PHP isValidID函数代码示例

function execEditGroup($userID, $groupID, $checkedUser)
{
    if (gettype($checkedUser) != "array") {
        return "Wrong type of group member!";
    }
    $checkedUser[] = $userID;
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($userID);
    if (!isValidID($groupID)) {
        return "Invalid group ID!";
    }
    $groupDAO = new GroupDAO();
    $group = $groupDAO->getGroupByID($groupID);
    if ($group === null) {
        return "Group doesn't exist!";
    }
    if ($group->getOwner()->getUserID() !== $userID) {
        return "You are not the owner of this group!";
    }
    $gmDAO = new GroupMemberDAO();
    $gms = $gmDAO->getGroupMembersByGroup($group);
    foreach ($gms as $gm) {
        $alreadyUser = $gm->getUser();
        if (in_array($alreadyUser->getUserID(), $checkedUser)) {
            continue;
        }
        $gmDAO->deleteGroupMember($gm);
    }
    return true;
}

function execChangeProfile($firstname, $lastname, $sex, $departmentID)
{
    if (!isValidName($firstname) || !isValidName($lastname)) {
        return "Please enter valid names!";
    }
    if (!isValidID($departmentID)) {
        return "Invalid department id!";
    }
    $departDAO = new DepartmentDAO();
    $depart = $departDAO->getDepartmentByID($departmentID);
    if ($depart === null) {
        return "Could not find the depart!";
    }
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($_SESSION["userID"]);
    $user->setDepartment($depart);
    if ($user->getFirstName() != $firstname) {
        $user->setFirstName($firstname);
    }
    if ($user->getLastName() != $lastname) {
        $user->setLastName($lastname);
    }
    if ($user->getGender() != $sex) {
        $user->setGender($sex);
    }
    if (isset($_FILES["uploadphoto"])) {
        $ans = uploadPhoto($user, $_FILES["uploadphoto"]);
        if ($ans !== true) {
            return $ans;
        }
    }
    $userDAO->updateUser($user);
    return true;
}

function verify()
{
    if (isset($_GET["groupid"]) && isset($_GET["accept"])) {
        $groupID = $_GET["groupid"];
        if (!isValidID($groupID)) {
            return;
        }
        $groupDAO = new GroupDAO();
        $group = $groupDAO->getGroupByID($groupID);
        if ($group === null) {
            return;
        }
        $userDAO = new UserDAO();
        $user = $userDAO->getUserByID($_SESSION["userID"]);
        $gmDAO = new GroupMemberDAO();
        $gm = $gmDAO->getGroupMember($group, $user);
        if ($gm === null) {
            return;
        }
        $status = $gm->getAcceptStatus();
        if ($status == "1") {
            return;
        }
        if ($_GET["accept"] == "1") {
            $gm->setAcceptStatus("1");
            $gmDAO->updateGroupMember($gm);
        } elseif ($_GET["accept"] == "3") {
            $gmDAO->deleteGroupMember($gm);
        }
    }
}

function uploadFile($userID, $groupID, $file)
{
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($userID);
    if ($user->getRole()->getRoleID() == "4") {
        return "This user was forbidden to upload file!";
    }
    if (!isValidID($groupID)) {
        return "Group id is not valid!";
    }
    $groupDAO = new GroupDAO();
    $group = $groupDAO->getGroupByID($groupID);
    if ($group === null) {
        return "Can not find this group!";
    }
    if ($group->getActivateStatus() === "2") {
        return "Group is not activated!";
    }
    $groupMemberDAO = new GroupMemberDAO();
    $groupMember = $groupMemberDAO->getGroupMember($group, $user);
    if ($groupMember === null) {
        return "User didn't belong to this group!";
    }
    if (gettype($file["error"]) == "array") {
        return "Only accept one file!";
    }
    $res = isValidUploadFile($file["error"]);
    if ($res !== true) {
        return $res;
    }
    $fileType = -1;
    $res = isValidImage($file["name"]);
    if ($res === true) {
        $fileType = "2";
    }
    $res = isValidFile($file["name"]);
    if ($res === true) {
        $fileType = "3";
    }
    if ($fileType === -1) {
        return "Only accepts jpeg/jpg/gif/png/zip file!";
    }
    $record = new Record($group, $user, $fileType, "temp", "1");
    $recordDAO = new RecordDAO();
    $recordDAO->insertRecord($record);
    $fileDir = "upload/";
    $filePath = $fileDir . $record->getRecordID() . "_" . $file["name"];
    $record->setContent($filePath);
    $recordDAO->updateRecord($record);
    if (file_exists($filePath)) {
        unlink($filePath);
    }
    if (!move_uploaded_file($file['tmp_name'], $filePath)) {
        return "Fail to move file, please contact administrator!";
    }
    return true;
}

