PHP db_real_escape_string函数代码示例

 public static function login($name, $email, $user)
 {
     if (!$name || !$user) {
         throw new Exception('Wypełnij wszystkie pola.');
     }
     $user = new ChatUser(array('name' => $name, 'gravatar' => $user));
     include_once "../db_connect.php";
     include_once "../include/ust.php";
     $Querys = 'SELECT * FROM ' . $pre . 'user WHERE user_id=' . $_SESSION['user_id'] . '';
     $results = db_query($Querys) or die(db_error());
     while ($rows = db_fetch($results)) {
         $ile_pkt = $rows['user_money'];
         if ($rows['user_vip'] >= time()) {
             $czy_vp = 1;
         }
         $user_chat = $rows['user_chat'];
     }
     if ($user_chat == 1) {
         throw new Exception('Masz zablokowany dostęp do czatu.');
     }
     if ($czy_vp != 1) {
         if ($ile_pkt > $ust['chatp']) {
             $up = "UPDATE " . $pre . "user SET user_money=user_money-" . $ust['chatp'] . " WHERE user_id='" . db_real_escape_string($_SESSION['user_id']) . "'";
             db_query($up);
         } else {
             throw new Exception('Masz zamało punktów by dołączyć do czatu.');
         }
     }
     // The save method returns a MySQLi object
     if ($user->save()->affected_rows != 1) {
         throw new Exception('Nick jest zajęty.');
     }
     $_SESSION['user'] = array('name' => $name, 'gravatar' => $user);
     return array('status' => 1, 'name' => $name, 'gravatar' => $user);
 }

function user_apikey_session_control($apikey_in)
{
    //----------------------------------------------------
    // Check for apikey login
    //----------------------------------------------------
    $apikey_in = db_real_escape_string($apikey_in);
    $userid = get_apikey_read_user($apikey_in);
    if ($userid != 0) {
        session_regenerate_id();
        $session['userid'] = $userid;
        $session['read'] = 1;
        $session['write'] = 0;
        $session['admin'] = 0;
        //   $session['lang'] = "en";
    }
    $userid = get_apikey_write_user($apikey_in);
    if ($userid != 0) {
        session_regenerate_id();
        $session['userid'] = $userid;
        $session['read'] = 1;
        $session['write'] = 1;
        $session['admin'] = 0;
        // $session['lang'] = "en";
    }
    //----------------------------------------------------
    return $session;
}

function confirm_controller()
{
    $message = preg_replace('/[^\\w\\s-.<>?:]/', '', $_POST['message']);
    // filter out all except for alphanumeric white space and dash
    $message = db_real_escape_string($message);
    $id = intval($_POST['id']);
    $action = preg_replace('/[^.\\/a-z]/', '', $_POST['action']);
    // filter out all except a-z / .
    $action = db_real_escape_string($action);
    $content['content'] = view("confirm_view.php", array('message' => $message, 'id' => $id, 'action' => $action));
    return $content;
}

function api_controller()
{
    global $session, $action;
    require "Models/input_model.php";
    require "Models/feed_model.php";
    require "Models/process_model.php";
    // POST arduino posts up to emoncms
    if ($action == 'post' && $session['write']) {
        $node = intval($_GET['node']);
        $json = db_real_escape_string($_GET['json']);
        $csv = db_real_escape_string($_GET['csv']);
    }
    if ($csv) {
        $values = explode(',', $csv);
        $i = 0;
        foreach ($values as $value) {
            $i++;
            if ($node) {
                $key = $i;
            } else {
                $key = "csv" . $i;
            }
            $datapairs[] = $key . ":" . $value;
        }
    }
    if ($json) {
        // preg_replace strips out everything appart from alphanumeric characters, whitespace and -.:,
        $json = preg_replace('/[^\\w\\s-.:,]/', '', $json);
        $datapairs = explode(',', $json);
    }
    if ($json || $csv) {
        $time = time();
        // get the time - data recived time
        if (isset($_GET["time"])) {
            $time = intval($_GET["time"]);
            // - or use sent timestamp if present
        }
        $inputs = register_inputs($session['userid'], $node, $datapairs, $time);
        // register inputs
        process_inputs($session['userid'], $inputs, $time);
        // process inputs to feeds etc
        $output['message'] = "ok";
    }
    return $output;
}

