PHP db_prepare_string函数代码示例

function profile_update($p_user_id, $p_profile_id, $p_platform, $p_os, $p_os_build, $p_description)
{
    $c_user_id = db_prepare_int($p_user_id);
    $c_profile_id = db_prepare_int($p_profile_id);
    $c_platform = db_prepare_string($p_platform);
    $c_os = db_prepare_string($p_os);
    $c_os_build = db_prepare_string($p_os_build);
    $c_description = db_prepare_string($p_description);
    if (ALL_USERS != $p_user_id) {
        user_ensure_unprotected($p_user_id);
    }
    # platform cannot be blank
    if (is_blank($c_platform)) {
        error_parameters(lang_get('platform'));
        trigger_error(ERROR_EMPTY_FIELD, ERROR);
    }
    # os cannot be blank
    if (is_blank($c_os)) {
        error_parameters(lang_get('operating_system'));
        trigger_error(ERROR_EMPTY_FIELD, ERROR);
    }
    # os_build cannot be blank
    if (is_blank($c_os_build)) {
        error_parameters(lang_get('version'));
        trigger_error(ERROR_EMPTY_FIELD, ERROR);
    }
    $t_user_profile_table = config_get('mantis_user_profile_table');
    # Add item
    $query = "UPDATE {$t_user_profile_table}\n\t\t\t\t  SET platform='{$c_platform}',\n\t\t\t\t  \t  os='{$c_os}',\n\t\t\t\t\t  os_build='{$c_os_build}',\n\t\t\t\t\t  description='{$c_description}'\n\t\t\t\t  WHERE id='{$c_profile_id}' AND user_id='{$c_user_id}'";
    $result = db_query($query);
    # db_query() errors on failure so:
    return true;
}

function faq_update_query($p_id, $p_question, $p_answere, $p_project_id, $p_view_level)
{
    global $g_mantis_faq_table;
    # " character poses problem when editting so let's just convert them to '
    $p_question = db_prepare_string($p_question);
    $p_answere = db_prepare_string($p_answere);
    # Update entry
    $query = "UPDATE {$g_mantis_faq_table}\n\t\t\t\tSET question='{$p_question}', answere='{$p_answere}',\n\t\t\t\t\tproject_id='{$p_project_id}', view_access='{$p_view_level}', last_modified=NOW()\n\t    \t\tWHERE id='{$p_id}'";
    return db_query_bound($query);
}

function history_log_event_special($p_bug_id, $p_type, $p_optional = '', $p_optional2 = '')
{
    $c_bug_id = db_prepare_int($p_bug_id);
    $c_type = db_prepare_int($p_type);
    $c_optional = db_prepare_string($p_optional);
    $c_optional2 = db_prepare_string($p_optional2);
    $t_user_id = auth_get_current_user_id();
    $t_mantis_bug_history_table = config_get('mantis_bug_history_table');
    $query = "INSERT INTO {$t_mantis_bug_history_table}\n\t\t\t\t\t( user_id, bug_id, date_modified, type, old_value, new_value, field_name )\n\t\t\t\tVALUES\n\t\t\t\t\t( '{$t_user_id}', '{$c_bug_id}', " . db_now() . ", '{$c_type}', '{$c_optional}', '{$c_optional2}', '' )";
    $result = db_query($query);
}

function admin_check_applied($p_table_name, $p_field_name = '')
{
    $c_table_name = db_prepare_string($p_table_name);
    $c_field_name = db_prepare_string($p_field_name);
    $result = db_query("DESCRIBE {$c_table_name} {$c_field_name}");
    if ($result && 0 < db_num_rows($result)) {
        return true;
    } else {
        return false;
    }
}

function email_queue_prepare_db($p_email_data)
{
    $t_email_data = new EmailData();
    $t_email_data->email_id = db_prepare_int($p_email_data->email_id);
    $t_email_data->email = db_prepare_string($p_email_data->email);
    $t_email_data->subject = db_prepare_string($p_email_data->subject);
    $t_email_data->body = db_prepare_string($p_email_data->body);
    $t_email_data->metadata = array();
    foreach ($p_email_data->metadata as $t_key => $t_value) {
        if ($t_key != 'headers') {
            $t_email_data->metadata[$t_key] = db_prepare_string($t_value);
        }
    }
    foreach ($p_email_data->metadata['headers'] as $t_key => $t_value) {
        $t_email_data->metadata['headers'][$t_key] = db_prepare_string($t_value);
    }
    $t_email_data->submitted = db_prepare_string($p_email_data->submitted);
    return $t_email_data;
}

