PHP PMA_validateSQL函数代码示例

//.........这里部分代码省略.........
            echo "\n";
            // Html format the query to be displayed
            // The nl2br function isn't used because its result isn't a valid
            // xhtml1.0 statement before php4.0.5 ("<br>" and not "<br />")
            // If we want to show some sql code it is easiest to create it here
            /* SQL-Parser-Analyzer */
            $sqlnr = 1;
            if (!empty($GLOBALS['show_as_php'])) {
                $new_line = '\'<br />' . "\n" . '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;. \' ';
            }
            if (isset($new_line)) {
                /* SQL-Parser-Analyzer */
                $query_base = PMA_sqlAddslashes(htmlspecialchars($local_query));
                /* SQL-Parser-Analyzer */
                $query_base = preg_replace("@((\r\n)|(\r)|(\n))+@", $new_line, $query_base);
            } else {
                $query_base = $local_query;
            }
            // Here we append the LIMIT added for navigation, to
            // enable its display. Adding it higher in the code
            // to $local_query would create a problem when
            // using the Refresh or Edit links.
            // Only append it on SELECTs.
            // FIXME: what would be the best to do when someone
            // hits Refresh: use the current LIMITs ?
            // TODO: use the parser instead of preg_match()
            if (preg_match('@^SELECT[[:space:]]+@i', $query_base) && isset($GLOBALS['sql_limit_to_append'])) {
                $query_base .= $GLOBALS['sql_limit_to_append'];
            }
            if (!empty($GLOBALS['show_as_php'])) {
                $query_base = '$sql  = \'' . $query_base;
            } else {
                if (!empty($GLOBALS['validatequery'])) {
                    $query_base = PMA_validateSQL($query_base);
                } else {
                    // avoid reparsing query:
                    if (isset($GLOBALS['parsed_sql']) && $query_base == $GLOBALS['parsed_sql']['raw']) {
                        $parsed_sql = $GLOBALS['parsed_sql'];
                    } else {
                        $parsed_sql = PMA_SQP_parse($query_base);
                    }
                    $query_base = PMA_formatSql($parsed_sql, $query_base);
                }
            }
            // Prepares links that may be displayed to edit/explain the query
            // (don't go to default pages, we must go to the page
            // where the query box is available)
            // (also, I don't see why we should check the goto variable)
            //if (!isset($GLOBALS['goto'])) {
            //$edit_target = (isset($GLOBALS['table'])) ? $cfg['DefaultTabTable'] : $cfg['DefaultTabDatabase'];
            $edit_target = isset($GLOBALS['db']) ? isset($GLOBALS['table']) ? 'tbl_properties.php' : 'db_details.php' : '';
            //} else if ($GLOBALS['goto'] != 'main.php') {
            //    $edit_target = $GLOBALS['goto'];
            //} else {
            //    $edit_target = '';
            //}
            if (isset($cfg['SQLQuery']['Edit']) && $cfg['SQLQuery']['Edit'] == TRUE && !empty($edit_target)) {
                $onclick = '';
                if ($cfg['QueryFrameJS'] && $cfg['QueryFrame']) {
                    $onclick = 'onclick="focus_querywindow(\'' . urlencode($local_query) . '\'); return false;"';
                }
                $edit_link = '&nbsp;[<a href="' . $edit_target . $url_qpart . '&amp;sql_query=' . urlencode($local_query) . '&amp;show_query=1#querybox" ' . $onclick . '>' . $GLOBALS['strEdit'] . '</a>]';
            } else {
                $edit_link = '';
            }
            // Want to have the query explained (Mike Beck 2002-05-22)

//.........这里部分代码省略.........
