domain_name..[[" />]]);
 	end);

resources/install/scripts/app/xml_handler/resources/scripts/directory/action/group_call.lua

@@ -34,8 +34,14 @@
 --set the cache
 	if (XML_STRING == "-ERR NOT FOUND") then
 		--connect to the database
-			require "resources.functions.database_handle";
-			dbh = database_handle('system');
+			local Database = require "resources.functions.database";
+			local dbh = Database.new('system');
+
+		--include json library
+			local json
+			if (debug["sql"]) then
+				json = require "resources.functions.lunajson"
+			end
 
 		--exits the script if we didn't connect properly
 			assert(dbh:connected());
@@ -44,28 +50,35 @@
 			if (domain_uuid == nil) then
 				--get the domain_uuid
 					if (domain_name ~= nil) then
-						sql = "SELECT domain_uuid FROM v_domains ";
-						sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
+						local sql = "SELECT domain_uuid FROM v_domains ";
+						sql = sql .. "WHERE domain_name = :domain_name ";
+						local params = {domain_name = domain_name};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
 						end
-						status = dbh:query(sql, function(rows)
+						dbh:query(sql, params, function(rows)
 							domain_uuid = rows["domain_uuid"];
 						end);
 					end
 			end
 
+			if not domain_uuid then
+				freeswitch.consoleLog("warning", "[xml_handler] Can not find domain name: " .. tostring(domain_name) .. "\n");
+				return
+			end
+
 		--build the call group array
-			sql = [[
+			local sql = [[
 			select * from v_extensions
-			where domain_uuid = ']]..domain_uuid..[['
+			where domain_uuid = :domain_uuid
 			order by call_group asc
 			]];
+			local params = {domain_uuid = domain_uuid};
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+				freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params: " .. json.encode(params) .. "\n");
 			end
 			call_group_array = {};
-			status = dbh:query(sql, function(row)
+			dbh:query(sql, params, function(row)
 				call_group = row['call_group'];
 				--call_group = str_replace(";", ",", call_group);
 				tmp_array = explode(",", call_group);

resources/install/scripts/app/xml_handler/resources/scripts/directory/action/reverse-auth-lookup.lua

@@ -31,22 +31,32 @@
 		--group_call - call group has been called
 		--user_call - user has been called
 
+--get logger
+	local log = require "resources.functions.log".xml_handler;
+
 --connect to the database
-	require "resources.functions.database_handle";
-	dbh = database_handle('system');
+	local Database = require "resources.functions.database";
+	dbh = Database.new('system');
+
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
 
 --exits the script if we didn't connect properly
 	assert(dbh:connected());
 
 --get the domain_uuid
-	if (domain_uuid == nil and domain_name ~= nil) then
+	if (domain_uuid == nil) then
 		if (domain_name ~= nil) then
-			sql = "SELECT domain_uuid FROM v_domains ";
-			sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
+			local sql = "SELECT domain_uuid FROM v_domains ";
+			sql = sql .. "WHERE domain_name = :domain_name ";
+			local params = {domain_name = domain_name}
 			if (debug["sql"]) then
-				freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+				log.noticef("SQL: %s; params %s", sql, json.encode(params));
 			end
-			status = dbh:query(sql, function(rows)
+			dbh:query(sql, params, function(rows)
 				domain_uuid = rows["domain_uuid"];
 			end);
 		end
@@ -54,11 +64,14 @@
 