function node_controller()
{
    require "Modules/node/node_model.php";
    global $session, $route;
    $output['content'] = "";
    $output['message'] = "";
    if ($route['action'] == 'create' && $session['write']) {
        $nodeid = create_node($session['userid'], "(new)", "");
        $output['message'] = "Node created";
    }
    if ($route['action'] == 'list' && $session['read']) {
        $list = get_node_list($session['userid']);
        $output['content'] = view('node/node_list.php', array('list' => $list));
    }
    if ($route['action'] == 'edit' && $session['write']) {
        $nodeid = intval($_GET['id']);
        $title = get_node_title($nodeid);
        $content = get_node_content($nodeid);
        $output['content'] = view('node/node_edit.php', array('id' => $nodeid, 'title' => $title, 'content' => $content));
    }
    if ($route['action'] == 'save' && $session['write']) {
        $nodeid = intval($_POST['id']);
        $title = $_POST['title'];
        $content = $_POST['content'];
        $content = db_real_escape_string($content);
        set_node_title($nodeid, $title);
        set_node_content($nodeid, $content);
        $output['message'] = "Node saved";
    }
    if ($route['action'] == 'view') {
        $nodeid = intval($_GET['id']);
        $title = get_node_title($nodeid);
        $content = get_node_content($nodeid);
        include_once "Modules/node/markdown/markdown.php";
        $content = Markdown($content);
        $output['content'] = view('node/node_view.php', array('title' => $title, 'content' => $content));
    }
    if ($route['action'] == 'delete' && $session['write']) {
        $nodeid = intval($_GET['id']);
        delete_node($nodeid);
        $output['message'] = "Node deleted";
    }
    return $output;
}

<?php

include "subheader.php";
$ilepw = 0;
$Query = 'SELECT * FROM ' . $pre . 'friend WHERE fo_do="' . db_real_escape_string($_SESSION['user_id']) . '" order by fo_id DESC';
$result = db_query($Query) or die(db_error());
while ($row = db_fetch($result)) {
    $Query1 = 'SELECT * FROM ' . $pre . 'user WHERE user_id="' . db_real_escape_string($row['fo_od']) . '"';
    $result1 = db_query($Query1) or die(db_error());
    while ($row1 = db_fetch($result1)) {
        $user_login[] = $row1['user_login'];
        $user_loginn[] = namen($row1['user_login']);
    }
    $pw_id[] = $row['fo_id'];
    $pw_od[] = $row['fo_od'];
    $pw_czyt[] = $row['fo_akt'];
    $pw_tresc[] = $row['fo_tresc'];
    $pw_data[] = $row['fo_data'];
    $ilepw++;
}
$smarty->assign("od_login", $user_login);
$smarty->assign("od_loginn", $user_loginn);
$smarty->assign("pw_id", $pw_id);
$smarty->assign("temat", $pw_temat);
$smarty->assign("od", $pw_od);
$smarty->assign("pw_tresc", $pw_tresc);
$smarty->assign("czyt", $pw_czyt);
$smarty->assign("data", $pw_data);
$smarty->assign("ilepw", $ilepw);
if ($_GET['v'] == "wyslano") {
    $smarty->assign("wyslano", "ok");

