PHP cs_sql_escape函数代码示例

function cs_sql_version($cs_file)
{
    global $cs_db;
    $subtype = empty($cs_db['subtype']) ? 'myisam' : strtolower($cs_db['subtype']);
    $sql_infos = array('data_free' => 0, 'data_size' => 0, 'index_size' => 0, 'tables' => 0, 'names' => array());
    $sql_query = "SHOW TABLE STATUS LIKE '" . cs_sql_escape($cs_db['prefix'] . '_') . "%'";
    if ($sql_data = $cs_db['con']->query($sql_query)) {
        $new_result = $sql_data->fetchAll(PDO::FETCH_ASSOC);
        $sql_data = NULL;
        foreach ($new_result as $row) {
            $sql_infos['data_size'] += $row['Data_length'];
            $sql_infos['index_size'] += $row['Index_length'];
            $sql_infos['data_free'] += $subtype == 'innodb' ? 0 : $row['Data_free'];
            $sql_infos['tables']++;
            $sql_infos['names'][] .= $row['Name'];
        }
    } else {
        $error = $cs_db['con']->errorInfo();
        cs_error_sql($cs_file, 'cs_sql_version', $error[2]);
    }
    cs_log_sql($cs_file, $sql_query);
    $sql_infos['type'] = 'MySQL (pdo_mysql)';
    $sql_infos['subtype'] = empty($cs_db['subtype']) ? 'myisam' : $cs_db['subtype'];
    $sql_infos['host'] = $cs_db['con']->getAttribute(PDO::ATTR_CONNECTION_STATUS);
    $sql_infos['encoding'] = 'PDO encoding';
    $sql_infos['client'] = $cs_db['con']->getAttribute(PDO::ATTR_CLIENT_VERSION);
    $sql_infos['server'] = $cs_db['con']->getAttribute(PDO::ATTR_SERVER_VERSION);
    return $sql_infos;
}

function cs_trashmail($email)
{
    $parts = explode('@', $email, 2);
    if (empty($parts[1])) {
        return false;
    } else {
        $where = "trashmail_entry = '" . strtolower(cs_sql_escape($parts[1])) . "'";
        $check = cs_sql_count(__FILE__, 'trashmail', $where);
        return empty($check) ? false : true;
    }
}

function cs_captchacheck($input, $mini = 0)
{
    if (!extension_loaded('gd')) {
        return true;
    }
    $ip = cs_getip();
    $timeout = cs_time() - 900;
    $string = empty($mini) ? cs_sql_escape($input) : 'mini_' . cs_sql_escape($input);
    $cond = 'captcha_ip = \'' . cs_sql_escape($ip) . '\' AND ';
    $cond .= 'captcha_time > \'' . $timeout . '\' AND ';
    $cond .= 'captcha_string = \'' . $string . '\'';
    $hash_db = cs_sql_select(__FILE__, 'captcha', 'captcha_id', $cond);
    if (empty($hash_db)) {
        return false;
    }
    cs_sql_delete(__FILE__, 'captcha', $hash_db['captcha_id']);
    return true;
}

function cs_categories_create($mod, $categories_name)
{
    $return = 0;
    if (empty($categories_name)) {
        return 0;
    }
    $get = "categories_mod='" . $mod . "' AND categories_name = '" . cs_sql_escape($categories_name) . "'";
    $get_data = cs_sql_select(__FILE__, 'categories', 'categories_id', $get, 'categories_name');
    if (empty($get_data['categories_id'])) {
        $columns = array('categories_mod', 'categories_name');
        $values = array($mod, $categories_name);
        cs_sql_insert(__FILE__, 'categories', $columns, $values);
        $find = "categories_mod='" . $mod . "' AND categories_name = '" . cs_sql_escape($categories_name) . "'";
        $find_data = cs_sql_select(__FILE__, 'categories', 'categories_id', $find, 'categories_name');
        $return = $find_data['categories_id'];
    } else {
        $return = $get_data['categories_id'];
    }
    return $return;
}

