PHP db_quote_id函数代码示例

                 $updateqr .= db_quote_id($fieldname) . " = '{$datetimeobj->convert("Y-m-d H:i:s")}', \n";
             }
         } elseif (($irow['type'] == 'N' || $irow['type'] == 'K') && $thisvalue == "") {
             $updateqr .= db_quote_id($fieldname) . " = NULL, \n";
         } elseif ($irow['type'] == '|' && strpos($irow['fieldname'], '_filecount') && $thisvalue == "") {
             $updateqr .= db_quote_id($fieldname) . " = NULL, \n";
         } elseif ($irow['type'] == 'submitdate') {
             if (isset($_POST['completed']) && $_POST['completed'] == "N") {
                 $updateqr .= db_quote_id($fieldname) . " = NULL, \n";
             } elseif (isset($_POST['completed']) && $thisvalue == "") {
                 $updateqr .= db_quote_id($fieldname) . " = " . db_quoteall($_POST['completed'], true) . ", \n";
             } else {
                 $updateqr .= db_quote_id($fieldname) . " = " . db_quoteall($thisvalue, true) . ", \n";
             }
         } else {
             $updateqr .= db_quote_id($fieldname) . " = " . db_quoteall($thisvalue, true) . ", \n";
         }
     }
     $updateqr = substr($updateqr, 0, -3);
     $updateqr .= " WHERE id={$id}";
     $updateres = $connect->Execute($updateqr) or safe_die("Update failed:<br />\n" . $connect->ErrorMsg() . "<br />{$updateqr}");
     $thissurvey = getSurveyInfo($surveyid);
     while (ob_get_level() > 0) {
         ob_end_flush();
     }
     $dataentryoutput .= "<div class='messagebox ui-corner-all'><div class='successheader'>" . $clang->gT("Success") . "</div>\n" . $clang->gT("Record has been updated.") . "<br /><br />\n" . "<input type='submit' value='" . $clang->gT("View This Record") . "' onclick=\"window.open('{$scriptname}?action=browse&amp;sid={$surveyid}&amp;subaction=id&amp;id={$id}', '_top')\" /><br /><br />\n" . "<input type='submit' value='" . $clang->gT("Browse Responses") . "' onclick=\"window.open('{$scriptname}?action=browse&amp;sid={$surveyid}&amp;subaction=all', '_top')\" />\n" . "</div>\n";
 } elseif ($subaction == "delete" && bHasSurveyPermission($surveyid, 'responses', 'delete')) {
     $dataentryoutput .= "<div class='header ui-widget-header'>" . $clang->gT("Data entry") . "</div>\n";
     $dataentryoutput .= "<div class='messagebox ui-corner-all'>\n";
     $thissurvey = getSurveyInfo($surveyid);
     $delquery = "DELETE FROM {$surveytable} WHERE id={$id}";

                //kick out ignored columns
                foreach ($ignoredcolumns  as $column)
                {
                    unset($writearray[$column]);
                }
                $dupfound=false;
                $invalidemail=false;

                if ($filterduplicatetoken!=false)
                {
                    $dupquery = "SELECT tid from ".db_table_name("tokens_$surveyid")." where 1=1";
                    foreach($filterduplicatefields as $field)
                    {
                        if (isset($writearray[$field])) {
                            $dupquery.=' and '.db_quote_id($field).' = '.db_quoteall($writearray[$field]);
                        }
                    }
                    $dupresult = $connect->Execute($dupquery) or safe_die ("Invalid field in duplicate check<br />$dupquery<br /><br />".$connect->ErrorMsg());
                    if ( $dupresult->RecordCount() > 0)
                    {
                        $dupfound = true;
                        $duplicatelist[]=$writearray['firstname']." ".$writearray['lastname']." (".$writearray['email'].")";
                    }
                }


                $writearray['email'] = trim($writearray['email']);

                //treat blank emails
                if ($filterblankemail && $writearray['email']=='')