            // when the query is large (for example an INSERT of binary
            // data), the parser chokes; so avoid parsing the query
            $query_too_big = true;
            $shortened_query_base = nl2br(htmlspecialchars(substr($sql_query, 0, $cfg['MaxCharactersInDisplayedSQL']) . '[...]'));
        } elseif (!empty($GLOBALS['parsed_sql']) && $query_base == $GLOBALS['parsed_sql']['raw']) {
            // (here, use "! empty" because when deleting a bookmark,
            // $GLOBALS['parsed_sql'] is set but empty
            $parsed_sql = $GLOBALS['parsed_sql'];
        } else {
            // Parse SQL if needed
            $parsed_sql = PMA_SQP_parse($query_base);
        }
        // Analyze it
        if (isset($parsed_sql)) {
            $analyzed_display_query = PMA_SQP_analyze($parsed_sql);
            // Here we append the LIMIT added for navigation, to
            // enable its display. Adding it higher in the code
            // to $sql_query would create a problem when
            // using the Refresh or Edit links.
            // Only append it on SELECTs.
            /**
             * @todo what would be the best to do when someone hits Refresh:
             * use the current LIMITs ?
             */
            if (isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_limit_to_append'])) {
                $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_limit_to_append'] . $analyzed_display_query[0]['section_after_limit'];
                // Need to reparse query
                $parsed_sql = PMA_SQP_parse($query_base);
            }
        }
        if (!empty($GLOBALS['show_as_php'])) {
            $query_base = '$sql  = "' . $query_base;
        } elseif (!empty($GLOBALS['validatequery'])) {
            $query_base = PMA_validateSQL($query_base);
        } elseif (isset($parsed_sql)) {
            $query_base = PMA_formatSql($parsed_sql, $query_base);
        }
        // Prepares links that may be displayed to edit/explain the query
        // (don't go to default pages, we must go to the page
        // where the query box is available)
        // Basic url query part
        $url_params = array();
        if (strlen($GLOBALS['db'])) {
            $url_params['db'] = $GLOBALS['db'];
            if (strlen($GLOBALS['table'])) {
                $url_params['table'] = $GLOBALS['table'];
                $edit_link = 'tbl_sql.php';
            } else {
                $edit_link = 'db_sql.php';
            }
        } else {
            $edit_link = 'server_sql.php';
        }
        // Want to have the query explained (Mike Beck 2002-05-22)
        // but only explain a SELECT (that has not been explained)
        /* SQL-Parser-Analyzer */
        $explain_link = '';
        if (!empty($cfg['SQLQuery']['Explain']) && !$query_too_big) {
            $explain_params = $url_params;
            // Detect if we are validating as well
            // To preserve the validate uRL data
            if (!empty($GLOBALS['validatequery'])) {
                $explain_params['validatequery'] = 1;
            }
            if (preg_match('@^SELECT[[:space:]]+@i', $sql_query)) {
                $explain_params['sql_query'] = 'EXPLAIN ' . $sql_query;

//.........这里部分代码省略.........
            $parsed_sql = PMA_SQP_parse($query_base);
        }
        // Analyze it
        if (isset($parsed_sql) && !PMA_SQP_isError()) {
            $analyzed_display_query = PMA_SQP_analyze($parsed_sql);
            // Same as below (append LIMIT), append the remembered ORDER BY
            if ($GLOBALS['cfg']['RememberSorting'] && isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_order_to_append'])) {
                $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_order_to_append'] . $analyzed_display_query[0]['limit_clause'] . ' ' . $analyzed_display_query[0]['section_after_limit'];
                // Need to reparse query
                $parsed_sql = PMA_SQP_parse($query_base);
                // update the $analyzed_display_query
                $analyzed_display_query[0]['section_before_limit'] .= $GLOBALS['sql_order_to_append'];
                $analyzed_display_query[0]['order_by_clause'] = $GLOBALS['sorted_col'];
            }
            // Here we append the LIMIT added for navigation, to
            // enable its display. Adding it higher in the code
            // to $sql_query would create a problem when
            // using the Refresh or Edit links.
            // Only append it on SELECTs.
            /**
             * @todo what would be the best to do when someone hits Refresh:
             * use the current LIMITs ?
