PHP mysql_escape函数代码示例

function check_time($string)
{
    $time = array('0', '1', '2', '3');
    if (!in_array($string, $time)) {
        exit('出错');
    }
    return mysql_escape($string);
}

/**
* TestGuestVersion1.0
* ================================================
* Copy 2010-2012yc60
* Web: http://www.yc60.com
* ================================================
* Author: Lee
* Date: 2012-9-17
*/
function check_content($string)
{
    $string = htmlspecialchars(mysql_escape(trim($string)));
    if (mb_strlen($string, 'utf-8') < 10 || mb_strlen($string, 'utf-8') > 200) {
        //判断输入的用户名长度是否合格
        alert('信心内容不得少于10个字符，请重新输入');
    }
    return $string;
}

function check_post_contenr($string, $min)
{
    $string = trim($string);
    if (mb_strlen($string, 'utf-8') < $min) {
        //判断输入的用户名长度是否合格
        alert('发帖内容长度不得小于' . $min . '位');
        exit;
    }
    return mysql_escape($string);
}

    function editFormHtml($record)
    {
        global $TABLE_PREFIX, $tableName;
        $calendarTable = $TABLE_PREFIX . "_datecalendar";
        // get dates
        $dates = array();
        $date = getdate();
        $monthNum = $date['mon'];
        $year = $date['year'];
        $firstMonth = sprintf("%04d%02d%02d", $year, $monthNum, '01');
        for ($i = 1; $i <= 12; $i++) {
            $dates[] = array('year' => $year, 'monthNum' => $monthNum);
            if (++$monthNum > 12) {
                $year++;
                $monthNum = 1;
            }
        }
        $lastMonth = sprintf("%04d%02d%02d", $year, $monthNum, '01');
        // load dates from database
        $selectedDates = array();
        $query = "SELECT DATE_FORMAT(date, '%Y%m%d') as date FROM `{$calendarTable}` ";
        $query .= "WHERE `tablename` = '{$tableName}' ";
        $query .= "  AND `fieldname` = '{$this->name}' ";
        $query .= "  AND `recordNum` = '" . mysql_escape($_REQUEST['num']) . "' ";
        $query .= "  AND '{$firstMonth}' <= `date` AND `date` <= '{$lastMonth}'";
        $result = mysql_query($query) or die("MySQL Error: " . htmlencode(mysql_error()) . "\n");
        while ($row = mysql_fetch_assoc($result)) {
            $selectedDates[$row['date']] = 1;
        }
        if (is_resource($result)) {
            mysql_free_result($result);
        }
        // get calendar HTML
        $calendarHtml = '';
        foreach ($dates as $date) {
            $calendarHtml .= _createEditCalendar($date['monthNum'], $date['year'], $selectedDates);
        }
        // display field
        print <<<__HTML__
   <tr>
    <td valign="top">{$this->label}</td>
    <td>{$calendarHtml}</td>
   </tr>
__HTML__;
    }

function saveUploadDetails()
{
    global $TABLE_PREFIX;
    security_dieUnlessPostForm();
    security_dieUnlessInternalReferer();
    security_dieOnInvalidCsrfToken();
    // update uploads
    if (is_array(@$_REQUEST['uploadNums'])) {
        foreach ($_REQUEST['uploadNums'] as $uploadNum) {
            if (!$uploadNum) {
                die(__FUNCTION__ . ": No upload num specified!");
            }
            $query = "UPDATE `{$TABLE_PREFIX}uploads`\n";
            $query .= "   SET info1 = '" . mysql_escape(@$_REQUEST["{$uploadNum}_info1"]) . "',\n";
            $query .= "       info2 = '" . mysql_escape(@$_REQUEST["{$uploadNum}_info2"]) . "',\n";
            $query .= "       info3 = '" . mysql_escape(@$_REQUEST["{$uploadNum}_info3"]) . "',\n";
            $query .= "       info4 = '" . mysql_escape(@$_REQUEST["{$uploadNum}_info4"]) . "',\n";
            $query .= "       info5 = '" . mysql_escape(@$_REQUEST["{$uploadNum}_info5"]) . "'\n";
            $query .= " WHERE num = '" . mysql_escape($uploadNum) . "' AND ";
            if ($_REQUEST['num']) {
                $query .= "recordNum     = '" . mysql_escape($_REQUEST['num']) . "'";
            } else {
                if ($_REQUEST['preSaveTempId']) {
                    $query .= "preSaveTempId = '" . mysql_escape($_REQUEST['preSaveTempId']) . "'";
                } else {
                    die("No value specified for 'num' or 'preSaveTempId'!");
                }
            }
            mysql_query($query) or die("MySQL Error: " . htmlencode(mysql_error()) . "\n");
        }
    }
    //
    print "<script type='text/javascript'>self.parent.reloadIframe('{$_REQUEST['fieldName']}_iframe')</script>";
    // reload uploadlist
    print "<script type='text/javascript'>self.parent.tb_remove();</script>\n";
    // close thickbox
    exit;
}