    $data['banners']['or_img_url'] = $cs_banners['banners_picture'];
    $data['banners']['alt'] = $cs_banners['banners_alt'];
    $data['banners']['order'] = $cs_banners['banners_order'];
    $matches[1] = $cs_lang['pic_infos'];
    $return_types = '';
    foreach ($img_filetypes as $add) {
        $return_types .= empty($return_types) ? $add : ', ' . $add;
    }
    $matches[2] = $cs_lang['max_width'] . $op_banners['max_width'] . ' px' . cs_html_br(1);
    $matches[2] .= $cs_lang['max_height'] . $op_banners['max_height'] . ' px' . cs_html_br(1);
    $matches[2] .= $cs_lang['max_size'] . cs_filesize($op_banners['max_size']) . cs_html_br(1);
    $matches[2] .= $cs_lang['filetypes'] . $return_types;
    $data['banners']['clip'] = cs_abcode_clip($matches);
    echo cs_subtemplate(__FILE__, $data, 'banners', 'create');
} else {
    settype($cs_banners['banners_order'], 'integer');
    $banners_cells = array_keys($cs_banners);
    $banners_save = array_values($cs_banners);
    cs_sql_insert(__FILE__, 'banners', $banners_cells, $banners_save);
    if (!empty($files['picture']['tmp_name'])) {
        $where = "banners_name = '" . cs_sql_escape($cs_banners['banners_name']) . "'";
        $getid = cs_sql_select(__FILE__, 'banners', 'banners_id', $where);
        $filename = 'picture-' . $getid['banners_id'] . '.' . $extension;
        cs_upload('banners', $filename, $files['picture']['tmp_name']);
        $cs_banners2['banners_picture'] = 'uploads/banners/' . $filename;
        $banners2_cells = array_keys($cs_banners2);
        $banners2_save = array_values($cs_banners2);
        cs_sql_update(__FILE__, 'banners', $banners2_cells, $banners2_save, $getid['banners_id']);
    }
    cs_redirect($cs_lang['create_done'], 'banners');
}

    $votes_error++;
}
if (!empty($_REQUEST['votes_id'])) {
    $votes_id = $_REQUEST['votes_id'];
} else {
    $votes_error++;
}
if (isset($_POST['submit_votes'])) {
    if (empty($votes_error)) {
        $votes_form = 0;
        if (isset($_POST['votes_several'])) {
            $temp = explode("\n", $cs_votes['votes_election']);
            $count_election = count($temp);
            $count_voted = count($_POST['voted_answer']);
            $error_several = 0;
            $where = "voted_fid = '" . $votes_id . "' AND voted_mod = '" . $mod . "' AND voted_ip = '" . cs_sql_escape($users_ip) . "'";
            $where .= " AND users_id = '" . $users_id . "' AND (";
            $voting = array();
            for ($run = 0; $run < $count_voted; $run++) {
                settype($voted_answer[$run], 'integer');
                if ($voted_answer[$run] < 1 || $voted_answer[$run] >= $count_election || in_array($voted_answer[$run], $voting)) {
                    $error_several = 1;
                    break;
                }
                $voting[] = $voted_answer[$run];
                $where .= 'voted_answer = "' . $voted_answer[$run] . '" OR ';
            }
            $where = substr($where, 0, -4) . ')';
            $error_several += cs_sql_count(__FILE__, 'voted', $where);
            if (!empty($error_several)) {
                die('Multivote triggered an error with answers -> Execution halted.');

