PHP F_escape_sql函数代码示例

/**
 * Prepare field value for SQL query.<br>
 * Returns the num if different from zero, NULL otherwise.
 * @param $num (string) string to check.
 * @return string $num if != 0, NULL otherwise
 */
function F_zero_to_null($num)
{
    require_once '../../shared/code/tce_db_dal.php';
    if ($num == 0) {
        return 'NULL';
    }
    return F_escape_sql($num);
}

            if (!F_check_unique(K_TABLE_ATTRIBUTE_TYPES, 'atb_name=\'' . F_escape_sql($atb_name) . '\'')) {
                F_print_error('WARNING', $l['m_duplicate_name']);
                $formstatus = FALSE;
                F_stripslashes_formfields();
                break;
            }
            $sql = 'INSERT INTO ' . K_TABLE_ATTRIBUTE_TYPES . ' (
				atb_name,
				atb_description,
				atb_type,
				atb_default
				) VALUES (
				\'' . F_escape_sql($atb_name) . '\',
				' . F_empty_to_null($atb_description) . ',
				\'' . F_escape_sql($atb_type) . '\',
				\'' . F_escape_sql($atb_default) . '\'
				)';
            if (!($r = F_db_query($sql, $db))) {
                F_display_db_error(false);
            } else {
                $atb_id = F_db_insert_id($db, K_TABLE_ATTRIBUTE_TYPES, 'atb_id');
            }
        }
        break;
    case 'clear':
        // Clear form fields
        $atb_name = '';
        $atb_description = '';
        $atb_type = '';
        $atb_default = '';
        break;

            if (!F_check_unique(K_TABLE_CABLES, 'cab_a_obj_id=' . $cab_a_obj_id . ' AND cab_b_obj_id=' . $cab_b_obj_id . ' AND cab_cbt_id=' . $cab_cbt_id)) {
                F_print_error('WARNING', $l['m_duplicate_connection']);
                $formstatus = false;
                F_stripslashes_formfields();
                break;
            }
            $sql = 'INSERT INTO ' . K_TABLE_CABLES . ' (
				cab_a_obj_id,
				cab_b_obj_id,
				cab_cbt_id,
				cab_color
				) VALUES (
				' . $cab_a_obj_id . ',
				' . $cab_b_obj_id . ',
				' . $cab_cbt_id . ',
				\'' . F_escape_sql($cab_color) . '\'
				)';
            if (!($r = F_db_query($sql, $db))) {
                F_display_db_error(false);
            }
            $cab_ids = $cab_a_obj_id . '|' . $cab_b_obj_id . '|' . $cab_cbt_id;
            $sel_a_obj_id = $cab_a_obj_id;
            $sel_b_obj_id = $cab_b_obj_id;
            $sel_cbt_id = $cab_cbt_id;
        }
        break;
    case 'clear':
        // Clear form fields
        $cbt_name = '';
        $cab_color = 'd3d3d3';
        break;

echo '<input type="text" name="searchterms" id="searchterms" value="' . htmlspecialchars($searchterms, ENT_COMPAT, $l['a_meta_charset']) . '" size="20" maxlength="255" title="' . $l['w_search_keywords'] . '" />';
F_submit_button('search', $l['w_search'], $l['w_search']);
echo '</div>' . K_NEWLINE;
// build a search query
if (strlen($searchterms) > 0) {
    $searchterms = trim($searchterms);
    if (preg_match("/^([0-9A-F]{2})[\\:\\-]([0-9A-F]{2})[\\:\\-]([0-9A-F]{2})/i", $searchterms, $matches) > 0) {
        // MAC address
        $mac = strtoupper($matches[1] . $matches[2] . $matches[3]);
        $sql = 'SELECT mnf_id, mnf_name FROM ' . K_TABLE_MANUFACTURES . ', ' . K_TABLE_MANUFACTURES_MAC . ' WHERE mnf_id=mac_mnf_id AND mac_mac=\'' . $mac . '\' ORDER BY mnf_name ASC';
    } else {
        $wherequery = '';
        $terms = preg_split("/[\\s]+/i", $searchterms);
        // Get all the words into an array
        foreach ($terms as $word) {
            $word = F_escape_sql($word);
            $wherequery .= ' AND (mnf_name LIKE \'%' . $word . '%\')';
        }
        $wherequery = substr($wherequery, 5);
        $sql = 'SELECT * FROM ' . K_TABLE_MANUFACTURES . ' WHERE ' . $wherequery . ' ORDER BY mnf_name ASC';
    }
} else {
    $sql = 'SELECT mnf_id, mnf_name FROM ' . K_TABLE_MANUFACTURES . ' ORDER BY mnf_name ASC';
}
if ($r = F_db_query($sql, $db)) {
    echo '<ul>' . K_NEWLINE;
    while ($m = F_db_fetch_array($r)) {
        // on click the manufacturer ID will be returned on the calling form field
        $jsaction = 'javascript:window.opener.document.getElementById(\'' . $cid . '\').value=' . $m['mnf_id'] . ';';
        $jsaction .= 'window.opener.document.getElementById(\'' . $cid . '\').onchange();';
        $jsaction .= 'window.close();';