function news_update($p_news_id, $p_project_id, $p_view_state, $p_announcement, $p_headline, $p_body)
{
    $c_news_id = db_prepare_int($p_news_id);
    $c_project_id = db_prepare_int($p_project_id);
    $c_view_state = db_prepare_int($p_view_state);
    $c_announcement = db_prepare_bool($p_announcement);
    $c_headline = db_prepare_string($p_headline);
    $c_body = db_prepare_string($p_body);
    if (is_blank($c_headline)) {
        error_parameters(lang_get('headline'));
        trigger_error(ERROR_EMPTY_FIELD, ERROR);
    }
    if (is_blank($c_body)) {
        error_parameters(lang_get('body'));
        trigger_error(ERROR_EMPTY_FIELD, ERROR);
    }
    $t_news_table = config_get('mantis_news_table');
    # Update entry
    $query = "UPDATE {$t_news_table}\n\t\t\t\t  SET view_state='{$c_view_state}',\n\t\t\t\t\tannouncement='{$c_announcement}',\n\t\t\t\t\theadline='{$c_headline}',\n\t\t\t\t\tbody='{$c_body}',\n\t\t\t\t\tproject_id='{$c_project_id}',\n\t\t\t\t\tlast_modified= " . db_now() . "\n\t\t\t\t  WHERE id='{$c_news_id}'";
    db_query($query);
    # db_query() errors on failure so:
    return true;
}

function upgrade_fix_strings($p_table_name, $p_primary_key, $p_fields)
{
    $c_table_name = db_prepare_string($p_table_name);
    $c_primary_key = db_prepare_string($p_primary_key);
    $t_field_string = db_prepare_string(implode(',', $p_fields));
    $query = "SELECT {$c_primary_key}, {$t_field_string} FROM {$c_table_name}";
    $result = @db_query($query);
    if (false == $result) {
        return false;
    }
    $count = db_num_rows($result);
    $t_failures = 0;
    for ($i = 0; $i < $count; $i++) {
        $row = db_fetch_array($result);
        $query2 = "UPDATE {$c_table_name} SET ";
        $t_updates = array();
        foreach ($p_fields as $t_field) {
            $t_new_value = stripslashes(upgrade_decode_entities($row[$t_field]));
            $t_updates[] = db_prepare_string($t_field) . "='" . db_prepare_string($t_new_value) . "'";
        }
        $query2 .= implode(',', $t_updates);
        $query2 .= "WHERE {$c_primary_key}=" . $row[$p_primary_key];
        $result2 = @db_query($query2);
        if (false == $result2) {
            $t_failures++;
        }
    }
    # If every query failed, something must be wrong so let's fail
    # If fewer failed, we don't want to fail because unescaping the
    #  successful ones again is bad.
    if ($count > 0 && $t_failures == $count) {
        return false;
    } else {
        return true;
    }
}

$f_user_id = gpc_get_int('user_id');
$f_email = trim($f_email);
$f_username = trim($f_username);
$t_old_username = user_get_field($f_user_id, 'username');
# check that the username is unique
if (0 != strcasecmp($t_old_username, $f_username) && false == user_is_name_unique($f_username)) {
    trigger_error(ERROR_USER_NAME_NOT_UNIQUE, ERROR);
}
user_ensure_name_valid($f_username);
user_ensure_realname_valid($f_realname);
user_ensure_realname_unique($f_username, $f_realname);
$f_email = email_append_domain($f_email);
email_ensure_valid($f_email);
$c_email = db_prepare_string($f_email);
$c_username = db_prepare_string($f_username);
$c_realname = db_prepare_string($f_realname);
$c_protected = db_prepare_bool($f_protected);
$c_enabled = db_prepare_bool($f_enabled);
$c_user_id = db_prepare_int($f_user_id);
$c_access_level = db_prepare_int($f_access_level);
$t_user_table = config_get('mantis_user_table');
$t_old_protected = user_get_field($f_user_id, 'protected');
# check that we are not downgrading the last administrator
$t_old_access = user_get_field($f_user_id, 'access_level');
if (ADMINISTRATOR == $t_old_access && $t_old_access != $f_access_level && 1 >= user_count_level(ADMINISTRATOR)) {
    trigger_error(ERROR_USER_CHANGE_LAST_ADMIN, ERROR);
}
# Project specific access rights override global levels, hence, for users who are changed
# to be administrators, we have to remove project specific rights.
if ($c_access_level >= ADMINISTRATOR && !user_is_administrator($c_user_id)) {
    user_delete_project_specific_access_levels($c_user_id);