 --get the extension information
 	if (domain_uuid ~= nil) then
-		sql = "SELECT * FROM v_extensions WHERE domain_uuid = '" .. domain_uuid .. "' and (extension = '" .. user .. "' or number_alias = '" .. user .. "') and enabled = 'true' ";
+		local sql = "SELECT * FROM v_extensions WHERE domain_uuid = :domain_uuid "
+			.. "and (extension = :user or number_alias = :user) "
+			.. "and enabled = 'true' ";
+		local params = {domain_uuid=domain_uuid, user=user};
 		if (debug["sql"]) then
-			freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+			log.noticef("SQL: %s; params %s", sql, json.encode(params));
 		end
-		dbh:query(sql, function(row)
+		dbh:query(sql, params, function(row)
 			--general
 				domain_uuid = row.domain_uuid;
 				extension_uuid = row.extension_uuid;
@@ -83,7 +96,7 @@
 		table.insert(xml, [[<document type="freeswitch/xml">]]);
 		table.insert(xml, [[	<section name="directory">]]);
 		table.insert(xml, [[		<domain name="]] .. domain_name .. [[" alias="true">]]);
-		table.insert(xml, [[			<user id="]] .. extension .. [[">]]);
+		table.insert(xml, [[			<user id="]] .. extension .. [["]] .. number_alias .. [[>]]);
 		table.insert(xml, [[				<params>]]);
 		table.insert(xml, [[					<param name="reverse-auth-user" value="]] .. extension .. [["/>]]);
 		table.insert(xml, [[					<param name="reverse-auth-pass" value="]] .. password .. [["/>]]);

resources/install/scripts/app/xml_handler/resources/scripts/directory/directory.lua

@@ -1,6 +1,6 @@
 --	xml_handler.lua
 --	Part of FusionPBX
---	Copyright (C) 2013 - 2015 Mark J Crane <markjcrane@fusionpbx.com>
+--	Copyright (C) 2013 - 2016 Mark J Crane <markjcrane@fusionpbx.com>
 --	All rights reserved.
 --
 --	Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,12 @@
 	number_alias_string = "";
 	vm_mailto = "";
 
+--include json library
+	local json
+	if (debug["sql"]) then
+		json = require "resources.functions.lunajson"
+	end
+
 -- event source
 	local event_calling_function = params:getHeader("Event-Calling-Function")
 	local event_calling_file = params:getHeader("Event-Calling-File")
@@ -70,26 +76,63 @@
 			--all other directory actions: sip_auth, user_call
 			--except for the action: group_call
 
+		-- Do we need use proxy to make call to ext. reged on different FS
+		--   true - send call to FS where ext reged
+		--   false - send call directly to ext
+			local USE_FS_PATH = xml_handler and xml_handler["fs_path"]
+
+		-- Make sance only for extensions with number_alias
+		--  false - you should register with AuthID=UserID=Extension (default)
+		--  true  - you should register with AuthID=Extension and UserID=Number Alias
+		-- 	also in this case you need 2 records in memcache for one extension
+			local DIAL_STRING_BASED_ON_USERID = xml_handler and xml_handler["reg_as_number_alias"]
+
+		-- Use number as presence_id
+		-- When you have e.g. extension like `user-100` with number-alias `100`
+		-- by default presence_id is `user-100`. This option allow use `100` as presence_id
+			local NUMBER_AS_PRESENCE_ID = xml_handler and xml_handler["number_as_presence_id"]
+
+			local sip_auth_method = params:getHeader("sip_auth_method")
+			if sip_auth_method then
+				sip_auth_method = sip_auth_method:upper();
+			end
+
+		-- Get UserID. If used UserID ~= AuthID then we have to disable `inbound-reg-force-matching-username`
+		-- on sofia profile and check UserID=Number-Alias and AuthID=Extension on register manually.
+		-- But in load balancing mode in proxy INVITE we have UserID equal to origin UserID but 
+		-- AuthID equal to callee AuthID. (e.g. 105 call to 100 and one FS forward call to other FS
+		-- then we have UserID=105 but AuthID=100).
+		-- Because we do not verify source of INVITE (FS or user device) we have to accept any UserID
+		-- for INVITE in such mode. So we just substitute correct UserID for check.
+		-- !!! NOTE !!! do not change USE_FS_PATH before this check.
+			local from_user = params:getHeader("sip_from_user")
+			if USE_FS_PATH and sip_auth_method == 'INVITE' then
+				from_user = user
+			end
+
+		-- Check eather we need build dial-string. Before request dial-string FusionPBX set `dialed_extension`
+		-- variable. So if we have no such variable we do not need build dial-string.
+			dialed_extension = params:getHeader("dialed_extension");
+			if (dialed_extension == nil) then
+				-- freeswitch.consoleLog("notice", "[xml_handler-directory.lua] dialed_extension is null\n");
+				USE_FS_PATH = false;
+			else
+				-- freeswitch.consoleLog("notice", "[xml_handler-directory.lua] dialed_extension is " .. dialed_extension .. "\n");
+			end
+
+			-- verify from_user and number alias for this methods
+			local METHODS = {
+				-- _ANY_    = true,
+				REGISTER = true,
+				-- INVITE   = true,
+			}
+
 			if (user == nil) then
 				user = "";
 			end
 