}
switch ($menu_mode) {
    case 'update':
        // Update
        if ($formstatus = F_check_form_fields()) {
            if (isset($testlog_score) and isset($max_score)) {
                // score cannot be greater than max_score
                $testlog_score = floatval($testlog_score);
                $max_score = floatval($max_score);
                if ($testlog_score > $max_score) {
                    F_print_error('WARNING', $l['m_score_higher_than_max']);
                    break;
                }
                $sql = 'UPDATE ' . K_TABLE_TESTS_LOGS . ' SET
					testlog_score=' . $testlog_score . ',
					testlog_comment=\'' . F_escape_sql($db, $testlog_comment) . '\'
					WHERE testlog_id=' . $testlog_id . '';
                if (!($r = F_db_query($sql, $db))) {
                    F_display_db_error(false);
                } else {
                    F_print_error('MESSAGE', $l['m_updated']);
                    $testlog_score = '';
                    $testlog_id = '';
                    $testlog_comment = '';
                }
            }
        }
        break;
    default:
        break;
}

/**
 * Display online users.
 * @author Nicola Asuni
 * @since 2001-10-18
 * @param $wherequery (string) users selection query
 * @param $order_field (string) order by column name
 * @param $orderdir (int) oreder direction
 * @param $firstrow (int) number of first row to display
 * @param $rowsperpage (int) number of rows per page
 * @return false in case of empty database, true otherwise
 */
function F_list_online_users($wherequery, $order_field, $orderdir, $firstrow, $rowsperpage)
{
    global $l, $db;
    require_once '../config/tce_config.php';
    require_once '../../shared/code/tce_functions_page.php';
    require_once 'tce_functions_user_select.php';
    //initialize variables
    $orderdir = intval($orderdir);
    $firstrow = intval($firstrow);
    $rowsperpage = intval($rowsperpage);
    // order fields for SQL query
    if (empty($order_field) or !in_array($order_field, array('cpsession_id', 'cpsession_data'))) {
        $order_field = 'cpsession_expiry';
    }
    if ($orderdir == 0) {
        $nextorderdir = 1;
        $full_order_field = $order_field;
    } else {
        $nextorderdir = 0;
        $full_order_field = $order_field . ' DESC';
    }
    if (!F_count_rows(K_TABLE_SESSIONS)) {
        //if the table is void (no items) display message
        echo '<h2>' . $l['m_databasempty'] . '</h2>';
        return FALSE;
    }
    if (empty($wherequery)) {
        $sql = 'SELECT * FROM ' . K_TABLE_SESSIONS . ' ORDER BY ' . $full_order_field . '';
    } else {
        $wherequery = F_escape_sql($db, $wherequery);
        $sql = 'SELECT * FROM ' . K_TABLE_SESSIONS . ' ' . $wherequery . ' ORDER BY ' . $full_order_field . '';
    }
    if (K_DATABASE_TYPE == 'ORACLE') {
        $sql = 'SELECT * FROM (' . $sql . ') WHERE rownum BETWEEN ' . $firstrow . ' AND ' . ($firstrow + $rowsperpage) . '';
    } else {
        $sql .= ' LIMIT ' . $rowsperpage . ' OFFSET ' . $firstrow . '';
    }
    echo '<div class="container">' . K_NEWLINE;
    echo '<table class="userselect">' . K_NEWLINE;
    echo '<tr>' . K_NEWLINE;
    echo '<th>' . $l['w_user'] . '</th>' . K_NEWLINE;
    echo '<th>' . $l['w_level'] . '</th>' . K_NEWLINE;
    echo '<th>' . $l['w_ip'] . '</th>' . K_NEWLINE;
    echo '</tr>' . K_NEWLINE;
    if ($r = F_db_query($sql, $db)) {
        while ($m = F_db_fetch_array($r)) {
            $this_session = F_session_string_to_array($m['cpsession_data']);
            echo '<tr>';
            echo '<td align="left">';
            $user_str = '';
            if ($this_session['session_user_lastname']) {
                $user_str .= urldecode($this_session['session_user_lastname']) . ', ';
            }
            if ($this_session['session_user_firstname']) {
                $user_str .= urldecode($this_session['session_user_firstname']) . '';
            }
            $user_str .= ' (' . urldecode($this_session['session_user_name']) . ')';
            if (F_isAuthorizedEditorForUser($this_session['session_user_id'])) {
                echo '<a href="tce_edit_user.php?user_id=' . $this_session['session_user_id'] . '">' . $user_str . '</a>';
            } else {
                echo $user_str;
            }
            echo '</td>';
            echo '<td>' . $this_session['session_user_level'] . '</td>';
            echo '<td>' . $this_session['session_user_ip'] . '</td>';
            echo '</tr>' . K_NEWLINE;
        }
    } else {
        F_display_db_error();
    }
    echo '</table>' . K_NEWLINE;
    // --- ------------------------------------------------------
    // --- page jump
    if ($rowsperpage > 0) {
        $sql = 'SELECT count(*) AS total FROM ' . K_TABLE_SESSIONS . ' ' . $wherequery . '';
        if (!empty($order_field)) {
            $param_array = '&amp;order_field=' . urlencode($order_field) . '';
        }
        if (!empty($orderdir)) {
            $param_array .= '&amp;orderdir=' . $orderdir . '';
        }
        $param_array .= '&amp;submitted=1';
        F_show_page_navigator($_SERVER['SCRIPT_NAME'], $sql, $firstrow, $rowsperpage, $param_array);
    }
    echo '<div class="pagehelp">' . $l['hp_online_users'] . '</div>' . K_NEWLINE;
    echo '</div>' . K_NEWLINE;
    return TRUE;
}