 /**
  * Return object of a specific class by SQL
  *
  * @param string $sql
  * @param array $arguments
  * @param boolean $one
  * @param string $table_name
  * @return array
  */
 function findBySQL($sql, $arguments = null, $one = false)
 {
     if ($arguments !== null) {
         $sql = db_prepare_string($sql, $arguments);
     }
     // if
     $rows = db_execute_all($sql);
     if (is_error($rows)) {
         return $rows;
     }
     // if
     if (!is_foreachable($rows)) {
         return null;
     }
     // if
     if ($one) {
         $row = $rows[0];
         $item_class = array_var($row, 'type');
         $item = new $item_class();
         $item->loadFromRow($row);
         return $item;
     } else {
         $items = array();
         foreach ($rows as $row) {
             $item_class = array_var($row, 'type');
             $item = new $item_class();
             $item->loadFromRow($row);
             $items[] = $item;
         }
         // foreach
         return count($items) ? $items : null;
     }
     // if
 }

		else
		{
			if(NeedQuotes($cUserNameFieldType))
				$value=db_prepare_string($value);
			else
				$value=(0+$value);
		}
		$sWhere="(".GetFullFieldName($cUserNameField,"webreport_users",false)."=".$value;

		$value=$strUsernameEmail;
		if($cipherer->isFieldEncrypted($cEmailField))
			$value = $cipherer->MakeDBValue($cEmailField,$value,"","",true);
		else
		{
			if(NeedQuotes($cEmailFieldType))
				$value=db_prepare_string($value);
			else
				$value=(0+$value);
		}
		$sWhere.=" or ".GetFullFieldName($cEmailField,"webreport_users",false)."=".$value.")";
	
		if($tosearch && $globalEvents->exists("BeforeRemindPassword"))
			$tosearch = $globalEvents->BeforeRemindPassword($strUsernameEmail,$strUsernameEmail, $pageObject);
		
		if($tosearch)
		{
			$selectClause = "select ".GetFullFieldName($cUserNameField,"webreport_users",false)." as ".AddFieldWrappers($cUserNameField)
				.",".GetFullFieldName($cPasswordField,"webreport_users",false)." as ".AddFieldWrappers($cPasswordField);
			
			// prevent aliases mixing
			if( $cUserNameField != $cEmailField )

    } else {
        $t_caption = $t_prefix;
    }
    if ($t_prefix == $f_prefix) {
        $t_link = "<strong>{$t_caption}</strong>";
    } else {
        $t_link = '<a href="manage_user_page.php?prefix=' . $t_prefix . '">' . $t_caption . '</a>';
    }
    $t_index_links .= '<td>' . $t_link . '</td>';
}
$t_index_links .= '</tr></table></center>';
echo $t_index_links;
if ($f_prefix === 'ALL') {
    $t_where = '(1 = 1)';
} else {
    $c_prefix = db_prepare_string($f_prefix);
    $t_where = "(username like '{$c_prefix}%')";
}
# Get the user data in $c_sort order
if (0 == $c_hide) {
    $query = "SELECT *\n\t\t\t\tFROM {$t_user_table}\n\t\t\t\tWHERE {$t_where}\n\t\t\t\tORDER BY {$c_sort} {$c_dir}";
} else {
    $query = "SELECT *\n\t\t\t\tFROM {$t_user_table}\n\t\t\t\tWHERE (" . db_helper_compare_days(db_now(), "last_visit", "< '{$days_old}'") . ") AND {$t_where}\n\t\t\t\tORDER BY {$c_sort} {$c_dir}";
}
$result = db_query($query);
$user_count = db_num_rows($result);
?>
<br />
<table class="width100" cellspacing="1">
<tr>
	<td class="form-title" colspan="5">