function postRecord($userID, $groupID, $messageType, $content)
{
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($userID);
    if ($user->getRole()->getRoleID() == "4") {
        return "This user was forbidden to post!";
    }
    if (!isValidID($groupID)) {
        return "Group id is not valid!";
    }
    if (!isValidMessageType($messageType)) {
        return "Message type is not valid!";
    }
    if (gettype($content) != "string" || strlen($content) > 1000) {
        return "Wrong type content or exceed max length(1000)!";
    }
    if ($messageType == "4") {
        if (!preg_match("/^http:\\/\\//i", $content)) {
            return "Only accept http url!";
        }
        $content = substr($content, 7);
        if ($content === "") {
            return "Invalid url!";
        }
    }
    $groupDAO = new GroupDAO();
    $group = $groupDAO->getGroupByID($groupID);
    if ($group === null) {
        return "Can not find this group!";
    }
    if ($group->getActivateStatus() === "2") {
        return "Group is not activated!";
    }
    $groupMemberDAO = new GroupMemberDAO();
    $groupMember = $groupMemberDAO->getGroupMember($group, $user);
    if ($groupMember === null) {
        return "User didn't belong to this group!";
    }
    $record = new Record($group, $user, $messageType, $content, "1");
    $recordDAO = new RecordDAO();
    $recordDAO->insertRecord($record);
    return true;
}

function execAddToGroup($userID, $groupID, $adduserIDs)
{
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($userID);
    if (!isValidID($groupID)) {
        return "Invalid group ID!";
    }
    if (gettype($adduserIDs) != "array") {
        return "Wrong type of user id!";
    }
    if (count($adduserIDs) === 0) {
        return "You have to choose users to add to this group!";
    }
    foreach ($adduserIDs as $adduserID) {
        if (!isValidID($adduserID)) {
            return "Invalid user ID!";
        }
    }
    $groupDAO = new GroupDAO();
    $group = $groupDAO->getGroupByID($groupID);
    if ($group === null) {
        return "Group doesn't exist!";
    }
    if ($group->getOwner()->getUserID() !== $userID) {
        return "You are not the owner of this group!";
    }
    $gmDAO = new GroupMemberDAO();
    foreach ($adduserIDs as $auID) {
        $aduser = $userDAO->getUserByID($auID);
        if ($aduser === null) {
            continue;
        }
        $gm = $gmDAO->getGroupMember($group, $aduser);
        if ($gm !== null) {
            continue;
        }
        $gm = new GroupMember($group, $aduser, "2");
        $gmDAO->insertGroupMember($gm);
    }
    return true;
}

function execEditDep($userID, $departmentID, $departmentName)
{
    if (!isValidID($departmentID)) {
        return "Invalid parent ID!";
    }
    if (!isValidDepartmentName($departmentName)) {
        return "Invalid department name!";
    }
    $departDAO = new DepartmentDAO();
    $depart = $departDAO->getDepartmentByID($departmentID);
    if ($depart === null) {
        return "Could not find this department!";
    }
    $userDAO = new UserDAO();
    $user = $userDAO->getUserByID($userID);
    $role = $user->getRole();
    if ($role->getRoleID() == "4" || $role->getRoleID() == "3") {
        return "You have no right to do this!";
    }
    $depart->setDepartmentName($departmentName);
    $departDAO->updateDepartment($depart);
    return true;
}

<?php

require_once "classes/Recipe.class.php";
require_once "classes/DBUtils.class.php";
// Determine if the user has access to add new recipes, or edit this current one
if (!$SMObj->isUserLoggedIn()) {
    die($LangUI->_('You must be logged into perform the requested action.'));
}
// Proceed to the next step
$iterator = 0;
$item_id = "recipe_id_" . $iterator;
$item_delete = "recipe_selected_" . $iterator;
while (isset($_REQUEST[$item_id])) {
    // check to see if it is in the list
    if (isset($_REQUEST[$item_delete]) && $_REQUEST[$item_delete] == "yes") {
        $recipe_id = isValidID($_REQUEST[$item_id]) ? $_REQUEST[$item_id] : 0;
        // Figure out who the owner of this recipe is, Editors can edit anyones recipes
        // The owner of a recipe does not change when someone edits it.
        if (!$SMObj->checkAccessLevel("EDITOR")) {
            $sql = "SELECT recipe_user FROM {$db_table_recipes} WHERE recipe_id = " . $DB_LINK->addq($recipe_id, get_magic_quotes_gpc());
            $rc = $DB_LINK->Execute($sql);
            // If the recipe is owned by someone else then do not allow editing
            if ($rc->fields['recipe_user'] != "" && $rc->fields['recipe_user'] != $SMObj->getUserID()) {
                die($LangUI->_('You do not have sufficient privileges to delete this recipe!'));
            }
        }
        /* Go ahead and do the delete */
        // clean up the old picture if we are suppose to
        if ($g_rb_database_type == "postgres") {
            $sql = "SELECT recipe_picture FROM {$db_table_recipes} WHERE recipe_id=" . $DB_LINK->addq($recipe_id, get_magic_quotes_gpc());
            $rc = $DB_LINK->Execute($sql);