        if ($formstatus = F_check_form_fields()) {
            // check if name is unique
            if (!F_check_unique(K_TABLE_SUBJECTS, 'subject_name=\'' . F_escape_sql($db, $subject_name) . '\' AND subject_module_id=' . $subject_module_id . '')) {
                F_print_error('WARNING', $l['m_duplicate_name']);
                $formstatus = FALSE;
                F_stripslashes_formfields();
                break;
            }
            $sql = 'INSERT INTO ' . K_TABLE_SUBJECTS . ' (
				subject_name,
				subject_description,
				subject_enabled,
				subject_user_id,
				subject_module_id
				) VALUES (
				\'' . F_escape_sql($db, $subject_name) . '\',
				' . F_empty_to_null($subject_description) . ',
				\'' . intval($subject_enabled) . '\',
				\'' . intval($_SESSION['session_user_id']) . '\',
				' . $subject_module_id . '
				)';
            if (!($r = F_db_query($sql, $db))) {
                F_display_db_error(false);
            } else {
                $subject_id = F_db_insert_id($db, K_TABLE_SUBJECTS, 'subject_id');
            }
        }
        break;
    case 'clear':
        // Clear form fields
        $subject_name = '';

                    $_SESSION['session_user_name'] = $m['user_name'];
                    $_SESSION['session_user_ip'] = getNormalizedIP($_SERVER['REMOTE_ADDR']);
                    $_SESSION['session_user_level'] = $m['user_level'];
                    $_SESSION['session_user_firstname'] = urlencode($m['user_firstname']);
                    $_SESSION['session_user_lastname'] = urlencode($m['user_lastname']);
                    // read client cookie
                    if (isset($_COOKIE['LastVisit'])) {
                        $_SESSION['session_last_visit'] = intval($_COOKIE['LastVisit']);
                    } else {
                        $_SESSION['session_last_visit'] = 0;
                    }
                    $logged = true;
                } else {
                    $login_error = true;
                }
            } elseif (!F_check_unique(K_TABLE_USERS, 'user_name=\'' . F_escape_sql($_POST['xuser_name']) . '\'')) {
                // the user name exist but the password is wrong
                //F_print_error('WARNING', $l['m_login_wrong']);
                $login_error = true;
            } else {
                // this user doesn't exist on RackMap database
                $login_error = true;
            }
        } else {
            F_display_db_error();
        }
    }
}
if (!isset($pagelevel)) {
    // set default page level
    $pagelevel = 0;