/**
 * This functions saves the answer time for question/group and whole survey.
 * [ It compares current time with the time in $_POST['start_time'] ]
 * The times are saved in table: {prefix}{surveytable}_timings
 * @return void
 */
function set_answer_time()
{
    global $connect, $thissurvey, $surveyid;
    if (!isset($_POST['start_time'])) {
        return;
        // means haven't passed welcome page yet.
    }
    if (isset($_POST['lastanswer'])) {
        $setField = $_POST['lastanswer'];
    } else {
        if (isset($_POST['lastgroup'])) {
            $setField = $_POST['lastgroup'];
        }
    }
    $passedTime = round(microtime(true) - $_POST['start_time'], 2);
    $tablename = db_table_name('survey_' . $surveyid . '_timings');
    if (!isset($setField)) {
        //we show the whole survey on one page - we don't have to save time for group/question
        $query = "UPDATE " . $tablename . " SET " . "interviewtime = interviewtime" . " + " . $passedTime . " WHERE id = " . $_SESSION['srid'];
        $connect->execute($query);
        return;
    } else {
        $setField .= "time";
        //saving the times
        $query = "UPDATE " . $tablename . " SET " . "interviewtime = interviewtime" . " + " . $passedTime . "," . db_quote_id($setField) . " = " . db_quote_id($setField) . " + " . $passedTime . " WHERE id = " . $_SESSION['srid'];
        $connect->execute($query);
    }
}

             // Now, zip all the files in the filelist
             $zipfilename = "Responses_for_survey_" . $surveyid . ".zip";
             zipFiles($_POST['markedresponses'], $zipfilename);
         }
     }
 } else {
     if (isset($_POST['downloadfile']) && $_POST['downloadfile'] != '' && $_POST['downloadfile'] !== true) {
         // Now, zip all the files in the filelist
         $zipfilename = "LS_Responses_for_" . $_POST['downloadfile'] . ".zip";
         zipFiles($_POST['downloadfile'], $zipfilename);
     } else {
         if (isset($_POST['downloadindividualfile']) && $_POST['downloadindividualfile'] != '') {
             $id = (int) $_POST['id'];
             $downloadindividualfile = $_POST['downloadindividualfile'];
             $fieldname = $_POST['fieldname'];
             $query = "SELECT " . db_quote_id($fieldname) . " FROM {$surveytable} WHERE id={$id}";
             $result = db_execute_num($query);
             $row = $result->FetchRow();
             $phparray = json_decode($row[0]);
             for ($i = 0; $i < count($phparray); $i++) {
                 if ($phparray[$i]->name == $downloadindividualfile) {
                     $file = $uploaddir . "/surveys/" . $surveyid . "/files/" . $phparray[$i]->filename;
                     if (file_exists($file)) {
                         header('Content-Description: File Transfer');
                         header('Content-Type: application/octet-stream');
                         header('Content-Disposition: attachment; filename="' . rawurldecode($phparray[$i]->name) . '"');
                         header('Content-Transfer-Encoding: binary');
                         header('Expires: 0');
                         header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
                         header('Pragma: public');
                         header('Content-Length: ' . filesize($file));

         unset($fielddata[db_quote_id($numericfield)]);
     }
 }
 if (isset($fielddata[db_quote_id('submitdate')]) && $fielddata[db_quote_id('submitdate')] == 'NULL') {
     unset($fielddata[db_quote_id('submitdate')]);
 }
 if ($fielddata[db_quote_id('lastpage')] == '') {
     $fielddata[db_quote_id('lastpage')] = '0';
 }
 $recordexists = false;
 if (isset($fielddata['[id]'])) {
     $result = $connect->Execute("select id from {$surveytable} where id=" . $fielddata[db_quote_id('id')]);
     $recordexists = $result->RecordCount() > 0;
     if ($recordexists) {
         if ($insertstyle == "ignore") {
             $vvoutput .= sprintf($clang->gT("Record ID %d was skipped because of duplicate ID."), $fielddata[db_quote_id('id')]) . '<br/>';
             continue;
         }
         if ($insertstyle == "replace") {
             $result = $connect->Execute("delete from {$surveytable} where id=" . $fielddata['id']);
             $recordexists = false;
         }
     }
 }
 if ($insertstyle == "renumber") {
     unset($fielddata['id']);
 }
 if (isset($fielddata['id'])) {
     db_switchIDInsert("survey_{$surveyid}", true);
 }
 // try again, without the 'id' field.