-		--get the cache
-			if (trim(api:execute("module_exists", "mod_memcache")) == "true") then
-				if (domain_name) then
-					XML_STRING = trim(api:execute("memcache", "get directory:" .. user .. "@" .. domain_name));
-				end
-				if (XML_STRING == "-ERR NOT FOUND") or (XML_STRING == "-ERR CONNECTION FAILURE") then
-					source = "database";
-					continue = true;
-				else
-					source = "cache";
-					continue = true;
-				end
-			else
-				XML_STRING = "";
-				source = "database";
-				continue = true;
+			if (from_user == "") or (from_user == nil) then
+				from_user = user
 			end
 
 		--prevent processing for invalid user
@@ -98,27 +141,58 @@
 				continue = false;
 			end
 
+		-- cleanup
+			XML_STRING = nil;
+
+		-- get the cache. We can use cache only if we do not use `fs_path`
+		-- or we do not need dial-string. In other way we have to use database.
+			if (continue) and (not USE_FS_PATH) then
+				if (trim(api:execute("module_exists", "mod_memcache")) == "true") then
+					if (domain_name) then
+						local key = "directory:" .. (from_user or user) .. "@" .. domain_name
+						XML_STRING = trim(api:execute("memcache", "get " .. key));
+
+						if debug['cache'] then
+							if XML_STRING:sub(1, 4) == '-ERR' then
+								freeswitch.consoleLog("notice", "[xml_handler-directory][memcache] get key: " .. key .. " fail: " .. XML_STRING .. "\n")
+							else
+								freeswitch.consoleLog("notice", "[xml_handler-directory][memcache] get key: " .. key .. " pass!" .. "\n")
+							end
+						end
+					else
+						XML_STRING = "-ERR NOT FOUND"
+					end
+					if (XML_STRING == "-ERR NOT FOUND") or (XML_STRING == "-ERR CONNECTION FAILURE") then
+						source = "database";
+						continue = true;
+					else
+						source = "cache";
+						continue = true;
+					end
+				else
+					XML_STRING = "";
+					source = "database";
+					continue = true;
+				end
+			end
+
 		--show the params in the console
 			--if (params:serialize() ~= nil) then
 			--	freeswitch.consoleLog("notice", "[xml_handler-directory.lua] Params:\n" .. params:serialize() .. "\n");
 			--end
 
-		--set the variable from the params
-			dialed_extension = params:getHeader("dialed_extension");
-			if (dialed_extension == nil) then
-				--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] dialed_extension is null\n");
-				xml_handler["fs_path"] = false;
-			else
-				--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] dialed_extension is " .. dialed_extension .. "\n");
-			end
-
+			local loaded_from_db = false
 		--build the XML string from the database
-			if (source == "database") or (xml_handler["fs_path"]) then
+			if (source == "database") or (USE_FS_PATH) then
+				loaded_from_db = true
+
+				--include Database class
+					local Database = require "resources.functions.database";
+
 				--database connection
 					if (continue) then
 						--connect to the database
-							require "resources.functions.database_handle";
-							dbh = database_handle('system');
+							dbh = Database.new('system');
 