    }
} else {
    echo '</select></span></div>' . K_NEWLINE;
    F_display_db_error();
}
echo '</select>' . K_NEWLINE;
echo '<input type="text" name="searchterms" id="searchterms" value="' . htmlspecialchars($searchterms, ENT_COMPAT, $l['a_meta_charset']) . '" size="20" maxlength="255" title="' . $l['w_search'] . '" />';
F_submit_button('search', $l['w_search'], $l['w_search']);
echo '</span></div>' . K_NEWLINE;
// build a search query
$wherequery = '';
if (strlen($searchterms) > 0) {
    $terms = preg_split("/[\\s]+/i", $searchterms);
    // Get all the words into an array
    foreach ($terms as $word) {
        $word = F_escape_sql($db, $word);
        $wherequery .= ' AND ((user_name LIKE \'%' . $word . '%\')';
        $wherequery .= ' OR (user_email LIKE \'%' . $word . '%\')';
        $wherequery .= ' OR (user_firstname LIKE \'%' . $word . '%\')';
        $wherequery .= ' OR (user_lastname LIKE \'%' . $word . '%\')';
        $wherequery .= ' OR (user_regnumber LIKE \'%' . $word . '%\')';
        $wherequery .= ' OR (user_ssn LIKE \'%' . $word . '%\'))';
    }
    $wherequery = '(' . substr($wherequery, 5) . ')';
}
// select only specified User IDs
if (isset($uids) and !empty($uids)) {
    $uid_list = '';
    $uids = explode('x', $uids);
    foreach ($uids as $id) {
        $uid_list .= ',' . intval($id);

    /**
     * Sets the end element handler function for the XML parser parser.end_element_handler.
     * @param $parser (resource) The first parameter, parser, is a reference to the XML parser calling the handler.
     * @param $name (string) The second parameter, name, contains the name of the element for which this handler is called. If case-folding is in effect for this parser, the element name will be in uppercase letters.
     * @private
     */
    private function endElementHandler($parser, $name)
    {
        global $l, $db;
        require_once '../config/tce_config.php';
        require_once 'tce_functions_user_select.php';
        switch (strtolower($name)) {
            case 'name':
            case 'password':
            case 'email':
            case 'regdate':
            case 'ip':
            case 'firstname':
            case 'lastname':
            case 'birthdate':
            case 'birthplace':
            case 'regnumber':
            case 'ssn':
            case 'level':
            case 'verifycode':
                $this->current_data = F_escape_sql(F_xml_to_text($this->current_data));
                $this->user_data[$this->current_element] = $this->current_data;
                $this->current_element = '';
                $this->current_data = '';
                break;
            case 'group':
                $group_name = F_escape_sql(F_xml_to_text($this->current_data));
                // check if group already exist
                $sql = 'SELECT group_id
					FROM ' . K_TABLE_GROUPS . '
					WHERE group_name=\'' . $group_name . '\'
					LIMIT 1';
                if ($r = F_db_query($sql, $db)) {
                    if ($m = F_db_fetch_array($r)) {
                        // the group has been already added
                        $this->group_data[] = $m['group_id'];
                    } else {
                        // add new group
                        $sqli = 'INSERT INTO ' . K_TABLE_GROUPS . ' (
							group_name
							) VALUES (
							\'' . $group_name . '\'
							)';
                        if (!($ri = F_db_query($sqli, $db))) {
                            F_display_db_error(false);
                        } else {
                            $this->group_data[] = F_db_insert_id($db, K_TABLE_GROUPS, 'group_id');
                        }
                    }
                } else {
                    F_display_db_error();
                }
                break;
            case 'user':
                // insert users
                if (!empty($this->user_data['user_name'])) {
                    if (empty($this->user_data['user_regdate'])) {
                        $this->user_data['user_regdate'] = date(K_TIMESTAMP_FORMAT);
                    }
                    if (empty($this->user_data['user_ip'])) {
                        $this->user_data['user_ip'] = getNormalizedIP($_SERVER['REMOTE_ADDR']);
                    }
                    if (!isset($this->user_data['user_level']) or strlen($this->user_data['user_level']) == 0) {
                        $this->user_data['user_level'] = 1;
                    }
                    if ($_SESSION['session_user_level'] < K_AUTH_ADMINISTRATOR) {
                        // you cannot edit a user with a level equal or higher than yours
                        $this->user_data['user_level'] = min(max(0, $_SESSION['session_user_level'] - 1), $this->user_data['user_level']);
                        // non-administrator can access only to his/her groups
                        if (empty($this->group_data)) {
                            break;
                        }
                        $common_groups = array_intersect(F_get_user_groups($_SESSION['session_user_id']), $this->group_data);
                        if (empty($common_groups)) {
                            break;
                        }
                    }
                    // check if user already exist
                    $sql = 'SELECT user_id,user_level
						FROM ' . K_TABLE_USERS . '
						WHERE user_name=\'' . $this->user_data['user_name'] . '\'
							OR user_regnumber=\'' . $this->user_data['user_regnumber'] . '\'
							OR user_ssn=\'' . $this->user_data['user_ssn'] . '\'
						LIMIT 1';
                    if ($r = F_db_query($sql, $db)) {
                        if ($m = F_db_fetch_array($r)) {
                            // the user has been already added
                            $user_id = $m['user_id'];
                            if ($_SESSION['session_user_level'] >= K_AUTH_ADMINISTRATOR or $_SESSION['session_user_level'] > $m['user_level']) {
                                //update user data
                                $sqlu = 'UPDATE ' . K_TABLE_USERS . ' SET
									user_regdate=\'' . $this->user_data['user_regdate'] . '\',
									user_ip=\'' . $this->user_data['user_ip'] . '\',
									user_name=\'' . $this->user_data['user_name'] . '\',
									user_email=' . F_empty_to_null($this->user_data['user_email']) . ',';
//.........这里部分代码省略.........