# DEVELOPER / RESOLUTION #
?>
		<table class="width100" cellspacing="1">
		<tr>
			<td class="form-title" colspan="1">
				<?php 
echo lang_get('developer_by_resolution');
?>
			</td>
			<?php 
$t_arr = explode_enum_string(config_get('resolution_enum_string'));
$enum_count = count($t_arr);
for ($i = 0; $i < $enum_count; $i++) {
    print '<td>';
    $t_s = explode_enum_arr($t_arr[$i]);
    $c_s[0] = db_prepare_string($t_s[0]);
    echo get_enum_element('resolution', $c_s[0]);
    print '</td>';
}
print '<td>';
print lang_get('percentage_fixed');
print '</td>';
?>
		</tr>
		<?php 
summary_print_developer_resolution(config_get('resolution_enum_string'));
?>
		</table>
	</td>
</tr>
</table>

}
$c_file_id = db_prepare_int($f_file_id);
$c_title = db_prepare_string($f_title);
$c_description = db_prepare_string($f_description);
$t_project_file_table = db_get_table('mantis_project_file_table');
/** @todo (thraxisp) this code should probably be integrated into file_api to share methods used to store files */
file_ensure_uploaded($f_file);
extract($f_file, EXTR_PREFIX_ALL, 'v');
if (is_uploaded_file($v_tmp_name)) {
    $t_project_id = helper_get_current_project();
    # grab the original file path and name
    $t_disk_file_name = file_get_field($f_file_id, 'diskfile', 'project');
    $t_file_path = dirname($t_disk_file_name);
    # prepare variables for insertion
    $c_file_name = db_prepare_string($v_name);
    $c_file_type = db_prepare_string($v_type);
    $t_file_size = filesize($v_tmp_name);
    $t_max_file_size = (int) min(ini_get_number('upload_max_filesize'), ini_get_number('post_max_size'), config_get('max_file_size'));
    if ($t_file_size > $t_max_file_size) {
        trigger_error(ERROR_FILE_TOO_BIG, ERROR);
    }
    $c_file_size = db_prepare_int($t_file_size);
    $t_method = config_get('file_upload_method');
    switch ($t_method) {
        case FTP:
        case DISK:
            file_ensure_valid_upload_path($t_file_path);
            if (FTP == $t_method) {
                $conn_id = file_ftp_connect();
                file_ftp_delete($conn_id, $t_disk_file_name);
                file_ftp_put($conn_id, $t_disk_file_name, $v_tmp_name);