 						--exits the script if we didn't connect properly
 							assert(dbh:connected());
@@ -127,12 +201,13 @@
 							if (domain_uuid == nil) then
 								--get the domain_uuid
 									if (domain_name ~= nil) then
-										sql = "SELECT domain_uuid FROM v_domains ";
-										sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
+										local sql = "SELECT domain_uuid FROM v_domains "
+											.. "WHERE domain_name = :domain_name ";
+										local params = {domain_name = domain_name};
 										if (debug["sql"]) then
-											freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+											freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 										end
-										status = dbh:query(sql, function(rows)
+										dbh:query(sql, params, function(rows)
 											domain_uuid = rows["domain_uuid"];
 										end);
 									end
@@ -146,13 +221,17 @@
 
 				--if load balancing is set to true then get the hostname
 					if (continue) then
-						if (xml_handler["fs_path"]) then
+						if (USE_FS_PATH) then
 
 							--get the domain_name from domains
 								if (domain_name == nil) then
-									sql = "SELECT domain_name FROM v_domains ";
-									sql = sql .. "WHERE domain_uuid = '" .. domain_uuid .. "' ";
-									status = dbh:query(sql, function(row)
+									local sql = "SELECT domain_name FROM v_domains "
+										.. "WHERE domain_uuid = :domain_uuid ";
+									local params = {domain_uuid = domain_uuid};
+									if (debug["sql"]) then
+										freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+									end
+									dbh:query(sql, params, function(row)
 										domain_name = row["domain_name"];
 									end);
 								end
@@ -165,33 +244,37 @@
 								require "resources.functions.file_exists";
 
 							--connect to the switch database
-								if (file_exists(database_dir.."/core.db")) then
-									--dbh_switch = freeswitch.Dbh("core:core"); -- when using sqlite
-									dbh_switch = freeswitch.Dbh("sqlite://"..database_dir.."/core.db");
-								else
-									require "resources.functions.database_handle";
-									dbh_switch = database_handle('switch');
+								dbh_switch = Database.new('switch');
+
+							--get register name
+								local reg_user = dialed_extension
+								if not DIAL_STRING_BASED_ON_USERID then
+									reg_user = trim(api:execute("user_data", dialed_extension .. "@" .. domain_name .. " attr id"));
 								end
 
 							--get the destination hostname from the registration
-								sql = "SELECT hostname FROM registrations ";
-								sql = sql .. "WHERE reg_user = '"..dialed_extension.."' ";
-								sql = sql .. "AND realm = '"..domain_name.."' ";
+								local params = {reg_user=reg_user, domain_name=domain_name}
+								local sql = "SELECT hostname FROM registrations "
+									.. "WHERE reg_user = :reg_user "
+									.. "AND realm = :domain_name ";
 								if (database["type"] == "mysql") then
-									now = os.time();
-									sql = sql .. "AND expires > "..now;
+									params.now = os.time();
+									sql = sql .. "AND expires > :now ";
 								else
-									sql = sql .. "AND to_timestamp(expires) > NOW()";
+									sql = sql .. "AND to_timestamp(expires) > NOW() ";
 								end
-								status = dbh_switch:query(sql, function(row)
+								if (debug["sql"]) then
+									freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
+								end
+								dbh_switch:query(sql, params, function(row)
 									database_hostname = row["hostname"];
 								end);
 								--freeswitch.consoleLog("notice", "[xml_handler] sql: " .. sql .. "\n");
 								--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] database_hostname is " .. database_hostname .. "\n");
 
-							--hostname was not found set xml_handler["fs_path"] to false to prevent a database_hostname concatenation error
+							--hostname was not found set USE_FS_PATH to false to prevent a database_hostname concatenation error
 								if (database_hostname == nil) then
-									xml_handler["fs_path"] = false;
+									USE_FS_PATH = false;
 								end
 