 public function activation()
 {
     if (!empty($_GET['activation']) && isset($_GET['activation'])) {
         $code = mysql_escape($_GET['activation']);
         $user_count = User::where('activation', $code)->count();
         $User = User::where('activation', '=', $code)->firstOrFail();
         if ($user_count > 0) {
             $count = DB::table('users')->where('activation', $code)->where('status', '0')->count();
             if ($count == 1) {
                 $db_res = DB::table('users')->where('activation', $code)->update(array('status' => 1));
                 if ($db_res == 1) {
                     Auth::login($User);
                     return View::make('register/activation_to_resumes');
                     //return Redirect::to('/')->with('message','您的账号已经激活');
                 }
             } else {
                 return Redirect::to('ow_login')->with('message', '您的账号已经激活无需再次激活!');
             }
         } else {
             return Redirect::to('ow_register')->with('message', '您的账号存在');
         }
     }
 }

<?php

require "globals.php";
$search = mysql_escape($_POST['search']);
$page = mysql_escape($_POST['page']);
if ($search == "") {
    echo "<h1>Search Games</h1><center>Please type in the most accurate game title description to find your favourite games.<br>\n<form action=flashsearchdos.php?page=search method=post>Game Title: <input type=text name=search> <input type=submit value='Search'></form></center>";
} else {
    // Strip HTML tags
    $search = strip_tags($search);
    // Find games
    $sql = "SELECT game FROM flash2 WHERE game LIKE '%{$search}%' ORDER BY game DESC LIMIT 10";
    $countmatches = mysql_num_rows(mysql_query("{$sql}"));
    $findgames = mysql_query("SELECT imagename,game,id FROM flash2 WHERE game LIKE '%{$search}%' ORDER BY game DESC LIMIT 10");
    echo "<center><h1>Search Results</h1>\nWe have found {$countmatches} matches for your search results. The more specific the search phrase, the better your results will be.<br><br>\n\n<table border=0 cellspacing=10 cellpadding=0 border=0><tr>";
    $counter = 0;
    while ($game = mysql_fetch_array($findgames)) {
        // Next row
        if ($counter == 3) {
            echo "</tr><tr>";
            // Reset counter
            $counter = 0;
        }
        echo "<td><table>\n<tr>\n<td>\n<font size=1><a href=game.php?id={$game['id']} title=\"{$game['game']}\"><center>\n<img src=/arcadefiles/{$game['imagename']} height=60 width=60></a><br />\n<li><a href=game.php?id={$game['id']} title=\"{$game['game']}\">{$game['game']}</center></a>\n<li><a href=highscores.php?id={$game['id']}>View High Scores</a></center>\n</font></td>\n</tr>\t\t\t\t\t\t\n</table></td>";
        $counter++;
    }
    echo "</tr></table>";
}
print "<br /><br />";
$h->endpage();

<link rel="shortcut icon" href="images/favicon.ico" />
</head>
<body>
<?php 
define('IN_TG', true);
require dirname(__FILE__) . '/includes/global.fun.php';
//引进数据库连接文件
require dirname(__FILE__) . '/includes/conn.inc.php';
require dirname(__FILE__) . '/includes/common.inc.php';
require dirname(__FILE__) . '/includes/header.inc.php';
if (!isset($_GET['active'])) {
    //防止直接调用“active页面”
    location('非法操作', 'index.php');
}
if (isset($_GET['action']) && isset($_GET['active']) && $_GET['action'] == 'ok') {
    $active = mysql_escape($_GET['active']);
    //首先进行转义
    mysql_query("UPDATE user SET active=NULL WHERE active='{$active}' LIMIT 1");
    //将active字段设置为空
    if (mysql_affected_rows() == 1) {
        location('激活成功', 'index.php');
    } else {
        location('激活失败', 'register.php');
    }
}
?>
<div id="active">
<h2>激活页面</h2>
<p>点击一下链接进行激活</p>
<p><a href="active.php?action=ok&amp;active=<?php 
echo $_GET['active'];