 if ($_SESSION['USER_RIGHT_SUPERADMIN'] == 1 || $_SESSION['USER_RIGHT_MANAGE_TEMPLATE'] == 1) {
     $templaterights = array();
     $tquery = "SELECT * FROM " . $dbprefix . "templates";
     $tresult = db_execute_assoc($tquery);
     while ($trow = $tresult->FetchRow()) {
         if (isset($_POST[$trow["folder"] . "_use"])) {
             $templaterights[$trow["folder"]] = 1;
         } else {
             $templaterights[$trow["folder"]] = 0;
         }
     }
     foreach ($templaterights as $key => $value) {
         $uquery = "INSERT INTO {$dbprefix}templates_rights (uid," . db_quote_id('folder') . "," . db_quote_id('use') . ")  VALUES ({$postuserid},'" . $key . "',{$value})";
         $uresult = $connect->execute($uquery);
         if (!$uresult) {
             $uquery = "UPDATE {$dbprefix}templates_rights  SET  " . db_quote_id('use') . "={$value} where " . db_quote_id('folder') . "='{$key}' AND uid=" . $postuserid;
             $uresult = $connect->execute($uquery);
         }
     }
     if ($uresult) {
         $addsummary .= "<div class=\"successheader\">" . $clang->gT("Template permissions were updated successfully.") . "</div>\n";
         $addsummary .= "<br/><input type=\"submit\" onclick=\"window.open('{$scriptname}?action=editusers', '_top')\" value=\"" . $clang->gT("Continue") . "\"/>\n";
     } else {
         $addsummary .= "<div class=\"warningheader\">" . $clang->gT("Error") . "</div>\n";
         $addsummary .= "<br />" . $clang->gT("Error while updating usertemplates.") . "<br />\n";
         $addsummary .= "<br/><input type=\"submit\" onclick=\"window.open('{$scriptname}?action=editusers', '_top')\" value=\"" . $clang->gT("Continue") . "\"/>\n";
     }
 } else {
     include "access_denied.php";
 }
 $addsummary .= "</div>\n";