//.........这里部分代码省略.........
        //{
        $apikey = get_apikey_read($session['userid']);
        $output['content'] = view("dashboard/dashboard_view.php", array('dashboard' => $dashboard, "apikey_read" => $apikey));
        // If run mode avoid include dashboard configuration (this makes dashboard page lighter)
        if ($action != "run") {
            $output['content'] .= view("dashboard/dashboard_config.php", array('dashboard' => $dashboard));
        }
        //}
        //else
        //{
        //  $output['content'] = view("dashboard_run_errornomain.php",array());
        //}
    } elseif ($action == 'edit' && $session['write']) {
        $id = intval($_GET['id']);
        $alias = preg_replace('/[^a-z]/', '', $subaction);
        if ($id) {
            // If a dashboard id is given we get the coresponding dashboard
            $dashboard = get_dashboard_id($session['userid'], $id, 0, 0);
        } elseif ($alias) {
            $dashboard = get_dashboard_alias($session['userid'], $alias, 0, 0);
        } else {
            // Otherwise we get the main dashboard
            $dashboard = get_main_dashboard($session['userid']);
        }
        $apikey = get_apikey_read($session['userid']);
        $menu = build_dashboard_menu($session['userid'], "edit");
        $output['content'] = view("dashboard/dashboard_edit_view.php", array('dashboard' => $dashboard, "apikey_read" => $apikey));
        $output['content'] .= view("dashboard/dashboard_config.php", array('dashboard' => $dashboard));
        $output['submenu'] = view("dashboard/dashboard_menu.php", array('id' => $dashboard['id'], 'menu' => $menu, 'type' => "edit"));
    } elseif ($action == 'ckeditor' && $session['write']) {
        $id = intval($_GET['id']);
        $alias = preg_replace('/[^a-z]/', '', $subaction);
        if ($id) {
            // If a dashboard id is given we get the coresponding dashboard
            $dashboard = get_dashboard_id($session['userid'], $id, 0, 0);
        } elseif ($alias) {
            $dashboard = get_dashboard_alias($session['userid'], $alias, 0, 0);
        } else {
            // Otherwise we get the main dashboard
            $dashboard = get_main_dashboard($session['userid']);
        }
        $menu = build_dashboard_menu($session['userid'], "ckeditor");
        $output['content'] = view("dashboard/dashboard_ckeditor_view.php", array('dashboard' => $dashboard, 'menu' => $menu));
        $output['submenu'] = view("dashboard/dashboard_menu.php", array('id' => $dashboard['id'], 'menu' => $menu, 'type' => "ckeditor"));
    }
    //----------------------------------------------------------------------------------------------------------------------
    // SET dashboard
    // dashboard/set?content=<h2>HelloWorld</h2>
    //----------------------------------------------------------------------------------------------------------------------
    if ($action == 'set' && $session['write']) {
        $content = $_POST['content'];
        if (!$content) {
            $content = $_GET['content'];
        }
        $id = intval($_POST['id']);
        if (!$id) {
            $id = intval($_GET['id']);
        }
        // IMPORTANT: if you get problems with characters being removed check this line:
        $content = preg_replace('/[^\\w\\s-.#<>?",;:=&\\/%]/', '', $content);
        // filter out all except characters usually used
        $content = db_real_escape_string($content);
        set_dashboard_content($session['userid'], $content, $id);
        if ($format == 'html') {
            $output['message'] = _("dashboard set");
        } else {
            $output['message'] = "ok";
        }
    } elseif ($action == 'setconf' && $session['write']) {
        $id = intval($_POST['id']);
        $name = preg_replace('/[^\\w\\s-]/', '', $_POST['name']);
        $alias = preg_replace('/[^a-z]/', '', $_POST['alias']);
        $description = preg_replace('/[^\\w\\s-]/', '', $_POST['description']);
        // Separated functions to allow set values in independent way
        if (isset($_POST['main'])) {
            set_dashboard_main($session['userid'], $id, intval($_POST['main']));
        }
        if (isset($_POST['published'])) {
            set_dashboard_publish($session['userid'], $id, intval($_POST['published']));
        }
        if (isset($_POST['public'])) {
            set_dashboard_public($session['userid'], $id, intval($_POST['public']));
        }
        if (isset($_POST['name'])) {
            set_dashboard_name($session['userid'], $id, $name);
        }
        if (isset($_POST['alias'])) {
            set_dashboard_alias($session['userid'], $id, $alias);
        }
        if (isset($_POST['description'])) {
            set_dashboard_description($session['userid'], $id, $description);
        }
        if (isset($_POST['showdescription'])) {
            set_dashboard_showdescription($session['userid'], $id, intval($_POST['showdescription']));
        }
        //set_dashboard_conf($session['userid'],$id,$name,$alias,$description,$main,$public,$published);
        $output['message'] = _("dashboard set configuration");
    }
    return $output;
}