 							--close the database connection
@@ -201,12 +284,15 @@
 
 				--get the extension from the database
 					if (continue) then
-						sql = "SELECT * FROM v_extensions WHERE domain_uuid = '" .. domain_uuid .. "' and (extension = '" .. user .. "' or number_alias = '" .. user .. "') and enabled = 'true' ";
+						local sql = "SELECT * FROM v_extensions WHERE domain_uuid = :domain_uuid "
+							.. "and (extension = :user or number_alias = :user) "
+							.. "and enabled = 'true' ";
+						local params = {domain_uuid=domain_uuid, user=user};
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
 						continue = false;
-						dbh:query(sql, function(row)
+						dbh:query(sql, params, function(row)
 							--general
 								continue = true;
 								domain_uuid = row.domain_uuid;
@@ -265,30 +351,48 @@
 
 								do_not_disturb = row.do_not_disturb;
 
+							-- check matching UserID and AuthName
+								if sip_auth_method then
+									local check_from_number = METHODS[sip_auth_method] or METHODS._ANY_
+									if DIAL_STRING_BASED_ON_USERID then
+										continue = (sip_from_user == user) and ((not check_from_number) or (from_user == sip_from_number))
+									else
+										continue = (sip_from_user == user) and ((not check_from_number) or (from_user == user))
+									end
+
+									if not continue then
+										XML_STRING = nil;
+										return 1;
+									end
+								end
+
+							--set the presence_id
+								presence_id = (NUMBER_AS_PRESENCE_ID and sip_from_number or sip_from_user) .. "@" .. domain_name;
+
 							--set the dial_string
 								if (string.len(row.dial_string) > 0) then
 									dial_string = row.dial_string;
 								else
+										local destination = (DIAL_STRING_BASED_ON_USERID and sip_from_number or sip_from_user) .. "@" .. domain_name;
 									--set a default dial string
 										if (dial_string == null) then
-											dial_string = "{sip_invite_domain=" .. domain_name .. ",presence_id=" .. user .. "@" .. domain_name .. "}${sofia_contact(" .. extension .. "@" .. domain_name .. ")}";
+											dial_string = "{sip_invite_domain=" .. domain_name .. ",presence_id=" .. presence_id .. "}${sofia_contact(" .. destination .. ")}";
 										end
 									--set the an alternative dial string if the hostnames don't match
-										if (xml_handler["fs_path"]) then
+										if (USE_FS_PATH) then
 											if (local_hostname == database_hostname) then
 												freeswitch.consoleLog("notice", "[xml_handler-directory.lua] local_host and database_host are the same\n");
 											else
-												--sofia/internal/${user_data(${destination_number}@${domain_name} attr id)}@${domain_name};fs_path=sip:server
-												user_id = trim(api:execute("user_data", user .. "@" .. domain_name .. " attr id"));
-												dial_string = "{sip_invite_domain=" .. domain_name .. ",presence_id=" .. user .. "@" .. domain_name .. "}sofia/internal/" .. user_id .. "@" .. domain_name .. ";fs_path=sip:" .. database_hostname;
+												local profile, proxy = "internal", database_hostname;
+												dial_string = "{sip_invite_domain=" .. domain_name .. ",presence_id=" .. presence_id .."}sofia/" .. profile .. "/" .. destination .. ";fs_path=sip:" .. proxy;
 												--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] dial_string " .. dial_string .. "\n");
 											end
 										else
-											--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] seems balancing is false??" .. tostring(xml_handler["fs_path"]) .. "\n");
+											--freeswitch.consoleLog("notice", "[xml_handler-directory.lua] seems balancing is false??" .. tostring(USE_FS_PATH) .. "\n");
 										end
 