 /**
  * Write values to database.
  * @param <type> $updatedValues
  * @param <boolean> $finished - true if the survey needs to be finalized
  */
 private function _UpdateValuesInDatabase($updatedValues, $finished = false)
 {
     // Update these values in the database
     global $connect;
     $message = '';
     $_SESSION['datestamp'] = date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i:s", $this->surveyOptions['timeadjust']);
     if ($this->surveyOptions['active'] && !isset($_SESSION['srid'])) {
         // Create initial insert row for this record
         $today = date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i:s", $this->surveyOptions['timeadjust']);
         $sdata = array("datestamp" => $today, "ipaddr" => $this->surveyOptions['ipaddr'] && isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '', "startlanguage" => $this->surveyOptions['startlanguage'], "token" => $this->surveyOptions['token'], "datestamp" => $this->surveyOptions['datestamp'] ? $_SESSION['datestamp'] : NULL, "refurl" => $this->surveyOptions['refurl'] ? getenv("HTTP_REFERER") : NULL, "startdate" => $this->surveyOptions['datestamp'] ? $_SESSION['datestamp'] : date("Y-m-d H:i:s", 0));
         //One of the strengths of ADOdb's AutoExecute() is that only valid field names for $table are updated
         if ($connect->AutoExecute($this->surveyOptions['tablename'], $sdata, 'INSERT')) {
             $srid = $connect->Insert_ID($this->surveyOptions['tablename'], "id");
             $_SESSION['srid'] = $srid;
         } else {
             $message .= $this->gT("Unable to insert record into survey table: ") . $connect->ErrorMsg() . "<br/>";
             $_SESSION['flashmessage'] = $message;
             echo $message;
         }
         //Insert Row for Timings, if needed
         if ($this->surveyOptions['savetimings']) {
             $tdata = array('id' => $srid, 'interviewtime' => 0);
             if ($connect->AutoExecute($this->surveyOptions['tablename_timings'], $tdata, 'INSERT')) {
                 $trid = $connect->Insert_ID($this->surveyOptions['tablename_timings'], "sid");
             } else {
                 $message .= $this->gT("Unable to insert record into timings table ") . $connect->ErrorMsg() . "<br/>";
                 $_SESSION['flashmessage'] = $message;
                 echo $message;
             }
         }
     }
     if (count($updatedValues) > 0 || $finished) {
         $query = 'UPDATE ' . $this->surveyOptions['tablename'] . " SET ";
         $setter = array();
         switch ($this->surveyMode) {
             case 'question':
                 $thisstep = $this->currentQuestionSeq;
                 break;
             case 'group':
                 $thisstep = $this->currentGroupSeq;
                 break;
             case 'survey':
                 $thisstep = 1;
                 break;
         }
         $setter[] = db_quote_id('lastpage') . "=" . db_quoteall($thisstep);
         if ($this->surveyOptions['datestamp'] && isset($_SESSION['datestamp'])) {
             $setter[] = db_quote_id('datestamp') . "=" . db_quoteall($_SESSION['datestamp']);
         }
         if ($this->surveyOptions['ipaddr'] && isset($_SERVER['REMOTE_ADDR'])) {
             $setter[] = db_quote_id('ipaddr') . "=" . db_quoteall($_SERVER['REMOTE_ADDR']);
         }
         if ($finished) {
             $setter[] = db_quote_id('submitdate') . "=" . db_quoteall($_SESSION['datestamp']);
         }
         foreach ($updatedValues as $key => $value) {
             $val = is_null($value) ? NULL : $value['value'];
             $type = is_null($value) ? NULL : $value['type'];
             // Clean up the values to cope with database storage requirements
             switch ($type) {
                 case 'D':
                     //DATE
                     if (trim($val) == '') {
                         $val = NULL;
                         // since some databases can't store blanks in date fields
                     }
                     // otherwise will already be in yyyy-mm-dd format after ProcessCurrentResponses()
                     break;
                 case 'N':
                     //NUMERICAL QUESTION TYPE
                 //NUMERICAL QUESTION TYPE
                 case 'K':
                     //MULTIPLE NUMERICAL QUESTION
                     if (trim($val) == '') {
                         $val = NULL;
                         // since some databases can't store blanks in numerical inputs
                     }
                     break;
                 default:
                     break;
             }
             if (is_null($val)) {
                 $setter[] = db_quote_id($key) . "=NULL";
             } else {
                 $setter[] = db_quote_id($key) . "=" . db_quoteall($val);
             }
         }
         $query .= implode(', ', $setter);
         $query .= " WHERE ID=";
         if (isset($_SESSION['srid']) && $this->surveyOptions['active']) {
             $query .= $_SESSION['srid'];
             if (!db_execute_assoc($query)) {
                 echo submitfailed($connect->ErrorMsg());
                 if (($this->debugLevel & LEM_DEBUG_VALIDATION_SUMMARY) == LEM_DEBUG_VALIDATION_SUMMARY) {
                     $message .= 'Error in SQL update: ' . $connect->ErrorMsg() . '<br/>';
//.........这里部分代码省略.........

/**
 * This functions saves the answer time for question/group and whole survey.
 * [ It compares current time with the time in $_POST['start_time'] ]
 * The times are saved in table: {prefix}{surveytable}_timings
 * @return void
 */
function set_answer_time()
{
	global $connect, $thissurvey;
    if (isset($_POST['lastanswer']))
    {
        $setField = $_POST['lastanswer'];
    }
	$passedTime = round(microtime(true) - $_POST['start_time'],2);

	if(!isset($setField))
		$setField = $_POST['lastgroup'];
	if(!isset($setField)){ //we show the whole survey on one page - we don't have to save time for group/question
		if($connect->Insert_ID($thissurvey['tablename'],"id") > 0){	// means that the last operation was INSERT
			$query = "INSERT INTO ".db_quote_id($thissurvey['tablename']."_timings") ." ("
				 ."id, interviewtime)"
				 ." VALUES (" .$_SESSION['srid'] ."," .$passedTime .")";
		}else{	// UPDATE
			$query = "UPDATE {$thissurvey['tablename']}_timings SET "
				."interviewtime = interviewtime" ." + " .$passedTime
				." WHERE id = " .$_SESSION['srid'];
		}
		$connect->execute($query);
		return;
	}