<?php

session_start();
include '../db_connect.php';
if ($_SESSION['logadm'] == "adm") {
    if ($_POST['nazwa'] != "") {
        $up = "UPDATE " . $pre . "faq SET faq_nazwa='" . $_POST['nazwa'] . "', faq_tresc='" . $_POST['tresc'] . "' WHERE faq_id='" . db_real_escape_string($_GET['id']) . "'";
        db_query($up);
    } else {
        header('Location: index.php?page=faq&action=&e=t');
        exit;
    }
}
header('Location: index.php?page=faq&action=&e=2');

            $smarty->assign("vipendd", $rows['user_vip']);
            $smarty->assign("vipend", date("Y.m.d", $rows['user_vip']));
        } else {
            $smarty->assign("vipend", "0");
        }
    }
    $smarty->assign("get_user_prezenty", get_user_prezenty($_SESSION['user_id']));
}
//------
if ($_GET['v'] == "delete-zaproszenie") {
    $del = "DELETE FROM " . $pre . "friend WHERE fo_id='" . db_real_escape_string($_GET['id']) . "' and fo_do='" . $_SESSION['user_id'] . "' ";
    db_query($del);
    $smarty->assign("del-zaproszenie", "ok");
}
if ($_GET['v'] == "zatwierdz") {
    $del = "UPDATE " . $pre . "friend SET fo_akt=1 WHERE fo_id='" . db_real_escape_string($_GET['id']) . "' and fo_do='" . $_SESSION['user_id'] . "' ";
    db_query($del);
}
//------
if ($_GET['enter'] == "ok") {
    $_SESSION['user_18'] = "ok";
}
if ($ust['kos'] == "1" and $_SESSION['user_18'] != "ok") {
    $smarty->display($ust['templates'] . '/page_18.tpl');
    exit;
}
$topads = array();
$bottom1ads = array();
$bottom2ads = array();
$bottom3ads = array();
//$bottom4ads = array();

<?php

session_start();
include 'db_connect.php';
include 'include/function.php';
include 'include/ust.php';
if ($_COOKIE['lang'] != "" and isset($_COOKIE['lang']) and strlen($_COOKIE['lang']) <= 3) {
    $u_usr['lang'] = substr($_COOKIE['lang'], 0, 3);
} else {
    $u_usr['lang'] = $ust['lang_d'];
}
include "lang/" . $u_usr['lang'] . "/site.php";
if ($_GET['p'] == "v") {
    $Query = 'SELECT * FROM ' . $pre . 'dni WHERE dni_id="' . db_real_escape_string($_GET['id']) . '" ORDER by dni_dni ASC';
    $result = db_query($Query) or die(db_error());
    while ($row = db_fetch($result)) {
        $p_dni = $row['dni_dni'];
        $p_pkt = $row['dni_pkt'];
        $p_cpkt = $row['dni_cpkt'];
        $p_dniid = $row['dni_id'];
        $p_dnicena = $row['dni_cena'];
        $p_dnicenasms = $row['dni_cenasms'];
        $p_dninumer = $row['dni_numer'];
        $p_dnikod = $row['dni_kod'];
        $p_dnitresc = $row['dni_tresc'];
        $p_dnismspkt = $row['dni_sms_pkt'];
        $p_dnipaykod = $row['dni_pay_kod'];
        $p_dnipaypkt = $row['dni_pay_pkt'];
    }
    $in = "INSERT INTO " . $pre . "zamowienia(`za_pakiet`,`za_user`,`za_data`,`za_cena`,`za_punkty`)VALUES('pay','" . $_SESSION['user_id'] . "',NOW(),'" . $p_dnicena . "','" . $p_dniid . "')";
    db_query($in);

                    db_query($up);
                }
                header("Location: /user/moje-filmy/5");
                exit;
            } else {
                $msg = "Sorry, there was an error uploading your file.";
            }
            header("Location: /user/moje-filmy/15");
            exit;
        }
    } else {
        header("Location: /user/moje-filmy/19");
        exit;
    }
}
$Query = 'SELECT * FROM ' . $pre . 'mov WHERE fo_user="' . db_real_escape_string($_SESSION['user_id']) . '" order by fo_id DESC';
$result = db_query($Query) or die(db_error());
while ($row = db_fetch($result)) {
    $fo_id[] = $row['fo_id'];
    $fo_fd[] = $row['fo_fd'];
    $fo_opis[] = $row['fo_opis'];
    $fo_prv[] = $row['fo_prv'];
    $fo_custom_file[] = $row['fo_custom_file'];
    $fo_cena[] = $row['fo_cena'];
    $fo_user[] = $row['fo_user'];
    if ($row['fo_custom_file'] == 1) {
        $fo_fm[] = $row['fo_fm'];
    } else {
        $fo_fm[] = get_you($row['fo_fm']);
    }
    $fo_thumb[] = $row['fo_thumb'];