 									--show debug informationa
-										if (xml_handler["fs_path"]) then
+										if (USE_FS_PATH) then
 											freeswitch.consoleLog("notice", "[xml_handler] local_hostname: " .. local_hostname.. " database_hostname: " .. database_hostname .. " dial_string: " .. dial_string .. "\n");
 										end
 								end
@@ -298,15 +402,17 @@
 				--get the voicemail from the database
 					if (continue) then
 						vm_enabled = "true";
-						if tonumber(user) == nil then
-   							sql = "SELECT * FROM v_voicemails WHERE domain_uuid = '" .. domain_uuid .. "' and voicemail_id = '" .. number_alias .. "' ";
+						local sql = "SELECT * FROM v_voicemails WHERE domain_uuid = :domain_uuid and voicemail_id = :voicemail_id ";
+						local params = {domain_uuid = domain_uuid};
+						if number_alias and #number_alias > 0 then
+							params.voicemail_id = number_alias;
 						else
-							sql = "SELECT * FROM v_voicemails WHERE domain_uuid = '" .. domain_uuid .. "' and voicemail_id = '" .. user .. "' ";
+							params.voicemail_id = user;
 						end
 						if (debug["sql"]) then
-							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
+							freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 						end
-						dbh:query(sql, function(row)
+						dbh:query(sql, params, function(row)
 							if (string.len(row.voicemail_enabled) > 0) then
 								vm_enabled = row.voicemail_enabled;
 							end
@@ -389,6 +495,7 @@
 							table.insert(xml, [[								<variable name="call_timeout" value="]] .. call_timeout .. [["/>]]);
 							table.insert(xml, [[								<variable name="caller_id_name" value="]] .. sip_from_user .. [["/>]]);
 							table.insert(xml, [[								<variable name="caller_id_number" value="]] .. sip_from_number .. [["/>]]);
+							table.insert(xml, [[								<variable name="presence_id" value="]] .. presence_id .. [["/>]]);
 							if (string.len(call_group) > 0) then
 								table.insert(xml, [[								<variable name="call_group" value="]] .. call_group .. [["/>]]);
 							end
@@ -517,14 +624,26 @@
 							dbh:release();
 
 						--set the cache
-							if (user and domain_name) then
-								result = trim(api:execute("memcache", "set directory:" .. user .. "@" .. domain_name .. " '"..XML_STRING:gsub("'", "&#39;").."' "..expire["directory"]));
+							local key = "directory:" .. sip_from_number .. "@" .. domain_name
+							if debug['cache'] then
+								freeswitch.consoleLog("notice", "[xml_handler-directory][memcache] set key: " .. key .. "\n")
+							end
+							result = trim(api:execute("memcache", "set " .. key .. " '"..XML_STRING:gsub("'", "&#39;").."' "..expire["directory"]));
+
+							if sip_from_number ~= sip_from_user then
+								key = "directory:" .. sip_from_user .. "@" .. domain_name
+								if debug['cache'] then
+									freeswitch.consoleLog("notice", "[xml_handler-directory][memcache] set key: " .. key .. "\n")
+								end
+								result = trim(api:execute("memcache", "set " .. key .. " '"..XML_STRING:gsub("'", "&#39;").."' "..expire["directory"]));
 							end
 
-						--save to the conf directory
-							--local file = assert(io.open(conf_dir .. "/directory/" .. user .. "@" .. domain_name .. ".xml.cache", "w"));
-							--file:write(XML_STRING);
-							--file:close();
+						--send the xml to the console
+							if (debug["xml_string"]) then
+								local file = assert(io.open(temp_dir .. "/" .. user .. "@" .. domain_name .. ".xml", "w"));
+								file:write(XML_STRING);
+								file:close();
+							end
 
 						--send to the console
 							if (debug["cache"]) then
@@ -533,10 +652,22 @@
 					end
 			end
 
-		--disable registration for number-alias
-			if (params:getHeader("sip_auth_method") == "REGISTER") then
-				if (api:execute("user_data", user .. "@" .. domain_name .." attr id") ~= user) then
+			if XML_STRING and (not loaded_from_db) and sip_auth_method then
+				local user_id = api:execute("user_data", from_user .. "@" .. domain_name .." attr id")
+				if user_id ~= user then
 					XML_STRING = nil;
+				elseif METHODS[sip_auth_method] or METHODS._ANY_ then
+					local alias
+					if DIAL_STRING_BASED_ON_USERID then
+						alias = api:execute("user_data", from_user .. "@" .. domain_name .." attr number-alias")
+					end
+					if alias and #alias > 0 then
+						if from_user ~= alias then
+							XML_STRING = nil
+						end
+					elseif from_user ~= user_id then
+						XML_STRING = nil;
+					end
 				end
 			end
 

resources/install/scripts/app/xml_handler/resources/scripts/languages/languages.lua