        // Lang file
        $langinfocontent = '<?php' . "\r\n";
        $langinfocontent .= '// ClanSphere 2010 - www.clansphere.net' . "\r\n";
        $langinfocontent .= '// File created by mod modules' . "\r\n\r\n";
        $langinfocontent .= '$cs_lang[\'mod\'] = \'' . $_POST['modname'] . "';\r\n";
        $langinfocontent .= '$cs_lang[\'mod_info\'] = \'' . $_POST['description'] . "';\r\n\r\n";
        $langinfocontent .= '?>';
        if (!($langinfofile = fopen($cs_main['def_path'] . '/lang/' . $account['users_lang'] . '/' . $_POST['moddir'] . '.php', 'w'))) {
            $error .= cs_html_br(1) . $cs_lang['modinfolang_create_failed'];
        } elseif (!fwrite($langinfofile, $langinfocontent)) {
            $error .= cs_html_br(1) . $cs_lang['modinfolang_write_failed'];
        } else {
            fclose($langinfofile);
        }
        // SQL
        $query = 'ALTER TABLE {pre}_access ADD access_' . cs_sql_escape($_POST['moddir']) . ' int(2) NOT NULL default \'0\';';
        $query = cs_sql_replace($query);
        if (!cs_sql_query(__FILE__, $query)) {
            $error .= cs_html_br(1) . $cs_lang['sqlaccess_failed'];
        }
    }
}
if (empty($_POST['submit']) || !empty($error)) {
    $data['message']['lang'] = empty($error) ? nl2br($cs_lang['need_chmod']) : $cs_lang['error_occured'] . $error;
    // SQL Tables
    $_POST['tablescount'] = empty($_POST['tablescount']) ? 1 : (int) $_POST['tablescount'];
    $tablescount = empty($_POST['addtable']) ? $_POST['tablescount'] : $_POST['tablescount'] + 1;
    for ($run = 0; $run < $tablescount; $run++) {
        $data['tables'][$run]['run'] = $run;
        $data['tables'][$run]['value'] = empty($_POST['table_' . $run]) ? '' : $_POST['table_' . $run];
    }

// ClanSphere 2010 - www.clansphere.net
// $Id$
$cs_lang = cs_translate('users');
$start = empty($_GET['start']) ? 0 : (int) $_GET['start'];
$cs_sort[1] = 'users_nick DESC';
$cs_sort[2] = 'users_nick ASC';
$cs_sort[3] = 'users_place DESC';
$cs_sort[4] = 'users_place ASC';
$cs_sort[5] = 'users_laston DESC';
$cs_sort[6] = 'users_laston ASC';
$sort = empty($_GET['sort']) ? 2 : (int) $_GET['sort'];
$order = $cs_sort[$sort];
//$where = empty($_REQUEST['where']) ? 0 : $_REQUEST['where'];
//$mof = empty($where) ? '' : " AND users_sex = '" . cs_sql_escape($where) . "'";
$where = empty($_GET['where']) ? 0 : $_GET['where'];
$mof = empty($where) ? '' : " AND users_nick LIKE '" . cs_sql_escape($where) . "%'";
$condition = 'users_delete = 0 AND users_active = 1' . $mof;
$users_count = cs_sql_count(__FILE__, 'users', $condition);
$data['head']['mod'] = $cs_lang['mod_name'];
$data['head']['action'] = $cs_lang['list'];
$data['head']['total'] = $users_count;
$data['head']['pages'] = cs_pages('users', 'list', $users_count, $start, $where, $sort);
$sel_female = $where === 'female' ? 'selected' : '';
$data['head']['sel_female'] = $sel_female;
$sel_male = $where === 'male' ? 'selected' : '';
$data['head']['sel_male'] = $sel_male;
$data['sort']['nick'] = cs_sort('users', 'list', $start, $where, 1, $sort);
$data['sort']['place'] = cs_sort('users', 'list', $start, $where, 3, $sort);
$data['sort']['laston'] = cs_sort('users', 'list', $start, $where, 5, $sort);
$select = 'users_id, users_nick, users_place, users_laston, users_country, users_hidden, users_active, users_invisible';
$cs_users = cs_sql_select(__FILE__, 'users', $select, $condition, $order, $start, $account['users_limit']);