<?php

require_once "classes/Pager.class.php";
$where = isset($_GET['where']) && isValidLetter($_GET['where'], "%") ? $_GET['where'] : '';
$page = isset($_GET['page']) && isValidID($_GET['page']) ? $_GET['page'] : 1;
if (empty($where)) {
    $where = $alphabet[0];
    // Set the default on to 'a' so that we don't have everything listed (faster this way)
}
// Pull First Letters
$let = ":";
$sql = "SELECT DISTINCT LOWER(SUBSTRING(ingredient_name, 1, 1)) AS A FROM {$db_table_ingredients} WHERE ingredient_user = '" . $DB_LINK->addq($SMObj->getUserID(), get_magic_quotes_gpc()) . "'";
$rc = $DB_LINK->Execute($sql);
DBUtils::checkResult($rc, NULL, NULL, $sql);
while (!$rc->EOF) {
    if (ord($rc->fields[0]) >= 192 and ord($rc->fields[0]) <= 222 and ord($rc->fields[0]) != 215) {
        // "Select lower"
        $rc->fields[0] = chr(ord($rc->fields[0]) + 32);
    }
    // above doesn't work with ascii > 192, this fixes it
    $let .= $rc->fields[0];
    // it could be "a" or "A", so just go with the only returned item
    $rc->MoveNext();
}
?>

<table cellspacing="0" cellpadding="1" border="0" width="100%">
<tr>
        <td align="left" class="title"><?php 
echo $LangUI->_('Ingredient Index');
?>

function changeUserProfile($userID, $departmentID, $firstname, $lastname, $gender)
{
    $userDAO = new UserDAO();
    $departmentDAO = new DepartmentDAO();
    $user = $userDAO->getUserByID($userID);
    $department = $departmentDAO->getDepartmentByID($departmentID);
    if (!isValidID($userID) || !isValidID($departmentID)) {
        return "Invalid ID!";
    }
    if ($department === null) {
        return "Department: " . $departmentID . " doesn't exist!";
    }
    $user->setDepartment($dept);
    if (!isValidName($firstname)) {
        return "Invalid first name!";
    }
    $user->setFirstName($firstname);
    if (!isValidName($lastname)) {
        return "Invalid last name!";
    }
    $user->setLastName($lastname);
    if ($gender !== 0 && $gender !== 1) {
        return "Please select Male or Female!";
    }
    $user->setGender($gender);
    $userDAO->updateUser($user);
}

<!-- Load Data Section -->
<?php 
$store_id = isValidID($_GET['store_id']) ? $_GET['store_id'] : 0;
$sql = "SELECT store_name,store_layout FROM {$db_table_stores} WHERE store_id=" . $DB_LINK->addq($store_id, get_magic_quotes_gpc()) . " AND store_user='" . $SMObj->getUserID() . "'";
$rc = $DB_LINK->Execute($sql);
DBUtils::checkResult($rc, NULL, NULL, $sql);
$store_name = $rc->fields['store_name'];
$store_layout = split(',', $rc->fields['store_layout']);
$sql = "SELECT location_id, location_desc FROM {$db_table_locations}";
$rc = $DB_LINK->Execute($sql);
DBUtils::checkResult($rc, NULL, NULL, $sql);
$locations = DBUtils::createList($rc, 'location_id', 'location_desc');
?>
<!-- Navigation section -->
<table cellspacing="0" cellpadding="1" border="0" width="100%">
<tr>
	<td align="left" class="title">
		<?php 
echo $LangUI->_('Store Layout For:  ') . $store_name . "<br>";
?>
	</td>
</tr>
</table>

<table cellspacing="1" cellpadding="2" border="0" class="ing" width="40%">
<tr>
	<th><?php 
echo $LangUI->_('Section Name');
?>
</th>
</tr>

<?php

require_once "classes/DBUtils.class.php";
$recipe_id = isValidID($_GET['recipe_id']) ? $_GET['recipe_id'] : 0;
?>
<table cellspacing="0" cellpadding="1" border="0" width="100%">
<tr>
	<td align="left" class="title"><?php 
echo $LangUI->_('Parent recipes');
?>
</td>
</tr>
</table>
<p>
<?php 
$sql = "SELECT related_parent,recipe_name FROM {$db_table_related_recipes}\n\t\tLEFT JOIN {$db_table_recipes} ON recipe_id=related_parent\n\t\tWHERE related_child=" . $DB_LINK->addq($recipe_id, get_magic_quotes_gpc());
$rc = $DB_LINK->Execute($sql);
DBUtils::checkResult($rc, NULL, NULL, $sql);
// Test to see if we found anything
if ($rc->RecordCount() == 0) {
    echo $LangUI->_('No matching recipes found') . '.';
}
// Display all of the matching recipes that use said ingredient
while (!$rc->EOF) {
    echo '<a href="index.php?m=recipes&amp;a=view&recipe_id=' . $rc->fields['related_parent'] . '">' . $rc->fields['recipe_name'] . "</a><br />\n";
    $rc->MoveNext();
}

