PHP full_sanitize函数代码示例

function viewcommentaryargs_dohook($hook, $args)
{
    global $currentCommentaryArea;
    switch ($hook) {
        case 'blockcommentarea':
            $currentCommentaryArea = $args['section'];
            break;
        case 'viewcommentary':
            $accounts = db_prefix('accounts');
            $commentary = db_prefix('commentary');
            preg_match("/bio.php\\?char=(.*)&ret/", $args['commentline'], $matches);
            $acctid = filter_var($matches[1], FILTER_SANITIZE_NUMBER_INT);
            $sql = db_query_cached("SELECT login, name FROM {$accounts} WHERE acctid = {$acctid}", "commentary-author_name-{$acctid}", 86400);
            $row = db_fetch_assoc($sql);
            $name = $row['name'];
            $login = $row['login'];
            $temp = explode($row['name'], $args['commentline']);
            $temp = str_replace('`3 says, "`#', '', $temp[1]);
            $temp = str_replace('`3"', '', $temp);
            $temp = str_replace('/me', '', $temp);
            $temp = str_replace(':', '', $temp);
            $temp = str_replace('</a>', '', $temp);
            $temp = full_sanitize($temp);
            $temp = addslashes(implode('%', str_split(trim($temp))));
            $sql = db_query("SELECT commentid, comment, postdate FROM {$commentary}\n                WHERE comment LIKE '%{$temp}%'\n                AND section = '{$currentCommentaryArea}'");
            $row = db_fetch_assoc($sql);
            $args = ['commentline' => $args['commentline'], 'section' => $currentCommentaryArea, 'commentid' => $row['commentid'], 'comment' => $row['comment'], 'author_acctid' => $acctid, 'author_login' => $login, 'author_name' => $name, 'date' => $row['postdate']];
            unset($row);
            unset($temp);
            break;
    }
    return $args;
}

function mysticalshop_run()
{
    global $session;
    $shop = get_module_setting('shopname');
    $op = httpget('op');
    $from = 'runmodule.php?module=mysticalshop&';
    page_header(full_sanitize($shop));
    $what = httpget('what');
    $cat = httpget('cat');
    if (!is_numeric($cat)) {
        $cat = 0;
    }
    $names = translate_inline(array(0 => 'Rings', 1 => 'Amulets', 2 => 'Weapons', 3 => 'Armor', 4 => 'Cloaks', 5 => 'Helmets', 6 => 'Gloves', 7 => 'Boots', 8 => 'Miscellanea'));
    require_once "./modules/mysticalshop/run/case_{$op}.php";
    page_footer();
}

function textme_sendmail($post = [], $from = 'LotGD Staff')
{
    $accounts = db_prefix('accounts');
    $post['to'] = filter_var($post['to'], FILTER_SANITIZE_STRING);
    $post['body'] = trim(explode("---Original", $post['body'])[0]);
    $body = "From {$from}: \n{$post['body']}";
    $sql = db_query("SELECT acctid FROM {$accounts} WHERE login = '{$post['to']}'");
    $row = db_fetch_assoc($sql);
    $prefs = get_all_module_prefs('textme', $row['acctid']);
    foreach ($prefs as $key => $val) {
        $prefs[$key] = trim($val);
    }
    if ($prefs['user_number'] != '' && $prefs['user_carrier'] != 'none') {
        require_once 'lib/sanitize.php';
        $checkSent = mail("{$prefs['user_number']}@{$prefs['user_carrier']}", '', stripslashes(full_sanitize($body)), "From: textme@{$_SERVER['HTTP_HOST']}");
        if (!$checkSent) {
            debuglog("failed to send a message to {$post['to']} ({$prefs['user_number']}@{$prefs['user_carrier']})");
        }
    }
}

if (db_num_rows($result) > 0) {
    output("`7You ask %s`7 for the clan listings.  She points you toward a marquee board near the entrance of the lobby that lists the clans.`0`n`n", $registrar);
    $v = 0;
    $memb_n = translate_inline("(%s members)");
    $memb_1 = translate_inline("(%s member)");
    rawoutput('<table cellspacing="0" cellpadding="2" align="left">');
    while ($row = db_fetch_assoc($result)) {
        if ($row['c'] == 0) {
            $sql = "DELETE FROM " . db_prefix("clans") . " WHERE clanid={$row['clanid']}";
            db_query($sql);
        } else {
            rawoutput('<tr class="' . ($v % 2 ? "trlight" : "trdark") . '"><td>', true);
            if ($row['c'] == 1) {
                $memb = sprintf($memb_1, $row['c']);
            } else {
                $memb = sprintf($memb_n, $row['c']);
            }
            output_notl("&#149; &#60;%s&#62; <a href='clan.php?detail=%s'>%s</a> %s`n", $row['clanshort'], $row['clanid'], full_sanitize(htmlentities($row['clanname']), ENT_COMPAT, getsetting("charset", "ISO-8859-1")), $memb, true);
            rawoutput('</td></tr>');
            addnav("", "clan.php?detail={$row['clanid']}");
            $v++;
        }
    }
    rawoutput("</table>", true);
    addnav("Return to the Lobby", "clan.php");
} else {
    output("`7You ask %s`7 for the clan listings.  She stares at you blankly for a few moments, then says, \"`5Sorry pal, no one has had enough gumption to start up a clan yet.  Maybe that should be you, eh?`7\"", $registrar);
    addnav("Apply for a New Clan", "clan.php?op=new");
    addnav("Return to the Lobby", "clan.php");
}
page_footer();

