PHP db_input函数代码示例

 function log($priority, $title, $message, $alert = true)
 {
     global $cfg;
     switch ($priority) {
         //We are providing only 3 levels of logs. Windows style.
         case LOG_EMERG:
         case LOG_ALERT:
         case LOG_CRIT:
         case LOG_ERR:
             $level = 1;
             if ($alert) {
                 Sys::alertAdmin($title, $message);
             }
             break;
         case LOG_WARN:
         case LOG_WARNING:
             //Warning...
             $level = 2;
             break;
         case LOG_NOTICE:
         case LOG_INFO:
         case LOG_DEBUG:
         default:
             $level = 3;
             //debug
     }
     //Save log based on system log level settings.
     if ($cfg && $cfg->getLogLevel() >= $level) {
         $loglevel = array(1 => 'Error', 'Warning', 'Debug');
         $sql = 'INSERT INTO ' . SYSLOG_TABLE . ' SET created=NOW(),updated=NOW() ' . ',title=' . db_input($title) . ',log_type=' . db_input($loglevel[$level]) . ',log=' . db_input($message) . ',ip_address=' . db_input($_SERVER['REMOTE_ADDR']);
         //echo $sql;
         mysql_query($sql);
         //don't use db_query to avoid possible loop.
     }
 }

 function search($params)
 {
     $input = db_input(strtolower($params['input']), false);
     $len = strlen($input);
     $limit = isset($params['limit']) ? (int) $params['limit'] : 25;
     $items = array();
     $ticketid = false;
     if (is_numeric($input)) {
         $WHERE = ' WHERE ticketID LIKE \'' . $input . '%\'';
         $ticketid = true;
     } else {
         $WHERE = ' WHERE email LIKE \'' . $input . '%\'';
     }
     $sql = 'SELECT DISTINCT ticketID,email FROM ' . TICKET_TABLE . ' ' . $WHERE . ' ORDER BY created LIMIT ' . $limit;
     $resp = db_query($sql);
     if ($resp && db_num_rows($resp)) {
         while (list($id, $email) = db_fetch_row($resp)) {
             $info = $ticketid ? $email : $id;
             $id = $ticketid ? $id : $email;
             $items[] = '{"id": "' . $id . '", "value": "' . $id . '", "info": "' . $info . '"}';
         }
     }
     $result = '{"results": [' . implode(", ", $items) . ']}';
     return $result;
 }

 function search()
 {
     $limit = isset($_GET['limit']) ? (int) $_GET['limit'] : 25;
     $items = array();
     $ticketid = false;
     if (isset($_GET['id'])) {
         $WHERE = ' WHERE ticketID LIKE \'' . db_input($_GET['id'], false) . '%\'';
         $ticketid = true;
     } elseif (isset($_GET['email'])) {
         $WHERE = ' WHERE email LIKE \'' . db_input(strtolower($_GET['email']), false) . '%\'';
     } else {
         Http::response(400, "id or email argument is required");
     }
     $sql = 'SELECT DISTINCT ticketID,email,name FROM ' . TICKET_TABLE . ' ' . $WHERE . ' ORDER BY created LIMIT ' . $limit;
     $res = db_query($sql);
     if ($res && db_num_rows($res)) {
         while (list($id, $email, $name) = db_fetch_row($res)) {
             $info = $ticketid ? $email : $id;
             $id = $ticketid ? $id : $email;
             # TODO: Return 'name' from email address if 'email' argument
             #       specified?
             $items[] = array('id' => $id, 'value' => $id, 'info' => $info, 'name' => $name);
         }
     }
     return $this->encode(array('results' => $items));
 }

    function run($max_time) {
        foreach (array(
                'registration-staff', 'pwreset-staff', 'banner-staff',
                'registration-client', 'pwreset-client', 'banner-client',
                'registration-confirm', 'registration-thanks',
                'access-link') as $type) {
            $i18n = new Internationalization();
            $tpl = $i18n->getTemplate("templates/page/{$type}.yaml");
            if (!($page = $tpl->getData()))
                // No such template on disk
                continue;

            if ($id = db_result(db_query('select id from '.PAGE_TABLE
                    .' where `type`='.db_input($type))))
                // Already have a template for the content type
                continue;

            $sql = 'INSERT INTO '.PAGE_TABLE.' SET type='.db_input($type)
                .', name='.db_input($page['name'])
                .', body='.db_input($page['body'])
                .', lang='.db_input($tpl->getLang())
                .', notes='.db_input($page['notes'])
                .', created=NOW(), updated=NOW(), isactive=1';
            db_query($sql);
        }
        // Set the content_id for all the new items
        db_query('UPDATE '.PAGE_TABLE
            .' SET `content_id` = `id` WHERE `content_id` = 0');
    }

