$createdBy=$modx->user->get('id');
$flds = array(
'pagetitle' => $title,
'longtitle' => $longtitle,
'description' => $description,
'introtext' => $introtext,
'alias' => $alias,
'parent' => $folder,
'createdon' => $createdon,
'createdby' => $createdBy,
'editedon' => '0',
'editedby' => '0',
'published' => $published,
'pub_date' => $pub_date,
'unpub_date' => $unpub_date,
'deleted' => '0',
'hidemenu' => $hidemenu,
'menuindex' => $mnuidx,
'template' => $template,
'content' => $header.$content.$footer
);
$resource = $modx->newObject('modResource',$flds);
$resource->save();
$resource->set('fieldName',$value);
MODX Staff
'createdby' => ($userid>0 ? $userid * -1:0)
mysql_escape_string($header.$content.$footer)
'createdby' => ($userid>0 ? $userid * -1:0)
mysql_escape_string($header.$content.$footer)
*blink*
I think that is Evo code you are demonstrating there...
MODX Staff
You don’t need to use anything if you are using bound parameters with prepared statements, as save()’ing xPDOObjects does. Prepared statements automatically PDO::quote() the values you bind. If you were to author direct SQL and not use a prepared statement, you could manually call $modx->quote($userInput), but again, this is not necessary in the form you are using here.
Oops. I swiped the code from the unfinished NewsPublisher snippet I’m working on. What should mysql_escape_string() be in Revo?