@@ -67,29 +67,35 @@
 	--build the XML string from the database
 		if (source == "database") then
 
-			--database connection
+			--connect to the database
+				local Database = require "resources.functions.database";
+				dbh = Database.new('system');
+
+			--include json library
+				local json
+				if (debug["sql"]) then
+					json = require "resources.functions.lunajson"
+				end
+
+			--exits the script if we didn't connect properly
+				assert(dbh:connected());
+
+			--get the domain_uuid
 				if (continue) then
-					--connect to the database
-						require "resources.functions.database_handle";
-						dbh = database_handle('system');
-
-					--exits the script if we didn't connect properly
-						assert(dbh:connected());
-
-					--get the domain_uuid
-						if (domain_uuid == nil) then
-							--get the domain_uuid
-								if (domain_name ~= nil) then
-									sql = "SELECT domain_uuid FROM v_domains ";
-									sql = sql .. "WHERE domain_name = '" .. domain_name .."' ";
-									if (debug["sql"]) then
-										freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
-									end
-									status = dbh:query(sql, function(rows)
-										domain_uuid = rows["domain_uuid"];
-									end);
+					if (domain_uuid == nil) then
+						--get the domain_uuid
+							if (domain_name ~= nil) then
+								local sql = "SELECT domain_uuid FROM v_domains ";
+								sql = sql .. "WHERE domain_name = :domain_name ";
+								local params = {domain_name = domain_name};
+								if (debug["sql"]) then
+									freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "; params:" .. json.encode(params) .. "\n");
 								end
-						end
+								dbh:query(sql, params, function(rows)
+									domain_uuid = rows["domain_uuid"];
+								end);
+							end
+					end
 				end
 
 			--prevent processing for invalid domains
@@ -113,20 +119,21 @@
 								table.insert(xml, [[			<phrases>]]);
 								table.insert(xml, [[				<macros>]]);
 
-								sql = "SELECT * FROM v_phrases as p, v_phrase_details as d ";
-								sql = sql .. "WHERE d.domain_uuid = '" .. domain_uuid .. "' ";
-								sql = sql .. "AND p.phrase_uuid = '".. macro_name .."' ";
-								sql = sql .. "AND p.phrase_language = '".. language .."' ";
+								local sql = "SELECT * FROM v_phrases as p, v_phrase_details as d ";
+								sql = sql .. "WHERE d.domain_uuid = :domain_uuid ";
+								sql = sql .. "AND p.phrase_uuid = :macro_name ";
+								sql = sql .. "AND p.phrase_language = :language ";
 								sql = sql .. "AND p.phrase_uuid = d.phrase_uuid ";
 								sql = sql .. "AND p.phrase_enabled = 'true' ";
 								sql = sql .. "ORDER BY d.domain_uuid, p.phrase_uuid, d.phrase_detail_order ASC ";
+								local params = {domain_uuid = domain_uuid, macro_name = macro_name, language = language};
 								if (debug["sql"]) then
 									freeswitch.consoleLog("notice", "[xml_handler] SQL: " .. sql .. "\n");
 								end
 								previous_phrase_uuid = "";
 								match_tag = "open";
 								x = 0;
-								dbh:query(sql, function(row)
+								dbh:query(sql, params, function(row)
 									--phrase_uuid,domain_uuid,phrase_name,phrase_language
 									--phrase_description,phrase_enabled,phrase_detail_uuid
 									--phrase_detail_group,phrase_detail_tag,phrase_detail_pattern