function extbio_run()
{
    $char = httpget('char');
    //Legacy support
    if (is_numeric($char)) {
        $where = "acctid = {$char}";
    } else {
        $where = "login = '{$char}'";
    }
    $sql = "SELECT login, name, level, sex, title, specialty, hashorse, acctid, resurrections, bio, dragonkills, race, clanname, clanshort, clanrank, " . db_prefix("accounts") . ".clanid, laston, loggedin FROM " . db_prefix("accounts") . " LEFT JOIN " . db_prefix("clans") . " ON " . db_prefix("accounts") . ".clanid = " . db_prefix("clans") . ".clanid WHERE {$where}";
    $result = db_query($sql);
    if ($target = db_fetch_assoc($result)) {
        $target['login'] = rawurlencode($target['login']);
        $id = $target['acctid'];
        $target['return_link'] = $return;
        page_header("Character Biography: %s", full_sanitize($target['name']));
        modulehook("biotop", $target);
        output("`^Biography for %s`^.", $target['name']);
        if ($target['clanname'] > "" && getsetting("allowclans", false)) {
            $ranks = array(CLAN_APPLICANT => "`!Applicant`0", CLAN_MEMBER => "`3Member`0", CLAN_OFFICER => "`^Officer`0", CLAN_LEADER => "`&Leader`0", CLAN_FOUNDER => "`\$Founder");
            $ranks = modulehook("clanranks", array("ranks" => $ranks, "clanid" => $target['clanid']));
            tlschema("clans");
            //just to be in the right schema
            array_push($ranks['ranks'], "`\$Founder");
            $ranks = translate_inline($ranks['ranks']);
            tlschema();
            output("`@%s`2 is a %s`2 to `%%s`2`n", $target['name'], $ranks[$target['clanrank']], $target['clanname']);
        }
        output("`^Title: `@%s`n", $target['title']);
        output("`^Level: `@%s`n", $target['level']);
        $loggedin = false;
        if ($target['loggedin'] && date("U") - strtotime($target['laston']) < getsetting("LOGINTIMEOUT", 900)) {
            $loggedin = true;
        }
        $status = translate_inline($loggedin ? "`3Online`0" : "`\$Offline`0");
        output("`^Status: %s`n", $status);
        output("`^Resurrections: `@%s`n", $target['resurrections']);
        $race = $target['race'];
        if (!$race) {
            $race = RACE_UNKNOWN;
        }
        tlschema("race");
        $race = translate_inline($race);
        tlschema();
        output("`^Race: `@%s`n", $race);
        $genders = array("Male", "Female");
        $genders = translate_inline($genders);
        output("`^Gender: `@%s`n", $genders[$target['sex']]);
        $specialties = modulehook("specialtynames", array("" => translate_inline("Unspecified")));
        if (isset($specialties[$target['specialty']])) {
            output("`^Specialty: `@%s`n", $specialties[$target['specialty']]);
        }
        $sql = "SELECT * FROM " . db_prefix("mounts") . " WHERE mountid='{$target['hashorse']}'";
        $result = db_query_cached($sql, "mountdata-{$target['hashorse']}", 3600);
        $mount = db_fetch_assoc($result);
        $mount['acctid'] = $target['acctid'];
        $mount = modulehook("bio-mount", $mount);
        $none = translate_inline("`iNone`i");
        if (!isset($mount['mountname']) || $mount['mountname'] == "") {
            $mount['mountname'] = $none;
        }
        output("`^Creature: `@%s`0`n", $mount['mountname']);
        modulehook("biostat", $target);
        if ($target['dragonkills'] > 0) {
            output("`^Dragon Kills: `@%s`n", $target['dragonkills']);
        }
        if ($target['bio'] > "") {
            output("`^Bio: `@`n%s`n", soap($target['bio']));
        }
        modulehook("bioinfo", $target);
        output("`n`^Recent accomplishments (and defeats) of %s`^", $target['name']);
        $result = db_query("SELECT * FROM " . db_prefix("news") . " WHERE accountid={$target['acctid']} ORDER BY newsdate DESC,newsid ASC LIMIT 100");
        $odate = "";
        tlschema("news");
        while ($row = db_fetch_assoc($result)) {
            tlschema($row['tlschema']);
            if ($row['arguments'] > "") {
                $arguments = array();
                $base_arguments = unserialize($row['arguments']);
                array_push($arguments, $row['newstext']);
                while (list($key, $val) = each($base_arguments)) {
                    array_push($arguments, $val);
                }
                $news = call_user_func_array("sprintf_translate", $arguments);
                rawoutput(tlbutton_clear());
            } else {
                $news = translate_inline($row['newstext']);
                rawoutput(tlbutton_clear());
            }
            tlschema();
            if ($odate != $row['newsdate']) {
                output_notl("`n`b`@%s`0`b`n", date("D, M d", strtotime($row['newsdate'])));
                $odate = $row['newsdate'];
            }
            output_notl("`@{$news}`0`n");
        }
        tlschema();
        modulehook("bioend", $target);
    }
    page_footer();
//.........这里部分代码省略.........

