PHP add_escape_custom函数代码示例

/**
 * library to simplify processing code_types
 * 
 * Copyright (C) 2013 Kevin Yeh <kevin.y@integralemr.com> and OEMR <www.oemr.org>
 *
 * LICENSE: This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 3
 * of the License, or (at your option) any later version.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
 *
 * @package OpenEMR
 * @author  Kevin Yeh <kevin.y@integralemr.com>
 * @link    http://www.open-emr.org
 */
function diag_code_types($format = 'json', $sqlEscape = false)
{
    global $code_types;
    $diagCodes = array();
    foreach ($code_types as $key => $ct) {
        if ($ct['active'] && $ct['diag']) {
            if ($format == 'json') {
                $entry = array("key" => $key, "id" => $ct['id']);
            } else {
                if ($format == 'keylist') {
                    $entry = "'";
                    $entry .= $sqlEscape ? add_escape_custom($key) : $key;
                    $entry .= "'";
                }
            }
            array_push($diagCodes, $entry);
        }
    }
    if ($format == 'json') {
        return json_encode($diagCodes);
    }
    if ($format == 'keylist') {
        return implode(",", $diagCodes);
    }
}

function review_of_systems_report($pid, $encounter, $cols, $id)
{
    $count = 0;
    $data = formFetch("form_review_of_systems", $id);
    $sql = "SELECT name from form_review_of_systems_checks where foreign_id = '" . add_escape_custom($id) . "'";
    $results = sqlQ($sql);
    $data2 = array();
    while ($row = sqlFetchArray($results)) {
        $data2[] = $row['name'];
    }
    $data = array_merge($data, $data2);
    if ($data) {
        print "<table><tr>";
        foreach ($data as $key => $value) {
            if ($key == "id" || $key == "pid" || $key == "user" || $key == "groupname" || $key == "authorized" || $key == "activity" || $key == "date" || $value == "" || $value == "0000-00-00 00:00:00") {
                continue;
            }
            if ($value == "on") {
                $value = "yes";
            }
            $key = ucwords(str_replace("_", " ", $key));
            if (is_numeric($key)) {
                $key = "check";
            }
            print "<td><span class=bold>{$key}: </span><span class=text>{$value}</span></td>";
            $count++;
            if ($count == $cols) {
                $count = 0;
                print "</tr><tr>\n";
            }
        }
    }
}

 function Tree($root, $root_type = ROOT_TYPE_ID)
 {
     $this->_db = $GLOBALS['adodb']['db'];
     $this->_root = add_escape_custom($root);
     $this->_root_type = add_escape_custom($root_type);
     $this->load_tree();
 }

function QuotedOrNull($fld)
{
    if ($fld) {
        return "'" . add_escape_custom($fld) . "'";
    }
    return "NULL";
}

function invalue($name)
{
    if (!$_POST[$name]) {
        return "''";
    }
    $fld = add_escape_custom(trim($_POST[$name]));
    return "'{$fld}'";
}

function addwhere($where, $colname, $value)
{
    if ($value) {
        $where .= " AND ";
        $where .= "{$colname} LIKE '%" . add_escape_custom($value) . "%'";
    }
    return $where;
}

function updateInvoiceRefNumber()
{
    $irnumber = getInvoiceRefNumber();
    // Here "?" specifies a minimal match, to get the most digits possible:
    if (preg_match('/^(.*?)(\\d+)(\\D*)$/', $irnumber, $matches)) {
        $newdigs = sprintf('%0' . strlen($matches[2]) . 'd', $matches[2] + 1);
        $newnumber = add_escape_custom($matches[1] . $newdigs . $matches[3]);
        sqlStatement("UPDATE users AS u, list_options AS lo " . "SET lo.notes = '{$newnumber}' WHERE " . "u.username = '" . $_SESSION['authUser'] . "' AND " . "lo.list_id = 'irnpool' AND lo.option_id = u.irnpool");
    }
    return $irnumber;
}

function formDataCore($s, $isTrim = false)
{
    //trim if selected
    if ($isTrim) {
        $s = trim($s);
    }
    //strip escapes
    $s = strip_escape_custom($s);
    //add escapes for safe database insertion
    $s = add_escape_custom($s);
    return $s;
}

 function populate()
 {
     if (!empty($this->id)) {
         $res = sqlQuery("SELECT providerID,fname,lname,mname " . ", DATE_FORMAT(DOB,'%m/%d/%Y') as date_of_birth " . ", pubpid " . " from " . $this->_table . " where pid =" . add_escape_custom($this->id));
         if (is_array($res)) {
             $this->pubpid = $res['pubpid'];
             $this->lname = $res['lname'];
             $this->mname = $res['mname'];
             $this->fname = $res['fname'];
             $this->provider = new Provider($res['providerID']);
             $this->date_of_birth = $res['date_of_birth'];
         }
     }
 }