    $where = $_REQUEST['usersthumb'];
    $from = 'usersgallery';
    $select = 'usersgallery_name, usersgallery_time, usersgallery_count, usersgallery_count_downloads';
    $where = "usersgallery_id = '" . cs_sql_escape($where) . "'";
    $cs_gallery = cs_sql_select(__FILE__, $from, $select, $where);
    $gallery_loop = count($cs_gallery);
    $name = $cs_gallery['usersgallery_name'];
    $gallery_time = $cs_gallery['usersgallery_time'];
    $gallery_count = $cs_gallery['usersgallery_count'];
    $gallery_count_downloads = $cs_gallery['usersgallery_count_downloads'];
}
if (!empty($_REQUEST['userspic'])) {
    $where = $_REQUEST['userspic'];
    $from = 'usersgallery';
    $select = 'usersgallery_name, usersgallery_time, usersgallery_count, usersgallery_count_downloads';
    $where = "usersgallery_id = '" . cs_sql_escape($where) . "'";
    $cs_gallery = cs_sql_select(__FILE__, $from, $select, $where);
    $gallery_loop = count($cs_gallery);
    $name = $cs_gallery['usersgallery_name'];
    $gallery_time = $cs_gallery['usersgallery_time'];
    $gallery_count = $cs_gallery['usersgallery_count'];
    $gallery_count_downloads = $cs_gallery['usersgallery_count_downloads'];
    $gallery_count = $gallery_count + 1;
    $gallery_cells = array('usersgallery_count');
    $gallery_save = array($gallery_count);
    cs_sql_update(__FILE__, 'usersgallery', $gallery_cells, $gallery_save, $_REQUEST['userspic']);
}
class PictureEngine
{
    var $image;
    var $width;

    if (!empty($_POST['users_nick'])) {
        $users_nick = cs_sql_escape($_POST['users_nick']);
        $users_id = cs_sql_select(__FILE__, 'users', 'users_id', "users_nick = '{$users_nick}'", 0, 0, 1);
        if ($users_id > 0) {
            $insertion = array('medals_id' => $medals_id, 'users_id' => $users_id['users_id'], 'medalsuser_date' => cs_time());
            cs_sql_insert(__FILE__, 'medalsuser', array_keys($insertion), array_values($insertion));
            cs_redirect($cs_lang['create_done'], 'medals', 'user', 'where=' . $medals_id);
        } else {
            cs_redirect($cs_lang['user_not_found'], 'medals', 'user', 'where=' . $medals_id);
        }
    }
} else {
    $medals_id = $_GET['where'];
}
if (isset($_GET['delete'])) {
    $medalsuser_id = cs_sql_escape($_GET['delete']);
    cs_sql_delete(__FILE__, 'medalsuser', $medalsuser_id);
    cs_redirect($cs_lang['del_true'], 'medals', 'user', 'where=' . $medals_id);
}
$start = empty($_GET['start']) ? 0 : $_GET['start'];
$cs_sort[1] = 'md.medalsuser_date DESC';
$cs_sort[2] = 'md.medalsuser_date ASC';
$cs_sort[3] = 'usr.users_nick DESC';
$cs_sort[4] = 'usr.users_nick ASC';
$sort = empty($_GET['sort']) ? 1 : $_GET['sort'];
$order = $cs_sort[$sort];
$tables = 'medalsuser md LEFT JOIN {pre}_users usr ON usr.users_id = md.users_id';
$cells = 'usr.users_nick AS users_nick, md.users_id AS users_id, usr.users_active AS users_active, usr.users_delete AS users_delete, ';
$cells .= 'md.medals_id AS medals_id, md.medalsuser_date AS medalsuser_date, md.medalsuser_id AS medalsuser_id';
$where = 'medals_id = ' . $medals_id . '';
$data['medals_user'] = array();