//.........这里部分代码省略.........
        $commentids[$i] = $row['commentid'];
        if (date("Y-m-d", strtotime($row['postdate'])) == date("Y-m-d")) {
            if ($row['name'] == $session['user']['name']) {
                $counttoday++;
            }
        }
        $x = 0;
        $ft = "";
        for ($x = 0; strlen($ft) < 5 && $x < strlen($row['comment']); $x++) {
            if (substr($row['comment'], $x, 1) == "`" && strlen($ft) == 0) {
                $x++;
            } else {
                $ft .= substr($row['comment'], $x, 1);
            }
        }
        $location = get_module_pref("location", "ajaxcommentary");
        if ($location) {
            $link = "bio.php?char=" . $row['author'] . "&ret=" . $location;
            addnav("", $link);
        } else {
            $link = '';
        }
        if (substr($ft, 0, 2) == "::") {
            $ft = substr($ft, 0, 2);
        } elseif (substr($ft, 0, 1) == ":") {
            $ft = substr($ft, 0, 1);
        } elseif (substr($ft, 0, 3) == "/me") {
            $ft = substr($ft, 0, 3);
        }
        $row['comment'] = holidayize($row['comment'], 'comment');
        $row['name'] = holidayize($row['name'], 'comment');
        $clanrankcolors = array(CLAN_APPLICANT => "`!", CLAN_MEMBER => "`#", CLAN_OFFICER => "`^", CLAN_LEADER => "`&", CLAN_FOUNDER => "`\$");
        if ($row['clanrank']) {
            $row['name'] = ($row['clanshort'] ? "{$clanrankcolors[$row['clanrank']]}&lt;`2{$row['clanshort']}{$clanrankcolors[$row['clanrank']]}&gt; `&" : "") . $row['name'];
        }
        if ($ft == "::" || $ft == "/me" || $ft == ":") {
            $x = strpos($row['comment'], $ft);
            if ($x !== false) {
                $op[$i] = str_replace("&amp;", "&", HTMLEntities(substr($row['comment'], 0, $x), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0" . ($link ? "<a href='{$link}' style='text-decoration: none'>\n" : "") . "`&{$row['name']}`0" . ($link ? "</a>" : "") . "\n`& " . str_replace("&amp;", "&", HTMLEntities(substr($row['comment'], $x + strlen($ft)), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0`n";
                $rawc[$i] = str_replace("&amp;", "&", HTMLEntities(substr($row['comment'], 0, $x), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0`&{$row['name']}`0`& " . str_replace("&amp;", "&", HTMLEntities(substr($row['comment'], $x + strlen($ft)), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0`n";
            }
        }
        if ($ft == "/game" && !$row['name']) {
            $x = strpos($row['comment'], $ft);
            //if ($x!==false){
            $op[$i] = str_replace("&amp;", "&", htmlentities(substr($row['comment'], 0, $x), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0`&" . str_replace("&amp;", "&", htmlentities(substr($row['comment'], $x + strlen($ft)), ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`0`n";
            //}
        }
        if (!isset($op) || !is_array($op)) {
            $op = array();
        }
        if (!array_key_exists($i, $op) || $op[$i] == "") {
            $op[$i] = "`0" . ($link ? "<a href='{$link}' style='text-decoration: none'>\n" : "") . "`&{$row['name']}`0" . ($link ? "</a>" : "") . "`3 says, \"`#" . str_replace("&amp;", "&", HTMLEntities($row['comment'], ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`3\"`0`n";
            $rawc[$i] = "`&{$row['name']}`3 says, \"`#" . str_replace("&amp;", "&", HTMLEntities($row['comment'], ENT_COMPAT, getsetting("charset", "ISO-8859-1"))) . "`3\"`0`n";
        }
        if (!array_key_exists('timestamp', $session['user']['prefs'])) {
            $session['user']['prefs']['timestamp'] = 0;
        }
        if ($session['user']['prefs']['timestamp'] == 1) {
            if (!isset($session['user']['prefs']['timeformat'])) {
                $session['user']['prefs']['timeformat'] = "[m/d h:ia]";
            }
            $time = strtotime($row['postdate']) + $session['user']['prefs']['timeoffset'] * 60 * 60;
            $s = "`7" . date($session['user']['prefs']['timeformat'], $time) . "`0 ";
            $op[$i] = $s . $op[$i];
        } elseif ($session['user']['prefs']['timestamp'] == 2) {
            $s = reltime(strtotime($row['postdate']));
            $op[$i] = "`7({$s})`0 " . $op[$i];
        }
        if ($row['postdate'] >= $session['user']['recentcomments']) {
            $op[$i] = "<img src='images/new.gif' alt='&gt;' width='3' height='5' align='absmiddle'> " . $op[$i];
        }
        $auth[$i] = $row['author'];
        $rawc[$i] = full_sanitize($rawc[$i]);
        $rawc[$i] = htmlentities($rawc[$i], ENT_QUOTES, getsetting("charset", "ISO-8859-1"));
    }
    $outputcomments = array();
    $sect = "x";
    for (; $i > -1; $i--) {
        $out = "";
        $out .= $op[$i];
        if (!array_key_exists($sect, $outputcomments) || !is_array($outputcomments[$sect])) {
            $outputcomments[$sect] = array();
        }
        array_push($outputcomments[$sect], $out);
    }
    ksort($outputcomments);
    reset($outputcomments);
    $sections = commentarylocs();
    while (list($sec, $v) = each($outputcomments)) {
        reset($v);
        while (list($key, $val) = each($v)) {
            $args = array('commentline' => $val);
            $args = modulehook("viewcommentary", $args);
            $val = $args['commentline'];
            output_notl($val, true);
        }
    }
    return $lastcommentid;
}