             */
            if (isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_limit_to_append'])) {
                $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_limit_to_append'] . $analyzed_display_query[0]['section_after_limit'];
                // Need to reparse query
                $parsed_sql = PMA_SQP_parse($query_base);
            }
        }
        if (!empty($GLOBALS['show_as_php'])) {
            $query_base = '$sql  = "' . $query_base;
        } elseif (!empty($GLOBALS['validatequery'])) {
            try {
                $query_base = PMA_validateSQL($query_base);
            } catch (Exception $e) {
                PMA_Message::error(__('Failed to connect to SQL validator!'))->display();
            }
        } elseif (isset($parsed_sql)) {
            $query_base = PMA_formatSql($parsed_sql, $query_base);
        }
        // Prepares links that may be displayed to edit/explain the query
        // (don't go to default pages, we must go to the page
        // where the query box is available)
        // Basic url query part
        $url_params = array();
        if (!isset($GLOBALS['db'])) {
            $GLOBALS['db'] = '';
        }
        if (strlen($GLOBALS['db'])) {
            $url_params['db'] = $GLOBALS['db'];
            if (strlen($GLOBALS['table'])) {
                $url_params['table'] = $GLOBALS['table'];
                $edit_link = 'tbl_sql.php';
            } else {
                $edit_link = 'db_sql.php';
            }
        } else {
            $edit_link = 'server_sql.php';
        }
        // Want to have the query explained
        // but only explain a SELECT (that has not been explained)
        /* SQL-Parser-Analyzer */
        $explain_link = '';
        $is_select = false;
        if (!empty($cfg['SQLQuery']['Explain']) && !$query_too_big) {
            $explain_params = $url_params;

//.........这里部分代码省略.........
        // Parse SQL if needed
        // (here, use "! empty" because when deleting a bookmark,
        // $GLOBALS['parsed_sql'] is set but empty
        if (!empty($GLOBALS['parsed_sql']) && $query_base == $GLOBALS['parsed_sql']['raw']) {
            $parsed_sql = $GLOBALS['parsed_sql'];
        } else {
            // when the query is large (for example an INSERT of binary
            // data), the parser chokes; so avoid parsing the query
            if (!$query_too_big) {
                $parsed_sql = PMA_SQP_parse($query_base);
            }
        }
        // Analyze it
        if (isset($parsed_sql)) {
            $analyzed_display_query = PMA_SQP_analyze($parsed_sql);
        }
        // Here we append the LIMIT added for navigation, to
        // enable its display. Adding it higher in the code
        // to $sql_query would create a problem when
        // using the Refresh or Edit links.
        // Only append it on SELECTs.
        /**
         * @todo what would be the best to do when someone hits Refresh:
         * use the current LIMITs ?
         */
        if (isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_limit_to_append'])) {
            $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_limit_to_append'] . $analyzed_display_query[0]['section_after_limit'];
            // Need to reparse query
            $parsed_sql = PMA_SQP_parse($query_base);
        }
        if (!empty($GLOBALS['show_as_php'])) {
            $query_base = '$sql  = \'' . $query_base;
        } elseif (!empty($GLOBALS['validatequery'])) {
            $query_base = PMA_validateSQL($query_base);
        } else {
            if (isset($parsed_sql)) {
                $query_base = PMA_formatSql($parsed_sql, $query_base);
            }
        }
        // Prepares links that may be displayed to edit/explain the query
        // (don't go to default pages, we must go to the page
        // where the query box is available)
        $edit_target = strlen($GLOBALS['db']) ? strlen($GLOBALS['table']) ? 'tbl_sql.php' : 'db_sql.php' : 'server_sql.php';
        if (isset($cfg['SQLQuery']['Edit']) && $cfg['SQLQuery']['Edit'] == true && !empty($edit_target) && !$query_too_big) {
            if ($cfg['EditInWindow'] == true) {
                $onclick = 'window.parent.focus_querywindow(\'' . PMA_jsFormat($sql_query, false) . '\'); return false;';
            } else {
                $onclick = '';
            }
            $edit_link = $edit_target . $url_qpart . '&sql_query=' . urlencode($sql_query) . '&show_query=1#querybox';
            $edit_link = ' [' . PMA_linkOrButton($edit_link, $GLOBALS['strEdit'], array('onclick' => $onclick)) . ']';
        } else {
            $edit_link = '';
        }
        // Want to have the query explained (Mike Beck 2002-05-22)
        // but only explain a SELECT (that has not been explained)
        /* SQL-Parser-Analyzer */
        if (isset($cfg['SQLQuery']['Explain']) && $cfg['SQLQuery']['Explain'] == true && !$query_too_big) {
            // Detect if we are validating as well
            // To preserve the validate uRL data
            if (!empty($GLOBALS['validatequery'])) {
                $explain_link_validate = '&validatequery=1';
            } else {
                $explain_link_validate = '';
            }
            $explain_link = 'import.php' . $url_qpart . $explain_link_validate . '&sql_query=';

//.........这里部分代码省略.........