            }
            $cs_clans['clans_picture'] = $filename;
        } else {
            $errormsg .= $cs_lang['up_error'];
            $error++;
        }
    }
    if (empty($cs_clans['clans_name'])) {
        $error++;
        $errormsg .= $cs_lang['no_name'] . cs_html_br(1);
    }
    if (empty($cs_clans['clans_short'])) {
        $error++;
        $errormsg .= $cs_lang['no_short'] . cs_html_br(1);
    }
    $where = "clans_name = '" . cs_sql_escape($cs_clans['clans_name']) . "'";
    $where .= " AND clans_id != " . (int) $clans_id;
    $search = cs_sql_count(__FILE__, 'clans', $where);
    if (!empty($search)) {
        $error++;
        $errormsg .= $cs_lang['name_exists'] . cs_html_br(1);
    }
} else {
    $cells = 'clans_name, clans_short, clans_tag, clans_tagpos, clans_country, clans_url, clans_since, clans_pwd, clans_picture, users_id';
    $cs_clans = cs_sql_select(__FILE__, 'clans', $cells, "clans_id = " . (int) $clans_id);
    $cs_users = cs_sql_select(__FILE__, 'users', 'users_nick', 'users_id = ' . (int) $cs_clans['users_id']);
    $users_nick = $cs_users['users_nick'];
}
if (!isset($_POST['submit'])) {
    $data['lang']['body'] = $cs_lang['errors_here'];
}

        $levels++;
    }
    $data['cat']['abcode_smileys'] = cs_abcode_smileys('categories_text');
    $data['cat']['abcode_features'] = cs_abcode_features('categories_text');
    $matches[1] = $cs_lang['pic_infos'];
    $return_types = '';
    foreach ($img_filetypes as $add) {
        $return_types .= empty($return_types) ? $add : ', ' . $add;
    }
    $matches[2] = $cs_lang['max_width'] . $op_categories['max_width'] . ' px' . cs_html_br(1);
    $matches[2] .= $cs_lang['max_height'] . $op_categories['max_height'] . ' px' . cs_html_br(1);
    $matches[2] .= $cs_lang['max_size'] . cs_filesize($op_categories['max_size']) . cs_html_br(1);
    $matches[2] .= $cs_lang['filetypes'] . $return_types;
    $data['cat']['picup_clip'] = cs_abcode_clip($matches);
    echo cs_subtemplate(__FILE__, $data, 'categories', 'create');
} else {
    $categories_cells = array_keys($cs_categories);
    $categories_save = array_values($cs_categories);
    cs_sql_insert(__FILE__, 'categories', $categories_cells, $categories_save);
    if (!empty($files_gl['picture']['tmp_name'])) {
        $where = "categories_name = '" . cs_sql_escape($cs_categories['categories_name']) . "'";
        $getid = cs_sql_select(__FILE__, 'categories', 'categories_id', $where);
        $filename = 'picture-' . $getid['categories_id'] . '.' . $extension;
        cs_upload('categories', $filename, $files_gl['picture']['tmp_name']);
        $cs_categories2['categories_picture'] = $filename;
        $categories2_cells = array_keys($cs_categories2);
        $categories2_save = array_values($cs_categories2);
        cs_sql_update(__FILE__, 'categories', $categories2_cells, $categories2_save, $getid['categories_id']);
    }
    cs_redirect($cs_lang['create_done'], 'categories', 'manage', 'where=' . $cs_categories['categories_mod']);
}

<?php

// ClanSphere 2010 - www.clansphere.net
// $Id$
$cs_lang = cs_translate('articles');
$categories_id = empty($_REQUEST['where']) ? 0 : $_REQUEST['where'];
$start = empty($_REQUEST['start']) ? 0 : $_REQUEST['start'];
if (!empty($_POST['categories_id'])) {
    $categories_id = $_POST['categories_id'];
}
empty($categories_id) ? $where = 0 : ($where = "categories_id = '" . cs_sql_escape($categories_id) . "'");
$cs_sort[1] = 'articles_headline DESC';
$cs_sort[2] = 'articles_headline ASC';
$cs_sort[3] = 'articles_time DESC';
$cs_sort[4] = 'articles_time ASC';
$sort = empty($_REQUEST['sort']) ? 3 : $_REQUEST['sort'];
$order = $cs_sort[$sort];
$articles_count = cs_sql_count(__FILE__, 'articles');
$data['head']['articles_count'] = $articles_count;
$data['head']['pages'] = cs_pages('articles', 'manage', $articles_count, $start, $categories_id, $sort);
$catmod = "categories_mod = 'articles'";
$cells = 'categories_name, categories_id';
$categories_data = cs_sql_select(__FILE__, 'categories', $cells, $catmod, 'categories_name', 0, 0);
$data['head']['dropdown'] = cs_dropdown('categories_id', 'categories_name', $categories_data, $categories_id);
$data['head']['message'] = cs_getmsg();
$cat_where = empty($categories_id) ? 0 : 'categories_id = ' . (int) $categories_id;
$cells = 'articles_headline, articles_id, articles_time, users_id';
$cs_articles = cs_sql_select(__FILE__, 'articles', $cells, $cat_where, $order, $start, $account['users_limit']);
$articles_loop = count($cs_articles);
$data['sort']['headline'] = cs_sort('articles', 'manage', $start, $categories_id, 1, $sort);
$data['sort']['date'] = cs_sort('articles', 'manage', $start, $categories_id, 3, $sort);