        output("Transfer how much: ");
        rawoutput("<input name='amount' id='amount' width='5' value='{$amt}'><br>");
        output("To: ");
        rawoutput("<input name='to' value='{$to}'>");
        output(" (partial names are ok, you will be asked to confirm the transaction before it occurs).`n");
        rawoutput("<input type='submit' class='button' value='{$msg}'></form>");
        rawoutput("<script language='javascript'>document.getElementById('amount').focus();</script>", true);
        addnav("", "bank.php?op=transfer2");
    } elseif (db_num_rows($result) > 1) {
        rawoutput("<form action='bank.php?op=transfer3' method='POST'>");
        output("`6Transfer `^%s`6 to ", $amt);
        rawoutput("<select name='to' class='input'>");
        $number = db_num_rows($result);
        for ($i = 0; $i < $number; $i++) {
            $row = db_fetch_assoc($result);
            rawoutput("<option value=\"" . HTMLEntities($row['login'], ENT_COMPAT, getsetting("charset", "ISO-8859-1")) . "\">" . full_sanitize($row['name']) . "</option>");
        }
        $msg = translate_inline("Complete Transfer");
        rawoutput("</select><input type='hidden' name='amount' value='{$amt}'><input type='submit' class='button' value='{$msg}'></form>", true);
        addnav("", "bank.php?op=transfer3");
    } else {
        output("`@Elessa`6 blinks at you from behind her spectacles, \"`@I'm sorry, but I can find no one matching that name who does business with our bank!  Please try again.`6\"");
    }
} elseif ($op == "transfer3") {
    $amt = abs((int) httppost('amount'));
    $to = httppost('to');
    output("`6`bTransfer Completion`b`n");
    if ($session['user']['gold'] + $session['user']['goldinbank'] < $amt) {
        output("`@Elessa`6 stands up to her full, but still diminutive height and glares at you, \"`@How can you transfer `^%s`@ gold when you only possess `^%s`@?`6\"", $amt, $session['user']['gold'] + $session['user']['goldinbank']);
    } else {
        $sql = "SELECT name,acctid,level,transferredtoday FROM " . db_prefix("accounts") . " WHERE login='{$to}'";

         if ($row['superuser'] & SU_GIVES_YOM_WARNING && !($row['superuser'] & SU_OVERRIDE_YOM_WARNING)) {
             array_push($superusers, $row['login']);
         }
     } elseif (db_num_rows($result) == 0) {
         output("`@No one was found who matches \"%s\".  ", stripslashes($to));
         $try = translate_inline("Please try again");
         output_notl("<a href=\"mail.php?op=address&prepop=" . rawurlencode(stripslashes(htmlentities($to))) . "\">{$try}</a>.", true);
         popup_footer();
         exit;
     } else {
         output_notl("<select name='to' id='to' onChange='check_su_warning();'>", true);
         $superusers = array();
         for ($i = 0; $i < db_num_rows($result); $i++) {
             $row = db_fetch_assoc($result);
             output_notl("<option value=\"" . HTMLEntities($row['login']) . "\">", true);
             output_notl("%s", full_sanitize($row['name']));
             if ($row['superuser'] & SU_GIVES_YOM_WARNING && !($row['superuser'] & SU_OVERRIDE_YOM_WARNING)) {
                 array_push($superusers, $row['login']);
             }
         }
         output_notl("</select>`n", true);
     }
 }
 rawoutput("<script language='JavaScript'>\r\n\tvar superusers = new Array();");
 while (list($key, $val) = each($superusers)) {
     rawoutput("\tsuperusers['" . addslashes($val) . "'] = true;");
 }
 rawoutput("</script>");
 output("`2Subject:");
 rawoutput("<input name='subject' value=\"" . HTMLEntities($subject) . HTMLEntities(stripslashes(httpget('subject'))) . "\"><br>");
 rawoutput("<div id='warning' style='visibility: hidden; display: none;'>");