                $query_base = preg_replace("@((\r\n)|(\r)|(\n))+@", $new_line, $query_base);
            } else {
                $query_base = $local_query;
            }
            // Parse SQL if needed
            if (isset($GLOBALS['parsed_sql']) && $query_base == $GLOBALS['parsed_sql']['raw']) {
                $parsed_sql = $GLOBALS['parsed_sql'];
            } else {
                // when the query is large (for example an INSERT of binary
                // data), the parser chokes; so avoid parsing the query
                if (strlen($query_base) < 1000) {
                    $parsed_sql = PMA_SQP_parse($query_base);
                }
            }
            // Analyze it
            if (isset($parsed_sql)) {
                $analyzed_display_query = PMA_SQP_analyze($parsed_sql);
            }
            // Here we append the LIMIT added for navigation, to
            // enable its display. Adding it higher in the code
            // to $local_query would create a problem when
            // using the Refresh or Edit links.
            // Only append it on SELECTs.
            // FIXME: what would be the best to do when someone
            // hits Refresh: use the current LIMITs ?
            if (isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_limit_to_append'])) {
                $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_limit_to_append'] . $analyzed_display_query[0]['section_after_limit'];
                // Need to reparse query
                $parsed_sql = PMA_SQP_parse($query_base);
            }
            if (!empty($GLOBALS['show_as_php'])) {
                $query_base = '$sql  = \'' . $query_base;
            } elseif (!empty($GLOBALS['validatequery'])) {
                $query_base = PMA_validateSQL($query_base);
            } else {
                if (isset($parsed_sql)) {
                    $query_base = PMA_formatSql($parsed_sql, $query_base);
                }
            }
            // Prepares links that may be displayed to edit/explain the query
            // (don't go to default pages, we must go to the page
            // where the query box is available)
            // (also, I don't see why we should check the goto variable)
            //if (!isset($GLOBALS['goto'])) {
            //$edit_target = (isset($GLOBALS['table'])) ? $cfg['DefaultTabTable'] : $cfg['DefaultTabDatabase'];
            $edit_target = isset($GLOBALS['db']) ? isset($GLOBALS['table']) ? 'tbl_properties.php' : 'db_details.php' : 'server_sql.php';
            //} elseif ($GLOBALS['goto'] != 'main.php') {
            //    $edit_target = $GLOBALS['goto'];
            //} else {
            //    $edit_target = '';
            //}
            if (isset($cfg['SQLQuery']['Edit']) && $cfg['SQLQuery']['Edit'] == true && !empty($edit_target)) {
                if ($cfg['EditInWindow'] == true) {
                    $onclick = 'window.parent.focus_querywindow(\'' . PMA_jsFormat($local_query, false) . '\'); return false;';
                } else {
                    $onclick = '';
                }
                $edit_link = $edit_target . $url_qpart . '&amp;sql_query=' . urlencode($local_query) . '&amp;show_query=1#querybox';
                $edit_link = ' [' . PMA_linkOrButton($edit_link, $GLOBALS['strEdit'], array('onclick' => $onclick)) . ']';
            } else {
                $edit_link = '';
            }
            // Want to have the query explained (Mike Beck 2002-05-22)
            // but only explain a SELECT (that has not been explained)
            /* SQL-Parser-Analyzer */
            if (isset($cfg['SQLQuery']['Explain']) && $cfg['SQLQuery']['Explain'] == true) {

//.........这里部分代码省略.........