	$setField .= "time";
	//saving the times
	if($connect->Insert_ID($thissurvey['tablename'],"id") > 0){	// means that the last operation was INSERT
		$query = "INSERT INTO ".db_quote_id($thissurvey['tablename']."_timings") ." ("
			 ."id, interviewtime, " .db_quote_id($setField) .")"
			 ." VALUES (" .$_SESSION['srid'] ."," .$passedTime ."," .$passedTime.")";
	}else{	// UPDATE
		$query = "UPDATE {$thissurvey['tablename']}_timings SET "
			."interviewtime = interviewtime" ." + " .$passedTime .","
			.db_quote_id($setField) ." = " .db_quote_id($setField) ." + " .$passedTime
			." WHERE id = " .$_SESSION['srid'];
	}
	$connect->execute($query);
}

/**
 * get_quotaCompletedCount() returns the number of answers matching the quota
 * @param string $surveyid - Survey identification number
 * @param string $quotaid - quota id for which you want to compute the completed field
 * @return string - number of mathing entries in the result DB or 'N/A'
 */
function get_quotaCompletedCount($surveyid, $quotaid)
{
    $result = "N/A";
    $quota_info = getQuotaInformation($surveyid, GetBaseLanguageFromSurveyID($surveyid), $quotaid);
    $quota = $quota_info[0];
    if (db_tables_exist(db_table_name_nq('survey_' . $surveyid)) && count($quota['members']) > 0) {
        $fields_list = array();
        // Keep a list of fields for easy reference
        // construct an array of value for each $quota['members']['fieldnames']
        unset($querycond);
        $fields_query = array();
        foreach ($quota['members'] as $member) {
            foreach ($member['fieldnames'] as $fieldname) {
                if (!in_array($fieldname, $fields_list)) {
                    $fields_list[] = $fieldname;
                    $fields_query[$fieldname] = array();
                }
                $fields_query[$fieldname][] = db_quote_id($fieldname) . " = '{$member['value']}'";
            }
        }
        foreach ($fields_list as $fieldname) {
            $select_query = " ( " . implode(' OR ', $fields_query[$fieldname]) . ' )';
            $querycond[] = $select_query;
        }
        $querysel = "SELECT count(id) as count FROM " . db_table_name('survey_' . $surveyid) . " WHERE " . implode(' AND ', $querycond) . " " . " AND submitdate IS NOT NULL";
        $result = db_execute_assoc($querysel) or safe_die($connect->ErrorMsg());
        //Checked
        $quota_check = $result->FetchRow();
        $result = $quota_check['count'];
    }
    return $result;
}

function refreshtemplates() {
    global $connect ;
    global $dbprefix ;

    $template_a = gettemplatelist();
	foreach ($template_a as $tp=>$fullpath) {
        // check for each folder if there is already an entry in the database
        // if not create it with current user as creator (user with rights "create user" can assign template rights)
        $query = "SELECT * FROM ".$dbprefix."templates WHERE folder LIKE '".$tp."'";
        $result = db_execute_assoc($query) or safe_die($connect->ErrorMsg()); //Checked

        if ($result->RecordCount() == 0) {
            $query2 = "INSERT INTO ".$dbprefix."templates (".db_quote_id('folder').",".db_quote_id('creator').") VALUES ('".$tp."', ".$_SESSION['loginID'].')' ;
            $connect->Execute($query2) or safe_die($connect->ErrorMsg()); //Checked
        }
    }
    return true;
}