<?php

$apply = httpget('apply');
if ($apply == 1) {
    $ocn = httppost('clanname');
    $ocs = httppost('clanshort');
    $clanname = stripslashes($ocn);
    $clanname = full_sanitize($clanname);
    $clanname = preg_replace("'[^[:alpha:] \\'-]'", "", $clanname);
    $clanname = addslashes($clanname);
    httppostset('clanname', $clanname);
    $clanshort = full_sanitize($ocs);
    $clanshort = preg_replace("'[^[:alpha:]]'", "", $clanshort);
    httppostset('clanshort', $clanshort);
    $sql = "SELECT * FROM " . db_prefix("clans") . " WHERE clanname='{$clanname}'";
    $result = db_query($sql);
    $e = array(translate_inline("%s`7 looks over your form but informs you that your clan name must consist only of letters, spaces, apostrophes, or dashes.  Also, your short name can consist only of letters. She hands you a blank form."), translate_inline("%s`7 looks over your form but informs you that you must have at least 5 and no more than 50 characters in your clan's name (and they must consist only of letters, spaces, apostrophes, or dashes), then hands you a blank form."), translate_inline("%s`7 looks over your form but informs you that you must have at least 2 and no more than 5 characters in your clan's short name (and they must all be letters), then hands you a blank form."), translate_inline("%s`7 looks over your form but informs you that the clan name %s is already taken, and hands you a blank form."), translate_inline("%s`7 looks over your form but informs you that the short name %s is already taken, and hands you a blank form."), translate_inline("%s`7 asks for the %s gold to start the clan, but you seem to be unable to produce the fees."), translate_inline("%s`7 asks for the %s gold and %s gems to start the clan, but you seem to be unable to produce the fees."), translate_inline("%s`7 asks for the %s gems to start the clan, but you seem to be unable to produce the fees."), translate_inline("She takes your application, and stamps it \"`\$DENIED`7\"."));
    if ($clanname != $ocn || $clanshort != $ocs) {
        output_notl($e[0], $registrar);
        clanform();
        addnav("Return to the Lobby", "clan.php");
    } elseif (strlen($clanname) < 5 || strlen($clanname) > 50) {
        output_notl($e[1], $registrar);
        clanform();
        addnav("Return to the Lobby", "clan.php");
    } elseif (strlen($clanshort) < 2 || strlen($clanshort) > 5) {
        output_notl($e[2], $registrar);
        clanform();
        addnav("Return to the Lobby", "clan.php");
    } elseif (db_num_rows($result) > 0) {
        output_notl($e[3], $registrar, stripslashes($clanname));

        for ($i = 0; $i < db_num_rows($result); $i++) {
            $row = db_fetch_assoc($result);
            if ($row['c'] == 0) {
                $sql = "DELETE FROM " . db_prefix("clans") . " WHERE clanid={$row['clanid']}";
                db_query($sql);
            } else {
                /*//*/
                $row = modulehook("clan-applymember", $row);
                /*//*/
                if (isset($row['handled']) && $row['handled']) {
                    continue;
                }
                $memb_n = translate_inline("(%s members)");
                $memb_1 = translate_inline("(%s member)");
                if ($row['c'] == 1) {
                    $memb = sprintf($memb_1, $row['c']);
                } else {
                    $memb = sprintf($memb_n, $row['c']);
                }
                output_notl("&#149; <a href='clan.php?op=apply&to=%s'>%s</a> %s`n", $row['clanid'], full_sanitize(htmlentities($row['clanname'], ENT_COMPAT, getsetting("charset", "ISO-8859-1"))), $memb, true);
                addnav("", "clan.php?op=apply&to={$row['clanid']}");
            }
        }
        addnav("Return to the Lobby", "clan.php");
    } else {
        output("`7You ask %s`7 for a clan membership application form.", $registrar);
        output("She stares at you blankly for a few moments, then says, \"`5Sorry pal, no one has had enough gumption to start up a clan yet.  Maybe that should be you, eh?`7\"");
        addnav("Apply for a New Clan", "clan.php?op=new");
        addnav("Return to the Lobby", "clan.php");
    }
}

    } else {
        rawoutput("<input type='submit' name='block' value=\"{$snb}\" class='button'>");
    }
    rawoutput("</form>");
    rawoutput("</div>");
    rawoutput("<script language='JavaScript'>var hidearea = document.getElementById('hidearea');hidearea.style.visibility='hidden';hidearea.style.display='none';</script>", true);
    $e = translate_inline("Edit Clan Info");
    rawoutput("<a href='#' onClick='hidearea.style.visibility=\"visible\"; hidearea.style.display=\"inline\"; return false;'>{$e}</a>", true);
    output_notl("`n");
}
output_notl(nltoappon($row1['clandesc']));
if (nltoappon($row1['clandesc']) != "") {
    output("`n`n");
}
output("`0This is the current clan membership of %s < %s >:`n", $row1['clanname'], $row1['clanshort']);
page_header("Clan Membership for %s &lt;%s&gt;", full_sanitize($row1['clanname']), full_sanitize($row1['clanshort']));
addnav("Clan Options");
$rank = translate_inline("Rank");
$name = translate_inline("Name");
$dk = translate_inline("Dragon Kills");
$jd = translate_inline("Join Date");
rawoutput("<table border='0' cellpadding='2' cellspacing='0'>");
rawoutput("<tr class='trhead'><td>{$rank}</td><td>{$name}</td><td>{$dk}</td><td>{$jd}</td></tr>");
$i = 0;
$sql = "SELECT acctid,name,login,clanrank,clanjoindate,dragonkills FROM " . db_prefix("accounts") . " WHERE clanid={$detail} ORDER BY clanrank DESC,clanjoindate";
$result = db_query($sql);
$tot = 0;
//little hack with the hook...can't think of any other way
$ranks = array(CLAN_APPLICANT => "`!Applicant`0", CLAN_MEMBER => "`#Member`0", CLAN_OFFICER => "`^Officer`0", CLAN_LEADER => "`&Leader`0", CLAN_FOUNDER => "`\$Founder");
$args = modulehook("clanranks", array("ranks" => $ranks, "clanid" => $detail));
$ranks = translate_inline($args['ranks']);