 function btn_save($id = '')
 {
     global $db, $messageStack;
     if ($this->security_id < 3) {
         $messageStack->add_session(ERROR_NO_PERMISSION, 'error');
         return false;
     }
     $title = db_prepare_input($_POST['title']);
     $code = strtoupper(db_prepare_input($_POST['code']));
     $sql_data_array = array('title' => $title, 'code' => $code, 'symbol_left' => db_prepare_input($_POST['symbol_left']), 'symbol_right' => db_prepare_input($_POST['symbol_right']), 'decimal_point' => db_prepare_input($_POST['decimal_point']), 'thousands_point' => db_prepare_input($_POST['thousands_point']), 'decimal_places' => db_prepare_input($_POST['decimal_places']), 'decimal_precise' => db_prepare_input($_POST['decimal_precise']), 'value' => db_prepare_input($_POST['value']));
     if ($id) {
         db_perform($this->db_table, $sql_data_array, 'update', "currencies_id = " . (int) $id);
         gen_add_audit_log(SETUP_LOG_CURRENCY . TEXT_UPDATE, $title);
     } else {
         db_perform($this->db_table, $sql_data_array);
         gen_add_audit_log(SETUP_LOG_CURRENCY . TEXT_ADD, $title);
     }
     if (isset($_POST['default']) && $_POST['default'] == 'on') {
         // first check to see if there are any general ledger entries
         $result = $db->Execute("select id from " . TABLE_JOURNAL_MAIN . " limit 1");
         if ($result->RecordCount() > 0) {
             $messageStack->add_session(SETUP_ERROR_CANNOT_CHANGE_DEFAULT, 'error');
         } else {
             $db->Execute("update " . TABLE_CONFIGURATION . " set configuration_value = '" . db_input($code) . "'\r\n\t\t\twhere configuration_key = 'DEFAULT_CURRENCY'");
             $db->Execute("alter table " . TABLE_JOURNAL_MAIN . " \r\n\t\t\tchange `currencies_code` `currencies_code` CHAR(3) NOT NULL DEFAULT '" . db_input($code) . "'");
         }
     }
     return true;
 }

 function create($staffId, $ticketId, $created)
 {
     if (is_numeric($staffId) && is_numeric($ticketId)) {
         $sql = 'INSERT INTO ' . SPENT_TIME_TABLE . ' SET ticket_id=' . db_input($ticketId) . ', staff_id=' . db_input($staffId) . ', created=' . db_input($created) . ', ended=NOW()' . ', seconds=TIME_TO_SEC(TIMEDIFF(ended,created))';
         return db_query($sql) && db_affected_rows() == 1;
     }
     return false;
 }

 function getIdByFileHash($hash, $tid = 0)
 {
     $sql = 'SELECT attach_id FROM ' . TICKET_ATTACHMENT_TABLE . ' a ' . ' INNER JOIN ' . FILE_TABLE . ' f ON(f.id=a.file_id) ' . ' WHERE f.hash=' . db_input($hash);
     if ($tid) {
         $sql .= ' AND a.ticket_id=' . db_input($tid);
     }
     return db_result(db_query($sql));
 }

 function cannedResp($params)
 {
     $sql = 'SELECT answer FROM ' . KB_PREMADE_TABLE . ' WHERE isenabled=1 AND premade_id=' . db_input($params['id']);
     if (($res = db_query($sql)) && db_num_rows($res)) {
         list($response) = db_fetch_row($res);
     }
     return $response;
 }

 function load($id)
 {
     $sql = 'SELECT * FROM ' . SYSLOG_TABLE . ' WHERE log_id=' . db_input($id);
     if (!($res = db_query($sql)) || !db_num_rows($res)) {
         return false;
     }
     $this->info = db_fetch_array($res);
     $this->id = $this->info['log_id'];
     return $this->id;
 }

 function run($max_time)
 {
     $sql = 'SELECT `INDEX_NAME` FROM information_schema.statistics
       WHERE table_schema = ' . db_input(DBNAME) . ' AND table_name = ' . db_input(TICKET_EMAIL_INFO_TABLE) . ' AND column_name = ' . db_input('thread_id');
     if ($name = db_result(db_query($sql))) {
         if ($name == 'PRIMARY') {
             db_query('ALTER TABLE `' . TICKET_EMAIL_INFO_TABLE . '` DROP PRIMARY KEY');
         }
     }
 }

 public function write($message)
 {
     $tableName = $this->tableName;
     $message = db_input($message);
     $time = time();
     $sql = "INSERT INTO `{$tableName}` (`message`, `time`) VALUES ('{$message}', {$time});";
     $result = db_query($sql);
     if (!$result) {
         throw new Exception(db_last_error());
     }
 }

 function renew()
 {
     global $cfg;
     $sql = 'UPDATE ' . TICKET_LOCK_TABLE . ' SET expire=DATE_ADD(NOW(),INTERVAL ' . $cfg->getLockTime() . ' MINUTE) ' . ' WHERE lock_id=' . db_input($this->getId());
     //echo $sql;
     if (db_query($sql) && db_affected_rows()) {
         $this->reload();
         return true;
     }
     return false;
 }

 function load($id)
 {
     if (!$id && !($id = $this->getId())) {
         return false;
     }
     $sql = 'SELECT *  FROM ' . PRIORITY_TABLE . ' WHERE priority_id=' . db_input($id);
     if (!($res = db_query($sql)) || !db_num_rows($res)) {
         return false;
     }
     $this->ht = db_fetch_array($res);
     $this->id = $this->ht['priority_id'];
     return true;
 }

 function load($id = 0)
 {
     if (!$id && !($id = $this->getId())) {
         return false;
     }
     $sql = 'SELECT * FROM ' . TIMEZONE_TABLE . ' WHERE id=' . db_input($id);
     if (!($res = db_query($sql)) || !db_num_rows($res)) {
         return false;
     }
     $this->ht = db_fetch_array($res);
     $this->id = $this->ht['id'];
     return $this->id;
 }

 function run()
 {
     $res = db_query('SELECT api_whitelist, api_key FROM ' . CONFIG_TABLE . ' WHERE id=1');
     if (!$res || !db_num_rows($res)) {
         return 0;
     }
     //Reporting success.
     list($whitelist, $key) = db_fetch_row($res);
     $ips = array_filter(array_map('trim', explode(',', $whitelist)));
     foreach ($ips as $ip) {
         $sql = 'INSERT INTO ' . API_KEY_TABLE . ' SET created=NOW(), updated=NOW(), isactive=1 ' . ',ipaddr=' . db_input($ip) . ',apikey=' . db_input(strtoupper(md5($ip . md5($key))));
         db_query($sql);
     }
 }