 function populate()
 {
     $res = sqlQuery("SELECT fname,lname,federaldrugid, specialty, npi, state_license_number FROM users where id =" . add_escape_custom($this->id));
     if (is_array($res)) {
         $this->lname = $res['lname'];
         $this->fname = $res['fname'];
         $this->federal_drug_id = $res['federaldrugid'];
         $this->specialty = $res['specialty'];
         $this->npi = $res['npi'];
         $this->state_license_number = $res['state_license_number'];
     }
     $ins = new InsuranceNumbers();
     $this->insurance_numbers = $ins->insurance_numbers_factory($this->id);
 }

 function persist()
 {
     parent::persist();
     if (is_numeric($this->id) and !empty($this->checks)) {
         $sql = "delete FROM form_review_of_systems_checks where foreign_id = '" . $this->id . "'";
         sqlQuery($sql);
         foreach ($this->checks as $check) {
             if (!empty($check)) {
                 $sql = "INSERT INTO form_review_of_systems_checks set foreign_id='" . add_escape_custom($this->id) . "', name = '" . add_escape_custom($check) . "'";
                 sqlQuery($sql);
                 //echo "$sql<br>";
             }
         }
     }
 }

 function populate()
 {
     $sql = "SELECT * from " . $this->_prefix . $this->_table . " WHERE id = '" . add_escape_custom(strval($this->id)) . "'";
     $results = sqlQuery($sql);
     if (is_array($results)) {
         foreach ($results as $field_name => $field) {
             $func = "set_" . $field_name;
             //echo "f: $field m: $func status: " .  (is_callable(array($this,$func))? "yes" : "no") . "<br>";
             if (is_callable(array($this, $func))) {
                 if (!empty($field)) {
                     //echo "s: $field_name to: $field <br>";
                     call_user_func(array(&$this, $func), $field);
                 }
             }
         }
     }
 }

function PrepareSearchItem($SearchItem)
{
    $SplitArray = explode(' like ', $SearchItem);
    if (isset($SplitArray[1])) {
        $SplitArray[1] = substr($SplitArray[1], 0, -1);
        $SplitArray[1] = substr($SplitArray[1], 1);
        $SearchItem = $SplitArray[0] . ' like ' . "'" . add_escape_custom($SplitArray[1]) . "'";
    } else {
        $SplitArray = explode(' = ', $SearchItem);
        if (isset($SplitArray[1])) {
            $SplitArray[1] = substr($SplitArray[1], 0, -1);
            $SplitArray[1] = substr($SplitArray[1], 1);
            $SearchItem = $SplitArray[0] . ' = ' . "'" . add_escape_custom($SplitArray[1]) . "'";
        }
    }
    return $SearchItem;
}

function fetchAppointments($from_date, $to_date, $patient_id = null, $provider_id = null, $facility_id = null, $pc_appstatus = null, $with_out_provider = null, $with_out_facility = null, $pc_catid = null)
{
    $where = "";
    if ($provider_id) {
        $where .= " AND e.pc_aid = '{$provider_id}'";
    }
    if ($patient_id) {
        $where .= " AND e.pc_pid = '{$patient_id}'";
    } else {
        $where .= " AND e.pc_pid != ''";
    }
    $facility_filter = '';
    if ($facility_id) {
        $event_facility_filter = " AND e.pc_facility = '" . add_escape_custom($facility_id) . "'";
        // escape $facility_id
        $provider_facility_filter = " AND u.facility_id = '" . add_escape_custom($facility_id) . "'";
        // escape $facility_id
        $facility_filter = $event_facility_filter . $provider_facility_filter;
    }
    $where .= $facility_filter;
    //Appointment Status Checking
    $filter_appstatus = '';
    if ($pc_appstatus != '') {
        $filter_appstatus = " AND e.pc_apptstatus = '" . $pc_appstatus . "'";
    }
    $where .= $filter_appstatus;
    if ($pc_catid != null) {
        $where .= " AND e.pc_catid=" . intval($pc_catid);
        // using intval to escape this parameter
    }
    //Without Provider checking
    $filter_woprovider = '';
    if ($with_out_provider != '') {
        $filter_woprovider = " AND e.pc_aid = ''";
    }
    $where .= $filter_woprovider;
    //Without Facility checking
    $filter_wofacility = '';
    if ($with_out_facility != '') {
        $filter_wofacility = " AND e.pc_facility = 0";
    }
    $where .= $filter_wofacility;
    $appointments = fetchEvents($from_date, $to_date, $where);
    return $appointments;
}

function PrepareSearchItem($SearchItem)
{
    //Parses the search value part of the criteria and prepares for sql.
    $SplitArray = split(' like ', $SearchItem);
    if (isset($SplitArray[1])) {
        $SplitArray[1] = substr($SplitArray[1], 0, -1);
        $SplitArray[1] = substr($SplitArray[1], 1);
        $SearchItem = $SplitArray[0] . ' like ' . "'" . add_escape_custom($SplitArray[1]) . "'";
    } else {
        $SplitArray = split(' = ', $SearchItem);
        if (isset($SplitArray[1])) {
            $SplitArray[1] = substr($SplitArray[1], 0, -1);
            $SplitArray[1] = substr($SplitArray[1], 1);
            $SearchItem = $SplitArray[0] . ' = ' . "'" . add_escape_custom($SplitArray[1]) . "'";
        }
    }
    return $SearchItem;
}