function soap($input, $debug = false, $skiphook = false)
{
    global $session;
    require_once "lib/sanitize.php";
    $final_output = $input;
    // $output is the color code-less (fully sanitized) input against which
    // we search.
    $output = full_sanitize($input);
    // the mask of displayable chars that should be masked out;
    // X displays, _ masks.
    $mix_mask = str_pad("", strlen($output), "X");
    if (getsetting("soap", 1)) {
        $search = nasty_word_list();
        $exceptions = array_flip(good_word_list());
        $changed_content = false;
        while (list($key, $word) = each($search)) {
            do {
                if ($word > "") {
                    $times = preg_match_all($word, $output, $matches);
                } else {
                    $times = 0;
                }
                for ($x = 0; $x < $times; $x++) {
                    if (strlen($matches[0][$x]) < strlen($matches[1][$x])) {
                        $shortword = $matches[0][$x];
                        $longword = $matches[1][$x];
                    } else {
                        $shortword = $matches[1][$x];
                        $longword = $matches[0][$x];
                    }
                    if (isset($exceptions[strtolower($longword)])) {
                        $x--;
                        $times--;
                        if ($debug) {
                            output("This word is ok because it was caught by an exception: `b`^%s`7`b`n", $longword);
                        }
                    } else {
                        if ($debug) {
                            output("`7This word is not ok: \"`%%s`7\"; it blocks on the pattern `i%s`i at \"`\$%s`7\".`n", $longword, $word, $shortword);
                        }
                        // if the word should be filtered, drop it from the
                        // search terms ($output), and mask its bytes out of
                        // the output mask.
                        $len = strlen($shortword);
                        $pad = str_pad("", $len, "_");
                        //while (($p = strpos($output,$shortword))!==false){
                        $p = strpos($output, $shortword);
                        $output = substr($output, 0, $p) . $pad . substr($output, $p + $len);
                        $mix_mask = substr($mix_mask, 0, $p) . $pad . substr($mix_mask, $p + $len);
                        //}
                        $changed_content = true;
                    }
                    //end if
                }
                //end for
            } while ($times > 0);
        }
        $y = 0;
        //position within final output
        $pad = '#@%$!';
        for ($x = 0; $x < strlen($mix_mask); $x++) {
            while (substr($final_output, $y, 1) == "`") {
                $y += 2;
                //when encountering appo encoding, skip over it.
            }
            //this character should be masked out.
            if (substr($mix_mask, $x, 1) == "_") {
                $final_output = substr($final_output, 0, $y) . substr($pad, $x % strlen($pad), 1) . substr($final_output, $y + 1);
            }
            $y++;
        }
        if ($session['user']['superuser'] & SU_EDIT_COMMENTS && $changed_content) {
            output("`0The filter would have tripped on \"`#%s`0\" but since you're a moderator, I'm going to be lenient on you.  The text would have read, \"`#%s`0\"`n`n", $input, $final_output);
            return $input;
        } else {
            if ($changed_content && !$skiphook) {
                modulehook("censor", array("input" => $input));
            }
            return $final_output;
        }
    } else {
        return $final_output;
    }
}