 if (!empty($search_nick)) {
     $error++;
     $errormsg .= $cs_lang['nick_exists'] . cs_html_br(1);
 }
 $search_nick = strpos($register['nick'], '♥');
 if (!empty($search_nick)) {
     $error++;
     $errormsg .= $cs_lang['chars_in_nick'] . cs_html_br(1);
 }
 $pwd2 = str_replace(' ', '', $register['password']);
 $pwdchars = strlen($pwd2);
 if ($pwdchars < 4) {
     $error++;
     $errormsg .= $cs_lang['short_pwd'] . cs_html_br(1);
 }
 $search_email = cs_sql_count(__FILE__, 'users', "users_email = '" . cs_sql_escape($register['email']) . "'");
 if (!empty($search_email)) {
     $error++;
     $errormsg .= $cs_lang['email_exists'] . cs_html_br(1);
 }
 $pattern = "=^[_a-z0-9-]+(\\.[_a-z0-9-]+)*@([0-9a-z](-?[0-9a-z])*\\.)+[a-z]{2}([zmuvtg]|fo|me)?\$=i";
 if (!preg_match($pattern, $register['email'])) {
     $error++;
     $errormsg .= $cs_lang['email_false'] . cs_html_br(1);
 }
 include_once 'mods/contact/trashmail.php';
 if (cs_trashmail($register['email'])) {
     $error++;
     $errormsg .= $cs_lang['email_false'] . cs_html_br(1);
 }
 $flood = cs_sql_select(__FILE__, 'users', 'users_register', 0, 'users_register DESC');

if (!empty($cs_post['start'])) {
    $start = $cs_post['start'];
}
$sort = empty($cs_get['sort']) ? 2 : $cs_get['sort'];
if (!empty($cs_post['sort'])) {
    $sort = $cs_post['sort'];
}
include_once 'mods/categories/functions.php';
$op_cat = cs_sql_option(__FILE__, 'categories');
$cs_sort[1] = 'categories_name DESC';
$cs_sort[2] = 'categories_name ASC';
$cs_sort[3] = 'categories_url DESC';
$cs_sort[4] = 'categories_url ASC';
$order = 'categories_subid, ' . $cs_sort[$sort];
$where = empty($_REQUEST['where']) ? $op_cat['def_mod'] : $_REQUEST['where'];
$mdp = "categories_mod = '" . cs_sql_escape($where) . "'";
$categories_count = cs_sql_count(__FILE__, 'categories', $mdp);
$data['where']['mod'] = $where;
$data['head']['count'] = $categories_count;
$data['head']['pages'] = cs_pages('categories', 'manage', $categories_count, $start, $where, $sort);
$run = 0;
$modules = cs_checkdirs('mods');
foreach ($modules as $mods) {
    $check_axx = empty($account['access_' . $mods['dir'] . '']) ? 0 : $account['access_' . $mods['dir'] . ''];
    if (!empty($mods['categories']) and $check_axx > 2) {
        $mods['dir'] == $where ? $sel = 1 : ($sel = 0);
        $data['mod'][$run]['sel'] = cs_html_option($mods['name'], $mods['dir'], $sel);
        $run++;
    }
}
$data['head']['getmsg'] = cs_getmsg();