             $parsed_sql = PMA_SQP_parse($query_base);
         }
         // Analyze it
         if (isset($parsed_sql) && !PMA_SQP_isError()) {
             $analyzed_display_query = PMA_SQP_analyze($parsed_sql);
             // Same as below (append LIMIT), append the remembered ORDER BY
             if ($GLOBALS['cfg']['RememberSorting'] && isset($analyzed_display_query[0]['queryflags']['select_from']) && isset($GLOBALS['sql_order_to_append'])) {
                 $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_order_to_append'] . $analyzed_display_query[0]['limit_clause'] . ' ' . $analyzed_display_query[0]['section_after_limit'];
                 // Need to reparse query
                 $parsed_sql = PMA_SQP_parse($query_base);
                 // update the $analyzed_display_query
                 $analyzed_display_query[0]['section_before_limit'] .= $GLOBALS['sql_order_to_append'];
                 $analyzed_display_query[0]['order_by_clause'] = $GLOBALS['sorted_col'];
             }
             // Here we append the LIMIT added for navigation, to
             // enable its display. Adding it higher in the code
             // to $sql_query would create a problem when
             // using the Refresh or Edit links.
             // Only append it on SELECTs.
             /**
              * @todo what would be the best to do when someone hits Refresh:
              * use the current LIMITs ?
              */
             if (isset($analyzed_display_query[0]['queryflags']['select_from']) && !empty($GLOBALS['sql_limit_to_append'])) {
                 $query_base = $analyzed_display_query[0]['section_before_limit'] . "\n" . $GLOBALS['sql_limit_to_append'] . $analyzed_display_query[0]['section_after_limit'];
                 // Need to reparse query
                 $parsed_sql = PMA_SQP_parse($query_base);
             }
         }
         if (!empty($GLOBALS['show_as_php'])) {
             $query_base = '$sql  = "' . $query_base;
         } elseif (!empty($GLOBALS['validatequery'])) {
             try {
                 $query_base = PMA_validateSQL($query_base);
             } catch (Exception $e) {
                 $retval .= PMA_Message::error(__('Failed to connect to SQL validator!'))->getDisplay();
             }
         } elseif (isset($query_base)) {
             $query_base = self::formatSql($query_base);
         }
         // Prepares links that may be displayed to edit/explain the query
         // (don't go to default pages, we must go to the page
         // where the query box is available)
         // Basic url query part
         $url_params = array();
         if (!isset($GLOBALS['db'])) {
             $GLOBALS['db'] = '';
         }
         if (strlen($GLOBALS['db'])) {
             $url_params['db'] = $GLOBALS['db'];
             if (strlen($GLOBALS['table'])) {
                 $url_params['table'] = $GLOBALS['table'];
                 $edit_link = 'tbl_sql.php';
             } else {
                 $edit_link = 'db_sql.php';
             }
         } else {
             $edit_link = 'server_sql.php';
         }
         // Want to have the query explained
         // but only explain a SELECT (that has not been explained)
         /* SQL-Parser-Analyzer */
         $explain_link = '';
         $is_select = preg_match('@^SELECT[[:space:]]+@i', $sql_query);
         if (!empty($cfg['SQLQuery']['Explain']) && !$query_too_big) {
             $explain_params = $url_params;

    /**
     * Tests for PMA_validateSQL SOAP
     *
     * @return void
     */
    public function testPMA_validateSQL_SOAP()
    {
        $sql_pass = "select * from PMA_test";
        $sql_fail = "select * PMA_test";

        //the sql validatior is loaded correctly
        //follow need SOAP
        $GLOBALS['cfg']['SQLValidator']['use'] = true;
        $GLOBALS['sqlvalidator_soap'] = 'PEAR';
        $GLOBALS['sqlvalidator_error'] = false;

        //validate that the result is the same as SOAP_Client return
        //SOAP_Client is mocked with simple logic
        $this->assertTrue(
            PMA_validateSQL($sql_pass)
        );
        $this->assertFalse(
            PMA_validateSQL($sql_fail)
        );
    }

//.........这里部分代码省略.........