function soap(string $input, bool $debug = false, bool $skiphook = false) : string
{
    global $session;
    require_once "lib/sanitize.php";
    require_once 'lib/sanitize.php';
    $final_output = $input;
    $output = full_sanitize($input);
    $mix_mask = str_pad('', strlen($output), 'X');
    if (getsetting('soap', 1)) {
        $search = nasty_word_list();
        $exceptions = array_flip(good_word_list());
        $changed_content = false;
        while (list($key, $word) = each($search)) {
            do {
                if ($word > '') {
                    $times = @preg_match_all($word, $output, $matches);
                } else {
                    $times = 0;
                }
                for ($x = 0; $x < $times; $x++) {
                    if (strlen($matches[0][$x]) < strlen($matches[1][$x])) {
                        $shortword = $matches[0][$x];
                        $longword = $matches[1][$x];
                    } else {
                        $shortword = $matches[1][$x];
                        $longword = $matches[0][$x];
                    }
                    if (isset($exceptions[strtolower($longword)])) {
                        $x--;
                        $times--;
                        if ($debug) {
                            output("This word is ok because it was caught by an exception: `b`^%s`7`b`n", $longword);
                        }
                    } else {
                        if ($debug) {
                            output("`7This word is not ok: \"`%%s`7\"; it blocks on the pattern `i%s`i at \"`\$%s`7\".`n", $longword, $word, $shortword);
                        }
                        $len = strlen($shortword);
                        $pad = str_pad('', $len, '_');
                        $p = strpos($output, $shortword);
                        $output = substr($output, 0, $p) . $pad . substr($output, $p + $len);
                        $mix_mask = substr($mix_mask, 0, $p) . $pad . substr($mix_mask, $p + $len);
                        $changed_content = true;
                    }
                }
            } while ($times > 0);
        }
        $y = 0;
        $pad = '#@%$!';
        for ($x = 0; $x < strlen($mix_mask); $x++) {
            while (substr($final_output, $y, 1) == '`') {
                $y += 2;
            }
            if (substr($mix_mask, $x, 1) == '_') {
                $final_output = substr($final_output, 0, $y) . substr($pad, $x % strlen($pad), 1) . substr($final_output, $y + 1);
            }
            $y++;
        }
        if ($session['user']['superuser'] & SU_EDIT_COMMENTS && $changed_content) {
            output("`0The filter would have tripped on \"`#%s`0\" but since you're a moderator, I'm going to be lenient on you.  The text would have read, \"`#%s`0\"`n`n", $input, $final_output);
            return $input;
        } else {
            if ($changed_content && !$skiphook) {
                modulehook('censor', ['input' => $input]);
            }
            return $final_output;
        }
    } else {
        return $final_output;
    }
}

$petition = modulehook('petition-form', ['header' => $petitionHeader, 'form' => $petitionForm, 'footnote' => $petitionFootNote]);
if (empty($post)) {
    output("`^%s `n`n`@%s`0 `n`Q%s`0", $petition['header'], $petition['form'], $petition['footnote'], true);
} else {
    $ip = substr($session['user']['lastip'], 0, -2);
    $sql = db_query("SELECT count(petitionid) AS count FROM {$petitions}\n        WHERE (ip LIKE '{$ip}%' OR id = '" . addslashes($_COOKIE['lgi']) . "')\n        AND date > '" . date('Y-m-d H:i:s', strtotime('-1 day')) . "'\n        AND status != '0'");
    $row = db_fetch_assoc($sql);
    if ($row['count'] >= 5 && !($session['user']['superuser'] & SU_EDIT_PETITIONS)) {
        output("`4We are sorry, but in an effort to keep spamming of the petitions to a minimum, we ask that users limit themselves to five petitions a day. Please try again tomorrow, or when one of your current issues is resolved.");
    } else {
        $date = date('Y-m-d H:i:s');
        $post['cancelpetition'] = false;
        $post['cancelreason'] = '';
        $post = modulehook('addpetition', $post);
        if ($post['cancelpetition'] == true) {
            output($post['cancelreason']);
        } else {
            db_query("INSERT INTO {$petitions} (author, date, body, pageinfo, ip, id)\n                VALUES ('{$session['user']['acctid']}', '{$date}', '" . addslashes($post['body']) . "', '" . addslashes($sessionJson) . "', '{$ip}', '" . addslashes($_COOKIE['lgi']) . "')");
            invalidatedatacache('petition_counts');
            output("`@Your petition has been sent!`n");
            output("As soon as the administration sees your petition for help, they will answer it immediately. Please give time for them to handle your issue and have a nice day!");
            if (getsetting('emailpetitions', 0)) {
                $name = translate_inline(full_sanitize($post['name']));
                $url = getsetting('serverurl', 'http://lotgd.net');
                $body = translate_inline($post['body']);
                mail(getsetting('gameadminemail', 'admin@lotgd.net'), "New petition from {$name}!", $body);
            }
        }
    }
}
popup_footer();