/**
 * Print due on string (due in, due today or late) for a given object
 *
 * @param array $params
 * @param Smarty $smarty
 * @return string
 */
function smarty_function_due($params, &$smarty)
{
    $object = array_var($params, 'object');
    $due_date = null;
    if (instance_of($object, 'ProjectObject')) {
        if ($object->can_be_completed) {
            if ($object->isCompleted()) {
                return lang('Completed');
            }
            // if
            $due_date = $object->getDueOn();
        } else {
            return '--';
        }
        // if
    } elseif (instance_of($object, 'Invoice')) {
        if ($object->getStatus() == INVOICE_STATUS_ISSUED) {
            $due_date = $object->getDueOn();
        } else {
            return '--';
        }
        // if
    } else {
        return new InvalidParamError('object', $object, '$object is not expected to be an instance of ProjectObject or Invoice class', true);
    }
    // if
    $offset = get_user_gmt_offset();
    if (instance_of($due_date, 'DateValue')) {
        require_once SMARTY_PATH . '/plugins/modifier.date.php';
        $date = smarty_modifier_date($due_date, 0);
        // just printing date, offset is 0!
        $reminder_string_begining = '';
        $reminder_string_end = '';
        $sql = "select auto_email_status, email_reminder_period, email_reminder_unit, email_reminder_time from healingcrystals_project_object_misc where object_id=? and auto_email_status='1'";
        $arguments = array($object->getId());
        $sql = db_prepare_string($sql, $arguments);
        $row = db_execute_all($sql);
        if (!empty($row)) {
            $entry = $row[0];
            $auto_email_status = array_var($entry, 'auto_email_status');
            $email_reminder_period = array_var($entry, 'email_reminder_period', '0');
            $email_reminder_unit = array_var($entry, 'email_reminder_unit', 'D');
            $email_reminder_time = array_var($entry, 'email_reminder_time', '06:00');
            $meridian = '';
            list($h, $m) = explode(':', $email_reminder_time);
            $h = (int) $h;
            if ($h > 12) {
                $h -= 12;
                $meridian = 'PM';
            } elseif ($h == 12) {
                $meridian = 'PM';
            } elseif ($h == 0) {
                $meridian = 'AM';
            } else {
                $meridian = 'AM';
            }
            $email_reminder_time = str_pad($h, 2, '0', STR_PAD_LEFT) . ':' . $m . ' ' . $meridian;
            $reminder_string_begining = 'Reminder set for ' . $email_reminder_period . ' ' . ($email_reminder_unit == 'D' ? 'Day(s)' : ($email_reminder_unit == 'W' ? 'Week(s)' : ($email_reminder_unit == 'M' ? 'Month(s)' : ''))) . " from Due Date: ";
            $reminder_string_end = " at " . $email_reminder_time;
        }
        if ($due_date->isToday($offset)) {
            if (!empty($reminder_string_begining)) {
                return '<span class="today">' . $reminder_string_begining . '<span class="number">' . lang('Today') . '</span>' . $reminder_string_end . '</span>';
            } else {
                return '<span class="today"><span class="number">' . lang('Due Today') . '</span></span>';
            }
        } elseif ($due_date->isYesterday($offset)) {
            if (!empty($reminder_string_begining)) {
                return '<span class="late" title="' . clean($date) . '">' . $reminder_string_begining . lang('<span class="number">1 Day Late</span>') . $reminder_string_end . '</span>';
            } else {
                return '<span class="late" title="' . clean($date) . '">' . lang('<span class="number">1 Day Late</span>') . '</span>';
            }
        } elseif ($due_date->isTomorrow($offset)) {
            if (!empty($reminder_string_begining)) {
                return '<span class="upcoming" title="' . clean($date) . '">' . $reminder_string_begining . '<span class="number">' . lang('Tomorrow') . '</span>' . $reminder_string_end . '</span>';
            } else {
                return '<span class="upcoming" title="' . clean($date) . '"><span class="number">' . lang('Due Tomorrow') . '</span></span>';
            }
        } else {
            $now = new DateTimeValue();
            $now->advance($offset);
            $now = $now->beginningOfDay();
            $due_date->beginningOfDay();
            if ($due_date->getTimestamp() > $now->getTimestamp()) {
                //return '<span class="upcoming" title="' . clean($date) . '">' . lang('Due in <span class="number">:days</span> Days', array('days' => floor(($due_date->getTimestamp() - $now->getTimestamp()) / 86400))) . '</span>';
                //return '<span class="upcoming" title="' . clean($date) . '">' . lang('<span class="number">:days</span> Days', array('days' => floor(($due_date->getTimestamp() - $now->getTimestamp()) / 86400))) . '</span>';
                if (!empty($reminder_string_begining)) {
                    return '<span class="upcoming" title="' . clean($date) . '">' . $reminder_string_begining . date('F d, Y', $due_date->getTimestamp()) . lang(' (<span class="number">:days</span> Days)', array('days' => floor(($due_date->getTimestamp() - $now->getTimestamp()) / 86400))) . $reminder_string_end . '</span>';
                } else {
                    return '<span class="upcoming" title="' . clean($date) . '">Due ' . date('F d, Y', $due_date->getTimestamp()) . lang(' (<span class="number">:days</span> Days)', array('days' => floor(($due_date->getTimestamp() - $now->getTimestamp()) / 86400))) . '</span>';
                }
            } else {
                //return '<span class="late" title="' . clean($date) . '">' . lang('<span class="number">:days</span> Days Late', array('days' => floor(($now->getTimestamp() - $due_date->getTimestamp()) / 86400))) . '</span>';
//.........这里部分代码省略.........

/**
 * Sets multiple fields on a user
 *
 * @param integer $p_user_id A valid user identifier.
 * @param array   $p_fields  Keys are the field names and the values are the field values.
 * @return void
 */
function user_set_fields($p_user_id, array $p_fields)
{
    if (!array_key_exists('protected', $p_fields)) {
        user_ensure_unprotected($p_user_id);
    }
    $t_query = 'UPDATE {user}';
    $t_parameters = array();
    foreach ($p_fields as $t_field_name => $t_field_value) {
        $c_field_name = db_prepare_string($t_field_name);
        if (count($t_parameters) == 0) {
            $t_query .= ' SET ' . $c_field_name . '=' . db_param();
        } else {
            $t_query .= ' , ' . $c_field_name . '=' . db_param();
        }
        array_push($t_parameters, $t_field_value);
    }
    $t_query .= ' WHERE id=' . db_param();
    array_push($t_parameters, (int) $p_user_id);
    db_query($t_query, $t_parameters);
    user_clear_cache($p_user_id);
}