 /**
  * Write values to database.
  * @param <type> $updatedValues
  * @param <boolean> $finished - true if the survey needs to be finalized
  */
 private function _UpdateValuesInDatabase($updatedValues, $finished = false, $setSubmitDate = false)
 {
     // Update these values in the database
     global $connect;
     //  TODO - now that using $this->updatedValues, may be able to remove local copies of it (unless needed by other sub-systems)
     $updatedValues = $this->updatedValues;
     if (!$this->surveyOptions['deletenonvalues']) {
         $nonNullValues = array();
         foreach ($updatedValues as $key => $value) {
             if (!is_null($value)) {
                 if (isset($value['value']) && !is_null($value['value'])) {
                     $nonNullValues[$key] = $value;
                 }
             }
         }
         $updatedValues = $nonNullValues;
     }
     $message = '';
     if ($this->surveyOptions['datestamp'] == true && $this->surveyOptions['anonymized'] == true) {
         // On anonymous datestamped surveys, set the datestamp to 1-1-1980
         $datestamp = date("Y-m-d H:i:s", mktime(0, 0, 0, 1, 1, 1980));
     } else {
         // Otherwise, use the real date/time, it will only be saved when the table holds a
         // datestamp field
         $datestamp = date_shift(date("Y-m-d H:i:s"), "Y-m-d H:i:s", $this->surveyOptions['timeadjust']);
     }
     $_SESSION['datestamp'] = $datestamp;
     if ($this->surveyOptions['active'] && !isset($_SESSION['srid'])) {
         // Create initial insert row for this record
         $sdata = array("datestamp" => $datestamp, "ipaddr" => $this->surveyOptions['ipaddr'] ? getIPAddress() : '', "startlanguage" => $this->surveyOptions['startlanguage'], "token" => $this->surveyOptions['token'], "refurl" => $this->surveyOptions['refurl'] ? getenv("HTTP_REFERER") : NULL, "startdate" => $datestamp);
         //One of the strengths of ADOdb's AutoExecute() is that only valid field names for $table are updated
         if ($connect->AutoExecute($this->surveyOptions['tablename'], $sdata, 'INSERT')) {
             $srid = $connect->Insert_ID($this->surveyOptions['tablename'], "id");
             $_SESSION['srid'] = $srid;
         } else {
             $message .= $this->gT("Unable to insert record into survey table: ") . $connect->ErrorMsg() . "<br/>";
             $_SESSION['flashmessage'] = $message;
             echo $message;
         }
         //Insert Row for Timings, if needed
         if ($this->surveyOptions['savetimings']) {
             $tdata = array('id' => $srid, 'interviewtime' => 0);
             if ($connect->AutoExecute($this->surveyOptions['tablename_timings'], $tdata, 'INSERT')) {
                 $trid = $connect->Insert_ID($this->surveyOptions['tablename_timings'], "sid");
             } else {
                 $message .= $this->gT("Unable to insert record into timings table ") . $connect->ErrorMsg() . "<br/>";
                 $_SESSION['flashmessage'] = $message;
                 echo $message;
             }
         }
     }
     if (count($updatedValues) > 0 || $finished) {
         $query = 'UPDATE ' . $this->surveyOptions['tablename'] . " SET ";
         $setter = array();
         switch ($this->surveyMode) {
             case 'question':
                 $thisstep = $this->currentQuestionSeq;
                 break;
             case 'group':
                 $thisstep = $this->currentGroupSeq;
                 break;
             case 'survey':
                 $thisstep = 1;
                 break;
         }
         $setter[] = db_quote_id('lastpage') . "=" . db_quoteall($thisstep);
         if ($this->surveyOptions['datestamp'] && isset($_SESSION['datestamp'])) {
             $setter[] = db_quote_id('datestamp') . "=" . db_quoteall($_SESSION['datestamp']);
         }
         if ($this->surveyOptions['ipaddr']) {
             $setter[] = db_quote_id('ipaddr') . "=" . db_quoteall(getIPAddress());
         }
         foreach ($updatedValues as $key => $value) {
             if (!empty($key)) {
                 $val = is_null($value) ? NULL : $value['value'];
                 $type = is_null($value) ? NULL : $value['type'];
                 // Clean up the values to cope with database storage requirements
                 switch ($type) {
                     case 'D':
                         //DATE
                         if (trim($val) == '') {
                             $val = NULL;
                             // since some databases can't store blanks in date fields
                         }
                         // otherwise will already be in yyyy-mm-dd format after ProcessCurrentResponses()
                         break;
                     case '|':
                         //File upload
                         // This block can be removed once we require 5.3 or later
                         if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
                             $val = addslashes($val);
                         }
                         break;
                     case 'N':
                         //NUMERICAL QUESTION TYPE
//.........这里部分代码省略.........