 } else {
     $e_plec = 0;
 }
 if ($_POST['y'] == "" or $_POST['m'] == "" or $_POST['d'] == "") {
     $smarty->assign("e_wiek", "1");
     $e_wiek = 1;
 } else {
     $e_wiek = 0;
 }
 if ($_POST['regulamin'] == "") {
     $smarty->assign("reg", "1");
     $reg = 1;
 } else {
     $reg = 0;
 }
 $ile_email = db_num_rows(db_query("SELECT user_email FROM " . $pre . "user WHERE user_email='" . db_real_escape_string($_POST['email']) . "'"));
 if ($ile_email >= 1) {
     $smarty->assign("ei", "1");
     $ei = 1;
 } else {
     $ei = 0;
 }
 if (!spremail($_POST['email'])) {
     $smarty->assign("e", "1");
     $e = 1;
 } else {
     $e = 0;
 }
 $resp = recaptcha_check_answer($privatekey, $_SERVER["REMOTE_ADDR"], $_POST["recaptcha_challenge_field"], $_POST["recaptcha_response_field"]);
 if ($ust['token_r'] == 1) {
     if (!$resp->is_valid) {

<?php

session_start();
include "../db_connect.php";
include "../include/function.php";
if ($_SESSION['user_id'] >= 1) {
    $del = "DELETE FROM " . $pre . "czlonkowie WHERE c_id='" . db_real_escape_string($_GET['id']) . "'";
    db_query($del);
}
header("Location: " . $_SERVER['HTTP_REFERER'] . "");

<?php

include "subheader.php";
if ($_GET['del'] >= 1) {
    $del = "DELETE FROM " . $pre . "imprezy WHERE i_id=" . db_real_escape_string($_GET['del']) . " and i_user=" . $_SESSION['user_id'] . "";
    db_query($del);
    $smarty->assign("delc", "1");
}
$Query = 'SELECT * FROM ' . $pre . 'imprezy WHERE i_user="' . db_real_escape_string($_SESSION['user_id']) . '"';
$result = db_query($Query) or die(db_error());
while ($row = db_fetch($result)) {
    $i_id[] = $row['i_id'];
    $i_d[] = $row['i_d'];
    $i_m[] = $row['i_m'];
    $i_y[] = $row['i_y'];
    $i_h[] = $row['i_h'];
    $i_mi[] = $row['i_mi'];
    $i_nazwa[] = $row['i_nazwa'];
    $i_opis[] = $row['i_opis'];
}
$smarty->assign("i_id", $i_id);
$smarty->assign("i_d", $i_d);
$smarty->assign("i_m", $i_m);
$smarty->assign("i_y", $i_y);
$smarty->assign("i_h", $i_h);
$smarty->assign("i_mi", $i_mi);
$smarty->assign("i_nazwa", $i_nazwa);
$smarty->assign("i_opis", $i_opis);
$smarty->assign("stan", $_GET['stan']);
$smarty->assign("title", $lang['464'] . ' - ' . $ust['nazwa']);
$smarty->display($ust['templates'] . '/panel-imprezy.tpl');

<?php

session_start();
include '../db_connect.php';
if ($_SESSION['logadm'] == "adm") {
    $uid = $_POST['uid'];
    $up = "UPDATE " . $pre . "user SET user_money='" . $_POST['punkty'] . "', user_vip='" . strtotime($_POST['vip']) . "' WHERE user_id='" . db_real_escape_string($uid) . "'";
    db_query($up);
    header('Location: index.php?page=user&action=view&id=' . $uid . '&e=1');
    exit;
}
header('Location: index.php?page=cat&action=&e=2');