				test_answers_order_mode,
				test_comment_enabled,
				test_menu_enabled,
				test_noanswer_enabled,
				test_mcma_radio,
				test_repeatable,
				test_mcma_partial_score,
				test_logout_on_timeout,
				test_password
				) VALUES (
				\'' . F_escape_sql($db, $test_name) . '\',
				\'' . F_escape_sql($db, $test_description) . '\',
				' . F_empty_to_null($test_begin_time) . ',
				' . F_empty_to_null($test_end_time) . ',
				\'' . $test_duration_time . '\',
				\'' . F_escape_sql($db, $test_ip_range) . '\',
				\'' . intval($test_results_to_users) . '\',
				\'' . intval($test_report_to_users) . '\',
				\'' . $test_score_right . '\',
				\'' . $test_score_wrong . '\',
				\'' . $test_score_unanswered . '\',
				\'' . $test_max_score . '\',
				\'' . intval($_SESSION['session_user_id']) . '\',
				\'' . $test_score_threshold . '\',
				\'' . intval($test_random_questions_select) . '\',
				\'' . intval($test_random_questions_order) . '\',
				\'' . $test_questions_order_mode . '\',
				\'' . intval($test_random_answers_select) . '\',
				\'' . intval($test_random_answers_order) . '\',
				\'' . $test_answers_order_mode . '\',
				\'' . intval($test_comment_enabled) . '\',

/**
 * Return the object type ID with the selected name.
 * @param $name (string) Name of the object type.
 * @return int.
 */
function F_getObjectTypeID($name)
{
    global $l, $db;
    require_once '../config/tce_config.php';
    $obt_id = 0;
    $sql = 'SELECT obt_id FROM ' . K_TABLE_OBJECT_TYPES . ' WHERE obt_name=\'' . F_escape_sql($name) . '\' LIMIT 1';
    if ($r = F_db_query($sql, $db)) {
        if ($m = F_db_fetch_array($r)) {
            $obt_id = $m['obt_id'];
        }
    } else {
        F_display_db_error();
    }
    return $obt_id;
}