<?php

require_once "classes/Units.class.php";
require_once "classes/DBUtils.class.php";
$recipe_id = isset($_GET['recipe_id']) && isValidID($_GET['recipe_id']) ? $_GET['recipe_id'] : 0;
$total_ingredients = isset($_GET['total_ingredients']) && isValidID($_REQUEST['total_ingredients']) ? $_REQUEST['total_ingredients'] : 0;
$total_related = isset($_GET['total_related']) && isValidID($_REQUEST['total_related']) ? $_REQUEST['total_related'] : 0;
$show_ingredient_ordering = isset($_REQUEST['show_ingredient_order']) ? 'yes' : '';
$private = isset($_REQUEST['private']) ? TRUE : FALSE;
// Declarations
$n = 0;
$p = 0;
$ingredients = null;
if ($g_rb_debug) {
    $show_ingredient_ordering = "yes";
}
// Determine if the user has access to add new recipes, or edit this current one
if (!$SMObj->isUserLoggedIn()) {
    die($LangUI->_('You must be logged into perform the requested action.'));
}
if ($recipe_id && !$SMObj->checkAccessLevel("EDITOR")) {
    // Figure out who the owner of this recipe is, Editors can edit anyones recipes
    // The owner of a recipe does not change when someone edits it.
    $sql = "SELECT recipe_user FROM {$db_table_recipes} WHERE recipe_id = " . $DB_LINK->addq($recipe_id, get_magic_quotes_gpc());
    $rc = $DB_LINK->Execute($sql);
    // If the recipe is owned by someone else then do not allow editing
    if ($rc->fields['recipe_user'] != "" && $rc->fields['recipe_user'] != $SMObj->getUserID()) {
        die($LangUI->_('You are not the owner of this recipe, you are not allowed to edit it'));
    }
}
// get the information about the recipe (empty query if new recipe)

</script>
<hr size=1 noshade>
<?php 
$query = "";
$query_order = " ORDER BY ingredient_name";
$query_all = "SELECT * FROM {$db_table_ingredients} WHERE ingredient_user = '" . $DB_LINK->addq($SMObj->getUserID(), get_magic_quotes_gpc()) . "' AND";
// Do not display anything if no search has been requested
if (!isset($_REQUEST['search'])) {
    $query = "";
} else {
    // Construct the query
    $query = $query_all;
    if ($_REQUEST['name'] != "") {
        $query .= " ingredient_name LIKE '%" . $DB_LINK->addq($_REQUEST['name'], get_magic_quotes_gpc()) . "%' AND";
    }
    if (isValidID($_REQUEST['location_id'])) {
        $query .= " ingredient_location=" . $DB_LINK->addq($_REQUEST['location_id'], get_magic_quotes_gpc());
    }
    $query = preg_replace("/AND\$/", "", $query);
    // Put the order on the end
    $query .= $query_order;
}
/* ----------------------
		The Query has been made, format and output the values returned from the database
	----------------------*/
if ($query != "") {
    $counter = 0;
    $rc = $DB_LINK->Execute($query);
    DBUtils::checkResult($rc, NULL, NULL, $query);
    // Error check
    # exit if we did not find any matches

<?php

require_once "libraries/head.php";
if (!isLogin()) {
    sendAjaxRedirect("index.php");
}
if (isset($_POST["userid"]) && isset($_POST["newrole"])) {
    if (!isValidID($_POST["userid"]) || !isValidID($_POST["newrole"])) {
        sendAjaxResErr("User or role status invalid!");
    }
    $result = executeChange($_SESSION["userID"], $_POST["userid"], $_POST["newrole"]);
    if ($result === true) {
        sendAjaxResSuc("Change role status successfully!");
    } else {
        sendAjaxResErr($result);
    }
}
function executeChange($currUser, $userid, $newrole)
{
    if ($newrole !== "1" && $newrole !== "2" && $newrole !== "3" && $newrole !== "4") {
        return "Invalid status!";
    }
    $userDAO = new UserDAO();
    $userChan = $userDAO->getUserByID($userid);
    $userCurr = $userDAO->getUserByID($currUser);
    //get current session user
    if ($userCurr->getRole()->getRoleID() !== "1" && $userCurr->getRole()->getRoleID() !== "2") {
        return "You have no right to change user status!";
    }
    if ($userChan === null) {
        //database