}
if ($sql && $sql != "NULL") {
    $query .= " AND " . auto_unescape(urldecode($sql));
}
switch (incompleteAnsFilterstate()) {
    case 'inc':
        //Inclomplete answers only
        $query .= ' AND submitdate is null ';
        break;
    case 'filter':
        //Inclomplete answers only
        $query .= ' AND submitdate is not null ';
        break;
}
if ($order == "alpha") {
    $query .= " ORDER BY " . db_quote_id($column);
} else {
    $query .= " ORDER BY id";
}
$result = db_execute_assoc($query) or safe_die("Error with query: " . $query . "<br />" . $connect->ErrorMsg());
$listcolumnoutput = "<table width='98%' class='statisticstable' border='1' cellpadding='2' cellspacing='0'>\n";
$listcolumnoutput .= "<thead><tr><th><input type='image' src='{$imageurl}/downarrow.png' align='middle' onclick=\"window.open('admin.php?action=listcolumn&amp;sid={$surveyid}&amp;column={$column}&amp;order=id', '_top')\" /></th>\n";
$listcolumnoutput .= "<th valign='top'><input type='image' align='right' src='{$imageurl}/close.gif' onclick='window.close()' />";
if ($connect->databaseType != 'odbc_mssql' && $connect->databaseType != 'odbtp' && $connect->databaseType != 'mssql_n' || $connect->databaseType == 'mssqlnative') {
    $listcolumnoutput .= "<input type='image' src='{$imageurl}/downarrow.png' align='left' onclick=\"window.open('admin.php?action=listcolumn&amp;sid={$surveyid}&amp;column={$column}&amp;order=alpha', '_top')\" />";
}
$listcolumnoutput .= "</th></tr>\n";
while ($row = $result->FetchRow()) {
    $listcolumnoutput .= "<tr><td valign='top' align='center' >" . "<a href='{$scriptname}?action=browse&amp;sid={$surveyid}&amp;subaction=id&amp;id=" . $row['id'] . "' target='home'>" . $row['id'] . "</a></td>" . "<td valign='top'>" . htmlspecialchars($row[$column]) . "</td></tr>\n";
}
$listcolumnoutput .= "</table>\n";

//.........这里部分代码省略.........
    {
        if(isset($field['qid']) && $field['qid']!='')
        $aQuestionMap[]=$field['sid'].'X'.$field['gid'].'X'.$field['qid'];
    }

    /*
     * Iterate through postvars to create "nice" data for SQL later.
     *
     * Remember there might be some filters applied which have to be put into an SQL statement
     */
    if(isset($postvars))

    foreach ($postvars as $pv)
    {
        //Only do this if there is actually a value for the $pv
        if (in_array($pv, $allfields) || in_array(substr($pv,1),$aQuestionMap) || in_array($pv,$aQuestionMap) || (($pv[0]=='D' || $pv[0]=='N' || $pv[0]=='K') && in_array(substr($pv,1,strlen($pv)-2),$aQuestionMap)))
        {
            $firstletter=substr($pv,0,1);
            /*
             * these question types WON'T be handled here:
             * M = Multiple choice
             * T - Long Free Text
             * Q - Multiple Short Text
             * D - Date
             * N - Numerical Input
             * | - File Upload
             * K - Multiple Numerical Input
             */
            if ($pv != "sid" && $pv != "display" && $firstletter != "M" && $firstletter != "P" && $firstletter != "T" &&
            $firstletter != "Q" && $firstletter != "D" && $firstletter != "N" && $firstletter != "K" && $firstletter != "|" &&
            $pv != "summary" && substr($pv, 0, 2) != "id" && substr($pv, 0, 9) != "datestamp") //pull out just the fieldnames
            {
                //put together some SQL here
                $thisquestion = db_quote_id($pv)." IN (";

                foreach ($_POST[$pv] as $condition)
                {
                    $thisquestion .= "'$condition', ";
                }

                $thisquestion = substr($thisquestion, 0, -2)
                . ")";

                //we collect all the to be selected data in this array
                $selects[]=$thisquestion;
            }

            //M - Multiple choice
            //P - Multiple choice with comments
            elseif ($firstletter == "M"  || $firstletter == "P")
            {
                $mselects=array();
                //create a list out of the $pv array
                list($lsid, $lgid, $lqid) = explode("X", $pv);

                $aquery="SELECT title FROM ".db_table_name("questions")." WHERE parent_qid=$lqid AND language='{$language}' and scale_id=0 ORDER BY question_order";
                $aresult=db_execute_num($aquery) or safe_die ("Couldn't get subquestions<br />$aquery<br />".$connect->ErrorMsg());

                // go through every possible answer
                while ($arow=$aresult->FetchRow())
                {
                    // only add condition if answer has been chosen
                    if (in_array($arow[0], $_POST[$pv]))
                    {
                        $mselects[]=db_quote_id(substr($pv, 1, strlen($pv)).$arow[0])." = 'Y'";
                    }