/**
 * Copy selected question to another topic
 * @author Nicola Asuni
 * @since 2008-11-26
 * @param $question_id (int) question ID
 * @param $new_subject_id (int) new subject ID
 */
function F_question_copy($question_id, $new_subject_id)
{
    global $l, $db;
    require_once '../config/tce_config.php';
    $question_id = intval($question_id);
    $new_subject_id = intval($new_subject_id);
    // check authorization
    $sql = 'SELECT subject_module_id FROM ' . K_TABLE_SUBJECTS . ' WHERE subject_id=' . $new_subject_id . ' LIMIT 1';
    if ($r = F_db_query($sql, $db)) {
        if ($m = F_db_fetch_array($r)) {
            $subject_module_id = $m['subject_module_id'];
            // check user's authorization for parent module
            if (!F_isAuthorizedUser(K_TABLE_MODULES, 'module_id', $subject_module_id, 'module_user_id')) {
                return;
            }
        }
    } else {
        F_display_db_error();
        return;
    }
    $q = F_question_get_data($question_id);
    if ($q !== false) {
        if (K_DATABASE_TYPE == 'ORACLE') {
            $chksql = 'dbms_lob.instr(question_description,\'' . F_escape_sql($db, $q['question_description']) . '\',1,1)>0';
        } elseif (K_DATABASE_TYPE == 'MYSQL' and defined('K_MYSQL_QA_BIN_UNIQUITY') and K_MYSQL_QA_BIN_UNIQUITY) {
            $chksql = 'question_description=\'' . F_escape_sql($db, $q['question_description']) . '\' COLLATE utf8_bin';
        } else {
            $chksql = 'question_description=\'' . F_escape_sql($db, $q['question_description']) . '\'';
        }
        if (F_check_unique(K_TABLE_QUESTIONS, $chksql . ' AND question_subject_id=' . $new_subject_id . '')) {
            $sql = 'START TRANSACTION';
            if (!($r = F_db_query($sql, $db))) {
                F_display_db_error(false);
                break;
            }
            // adjust questions ordering
            if ($q['question_position'] > 0) {
                $sql = 'UPDATE ' . K_TABLE_QUESTIONS . ' SET
					question_position=question_position+1
					WHERE question_subject_id=' . $new_subject_id . '
						AND question_position>=' . $q['question_position'] . '';
                if (!($r = F_db_query($sql, $db))) {
                    F_display_db_error(false);
                    F_db_query('ROLLBACK', $db);
                    // rollback transaction
                }
            }
            $sql = 'INSERT INTO ' . K_TABLE_QUESTIONS . ' (
				question_subject_id,
				question_description,
				question_explanation,
				question_type,
				question_difficulty,
				question_enabled,
				question_position,
				question_timer,
				question_fullscreen,
				question_inline_answers,
				question_auto_next
				) VALUES (
				' . $new_subject_id . ',
				\'' . F_escape_sql($db, $q['question_description']) . '\',
				\'' . F_escape_sql($db, $q['question_explanation']) . '\',
				\'' . $q['question_type'] . '\',
				\'' . $q['question_difficulty'] . '\',
				\'' . $q['question_enabled'] . '\',
				' . F_zero_to_null($q['question_position']) . ',
				\'' . $q['question_timer'] . '\',
				\'' . $q['question_fullscreen'] . '\',
				\'' . $q['question_inline_answers'] . '\',
				\'' . $q['question_auto_next'] . '\'
				)';
            if (!($r = F_db_query($sql, $db))) {
                F_display_db_error(false);
            } else {
                $new_question_id = F_db_insert_id($db, K_TABLE_QUESTIONS, 'question_id');
            }
            // copy associated answers
            $sql = 'SELECT *
				FROM ' . K_TABLE_ANSWERS . '
				WHERE answer_question_id=' . $question_id . '';
            if ($r = F_db_query($sql, $db)) {
                while ($m = F_db_fetch_array($r)) {
                    $sqli = 'INSERT INTO ' . K_TABLE_ANSWERS . ' (
						answer_question_id,
						answer_description,
						answer_explanation,
						answer_isright,
						answer_enabled,
						answer_position,
						answer_keyboard_key
						) VALUES (
						' . $new_question_id . ',
//.........这里部分代码省略.........

/**
 * Deletes the specific session.
 * @param $key (string) session ID of session to destroy.
 * @return resource database query result.
 */
function F_session_destroy($key)
{
    global $db;
    $key = F_escape_sql($key);
    $sql = 'DELETE FROM ' . K_TABLE_SESSIONS . ' WHERE cpsession_id=\'' . $key . '\'';
    return F_db_query($sql, $db);
}

                // get object ID
                $object_id = intval(substr($k, 3));
                // delete previous value
                $sql = 'DELETE FROM ' . K_TABLE_ATTRIBUTE_VALUES . ' WHERE atv_obj_id=' . $object_id . ' AND atv_atb_id=' . $atb_id . '';
                if (!($r = F_db_query($sql, $db))) {
                    F_display_db_error(false);
                }
                if (strlen($atb_value) > 0) {
                    $sql = 'INSERT INTO ' . K_TABLE_ATTRIBUTE_VALUES . ' (
						atv_obj_id,
						atv_atb_id,
						atv_value
						) VALUES (
						' . $object_id . ',
						' . $atb_id . ',
						\'' . F_escape_sql($atb_value) . '\'
						)';
                    if (!($r = F_db_query($sql, $db))) {
                        F_display_db_error(false);
                    }
                }
            }
        }
        F_print_error('MESSAGE', $l['m_updated']);
        break;
    default:
        break;
}
//end of switch
// -----------------------------------------------------------------------------
echo '<div class="container">' . K_NEWLINE;