            $local_query = !empty($GLOBALS['display_query']) ? $GLOBALS['display_query'] : ($cfg['SQP']['fmtType'] == 'none' && $GLOBALS['unparsed_sql'] != '' ? $GLOBALS['unparsed_sql'] : $GLOBALS['sql_query']);
            // Basic url query part
            $url_qpart = '?' . PMA_generate_common_url(isset($GLOBALS['db']) ? $GLOBALS['db'] : '', isset($GLOBALS['table']) ? $GLOBALS['table'] : '');
            echo "\n";
            ?>
    <tr>
        <td bgcolor="<?php 
            echo $cfg['BgcolorOne'];
            ?>
">
            <?php 
            echo "\n";
            // Html format the query to be displayed
            // The nl2br function isn't used because its result isn't a valid
            // xhtml1.0 statement before php4.0.5 ("<br>" and not "<br />")
            // If we want to show some sql code it is easiest to create it here
            /* SQL-Parser-Analyzer */
            $sqlnr = 1;
            if (!empty($GLOBALS['show_as_php'])) {
                $new_line = '\'<br />' . "\n" . '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;. \' ';
            }
            if (isset($new_line)) {
                /* SQL-Parser-Analyzer */
                $query_base = PMA_sqlAddslashes(htmlspecialchars($local_query));
                /* SQL-Parser-Analyzer */
                $query_base = preg_replace("@((\r\n)|(\r)|(\n))+@", $new_line, $query_base);
            } else {
                $query_base = $local_query;
            }
            if (!empty($GLOBALS['show_as_php'])) {
                $query_base = '$sql  = \'' . $query_base;
            } else {
                if (!empty($GLOBALS['validatequery'])) {
                    $query_base = PMA_validateSQL($query_base);
                } else {
                    $parsed_sql = PMA_SQP_parse($query_base);
                    $query_base = PMA_formatSql($parsed_sql, $query_base);
                }
            }
            // Prepares links that may be displayed to edit/explain the query
            // (don't go to default pages, we must go to the page
            // where the query box is available)
            // (also, I don't see why we should check the goto variable)
            //if (!isset($GLOBALS['goto'])) {
            //$edit_target = (isset($GLOBALS['table'])) ? $cfg['DefaultTabTable'] : $cfg['DefaultTabDatabase'];
            $edit_target = isset($GLOBALS['db']) ? isset($GLOBALS['table']) ? 'tbl_properties.php' : 'db_details.php' : '';
            //} else if ($GLOBALS['goto'] != 'main.php') {
            //    $edit_target = $GLOBALS['goto'];
            //} else {
            //    $edit_target = '';
            //}
            if (isset($cfg['SQLQuery']['Edit']) && $cfg['SQLQuery']['Edit'] == TRUE && !empty($edit_target)) {
                $onclick = '';
                if ($cfg['QueryFrameJS'] && $cfg['QueryFrame']) {
                    $onclick = 'onclick="focus_querywindow(\'' . urlencode($local_query) . '\'); return false;"';
                }
                $edit_link = '&nbsp;[<a href="' . $edit_target . $url_qpart . '&amp;sql_query=' . urlencode($local_query) . '&amp;show_query=1#querybox" ' . $onclick . '>' . $GLOBALS['strEdit'] . '</a>]';
            } else {
                $edit_link = '';
            }
            // Want to have the query explained (Mike Beck 2002-05-22)
            // but only explain a SELECT (that has not been explained)
            /* SQL-Parser-Analyzer */
            if (isset($cfg['SQLQuery']['Explain']) && $cfg['SQLQuery']['Explain'] == TRUE) {
                // Detect if we are validating as well
                // To preserve the validate uRL data