function claneditor_run()
{
    global $session;
    tlschema("claneditor");
    $dt = httpget("dt");
    $op = httpget('op');
    if ($dt != "") {
        $sql = "SELECT * FROM " . db_prefix("clans") . " WHERE clanid='{$dt}'";
        $result = db_query($sql);
        $claninfo = db_fetch_assoc($result);
        if (db_num_rows($result) == 0) {
            $op = "";
        }
    }
    addcommentary();
    $ranks = array(CLAN_APPLICANT => "`!Applicant`0", CLAN_MEMBER => "`#Member`0", CLAN_OFFICER => "`^Officer`0", CLAN_LEADER => "`&Leader`0", CLAN_FOUNDER => "`\$Founder");
    $args = modulehook("clanranks", array("ranks" => $ranks, "clanid" => $dt));
    $ranks = translate_inline($args['ranks'], "clan");
    superusernav();
    addnav("Clans");
    addnav("List Clans", "runmodule.php?module=claneditor&op=list");
    addnav("Create a New Clan", "runmodule.php?module=claneditor&op=new");
    if ($op == "" || $op == "list") {
        page_header("Clan Listing");
        rawoutput("<table border='0' padding='0'><tr><td>");
        $sql = "SELECT MAX(" . db_prefix("clans") . ".clanid) AS clanid, MAX(clanname) AS clanname,count(" . db_prefix("accounts") . ".acctid) AS c FROM " . db_prefix("clans") . " LEFT JOIN " . db_prefix("accounts") . " ON " . db_prefix("clans") . ".clanid=" . db_prefix("accounts") . ".clanid AND clanrank>" . CLAN_APPLICANT . " GROUP BY " . db_prefix("clans") . ".clanid ORDER BY c DESC";
        $result = db_query($sql);
        if (db_num_rows($result) > 0) {
            output("`%Karissa`7 steps in as if by magic, listing the clans for you.`n");
            output("`@`bList of Clans:`b`0`n`n");
            $v = 0;
            $memb_n = translate_inline("(%s members)");
            $memb_1 = translate_inline("(%s member)");
            rawoutput('<table cellspacing="0" cellpadding="2" align="left">');
            output_notl("<tr class='trhead'><td>%s</td><td>%s</td></tr>", translate_inline("`b`&Name of Clan`b"), translate_inline("`&`iNumber of Members`i"), true);
            for ($i = 0; $i < db_num_rows($result); $i++) {
                $row = db_fetch_assoc($result);
                if ($row['c'] == 0) {
                    $sql = "DELETE FROM " . db_prefix("clans") . " WHERE clanid={$row['clanid']}";
                    db_query($sql);
                } else {
                    rawoutput('<tr class="' . ($v % 2 ? "trlight" : "trdark") . '"><td>', true);
                    if ($row['c'] == 1) {
                        $memb = sprintf($memb_1, $row['c']);
                    } else {
                        $memb = sprintf($memb_n, $row['c']);
                    }
                    output_notl("&#149; <a href='runmodule.php?module=claneditor&op=mview&dt=%s'>%s</a></td><td>%s`n", $row['clanid'], full_sanitize(htmlentities($row['clanname']), ENT_COMPAT, getsetting("charset", "ISO-8859-1")), $memb, true);
                    rawoutput('</td></tr>');
                    addnav("", "runmodule.php?module=claneditor&op=mview&dt={$row['clanid']}");
                    $v++;
                }
            }
            rawoutput("</table>", true);
        } else {
            output("`7There are no clans in the database.`n`c");
        }
        rawoutput("</td></tr><tr><td>");
        output_notl("<br>[<a href='runmodule.php?module=claneditor&op=new'>%s</a>]", translate_inline("Create a New Clan"), true);
        addnav("", "runmodule.php?module=claneditor&op=new");
        rawoutput("</td></tr></table>");
        page_footer();
    } elseif ($op == "new") {
        page_header("Clan Creation");
        $apply = httpget('apply');
        if ($apply == 1) {
            $id = httpget("id");
            $ocn = httppost('clanname');
            $ocs = httppost('clanshort');
            $clanname = stripslashes($ocn);
            $clanname = full_sanitize($clanname);
            $clanname = preg_replace("'[^[:alpha:] \\'-]'", "", $clanname);
            $clanname = addslashes($clanname);
            httppostset('clanname', $clanname);
            $clanshort = full_sanitize($ocs);
            $clanshort = preg_replace("'[^[:alpha:]]'", "", $clanshort);
            httppostset('clanshort', $clanshort);
            $sql = "SELECT * FROM " . db_prefix("clans") . " WHERE clanname='{$clanname}'";
            $result = db_query($sql);
            $e = translate_inline("`%Karissa`7 hands you a form to start a clan.");
            $e1 = translate_inline("`%Karissa`7 looks over your form but informs you that your clan name must consist only of letters, spaces, apostrophes, or dashes.  Also, your short name can consist only of letters. She hands you a blank form.");
            $e2 = translate_inline("`%Karissa`7 looks over your form but informs you that you must have at least 5 and no more than 50 characters in your clan's name (and they must consist only of letters, spaces, apostrophes, or dashes), then hands you a blank form.");
            $e3 = translate_inline("`%Karissa`7 looks over your form but informs you that you must have at least 2 and no more than 5 characters in your clan's short name (and they must all be letters), then hands you a blank form.");
            $e4 = translate_inline("`%Karissa`7 looks over your form but informs you that the clan name %s is already taken, and hands you a blank form.");
            $e5 = translate_inline("`%Karissa`7 looks over your form but informs you that the short name %s is already taken, and hands you a blank form.");
            if ($ocs == "" && $ocn == "" && !httppostisset('clanname') && !httppostisset('clanshort')) {
                output_notl($e);
                clanform();
            } elseif ($clanname != $ocn || $clanshort != $ocs) {
                output_notl($e1);
                clanform();
            } elseif (strlen($clanname) < 5 || strlen($clanname) > 50) {
                output_notl($e2);
                clanform();
            } elseif (strlen($clanshort) < 2 || strlen($clanshort) > 5) {
                output_notl($e3);
                clanform();
            } elseif (db_num_rows($result) > 0) {
                output_notl($e4, stripslashes($clanname));
                clanform();
//.........这里部分代码省略.........