    if (!isset($_POST['url'])) {
        if ($bgfixed == 1) {
            $bgfixedcheck = "checked";
        } else {
            $bgfixedcheck = "";
        }
        if ($bgcenter == "center") {
            $bgcentercheck = "checked";
        } else {
            $bgcentercheck = "";
        }
        if ($bgcover == 1) {
            $bgcovercheck = "checked";
        } else {
            $bgcovercheck = "";
        }
        echo "<h2 class=\"text-left\">Site Background</h2><hr/>\n\t\t<p>Many sites have a background to make the website more personalized. There is not a default image size, but you may want to play around with some sizes to see what you like.</p>\n\t\t<p>To upload an image, please go to <a href=\"http://www.imgur.com\">imgur.com</a>, and then enter in the image url below. The URL will look like this: i.imgur.com/abcdefghi.jpg. Of course, you may use any other website to host your image.</p><hr/>\n\t\t<form method=\"post\">\n\t\t\t<div class=\"form-group\">\n\t\t\t\t<label for=\"inputURL\">Background URL</label>\n\t\t\t\t<input type=\"text\" class=\"form-control\" name=\"url\" id=\"inputURL\" placeholder=\"Enter image URL\" value=\"" . $background . "\">\n\t\t\t</div>\n\t\t\t<div class=\"form-group\">\n\t\t\t\t<label for=\"inputURL\">Background Color (Hex)</label>\n\t\t\t\t<input type=\"text\" class=\"form-control color\" name=\"bgcolor\" id=\"inputURL\" placeholder=\"Enter Background Color\" value=\"" . $bgcolor . "\">\n\t\t\t\t<span class=\"help-block\">Your background color must look like this: 000000<br/>To look up hex colors, click the input box above.</span>\n\t\t\t</div>\n\t\t\t<div class=\"form-group\">\n\t\t\t\t<label for=\"repeatStyle\">Background Repeat</label>\n\t\t\t\t<select class=\"form-control\" name=\"bgrepeat\" id=\"repeatStyle\">\n\t\t\t\t\t<option value=\"no-repeat\">No Repeat</option>\n\t\t\t\t\t<option value=\"repeat\">Repeat Both Directions</option>\n\t\t\t\t\t<option value=\"repeat-x\">Repeat Horizontally</option>\n\t\t\t\t\t<option value=\"repeat-y\">Repeat Vertically</option>\n\t\t\t\t</select>\n\t\t\t\t<span class=\"help-block\">Background images can repeat horizontally, vertically, both, or none.</span>\n\t\t\t</div>\n\t\t\t<div class=\"checkbox\">\n\t\t\t\t<label>\n\t\t\t\t\t<input type=\"checkbox\" name=\"bgcenter\" value=\"1\" {$bgcentercheck}>Center Background (Yes)\n\t\t\t\t</label>\n\t\t\t</div>\n\t\t\t<span class=\"help-block\">Background images can be centered.</span>\n\t\t\t<div class=\"checkbox\">\n\t\t\t\t<label>\n\t\t\t\t\t<input type=\"checkbox\" name=\"bgfixed\" value=\"1\" {$bgfixedcheck}>Fixed Background (Yes)\n\t\t\t\t</label>\n\t\t\t</div>\t\t\t\t\n\t\t\t<span class=\"help-block\">Background images can be fixed (won&#39;t scroll).</span>\n\t\t\t<div class=\"checkbox\">\n\t\t\t\t<label>\n\t\t\t\t\t<input type=\"checkbox\" name=\"bgcover\" value=\"1\" {$bgcovercheck}>Fit Background to Screen (Yes)\n\t\t\t\t</label>\n\t\t\t</div>\t\t\t\t\n\t\t\t<span class=\"help-block\">Background images can be resized to fit the browser window.</span>\n\t\t\t<hr/>\n\t\t\t<button type=\"submit\" class=\"btn btn-primary\" required>Submit &raquo;</button>\n\t\t</form>\n\t\t";
    } else {
        $url = mysql_escape($_POST["url"]);
        $bgcolor = mysql_escape($_POST["bgcolor"]);
        $bgrepeat = mysql_escape($_POST["bgrepeat"]);
        $bgcenter = mysql_escape(isset($_POST["bgcenter"]));
        $bgfixed = mysql_escape(isset($_POST["bgfixed"]));
        $bgcover = mysql_escape(isset($_POST["bgcover"]));
        $mysqli->query("UPDATE " . $prefix . "properties SET background = '{$url}', bgcolor = '{$bgcolor}', bgrepeat = '{$bgrepeat}', bgcenter = '{$bgcenter}', bgfixed = '{$bgfixed}', bgcover = '{$bgcover}'");
        echo "<div class=\"alert alert-success\">Successfully updated background.</div>";
        redirect_wait5("?base=admin&page=background");
    }
} else {
    redirect("?base");
}

function incrementCounterField($tablename, $fieldname, $recordNumber)
{
    global $VIEWER_NAME;
    // error checking
    if (!$tablename) {
        die(__FUNCTION__ . ": No 'tablename' value specified!");
    }
    if (!$fieldname) {
        die(__FUNCTION__ . ": No 'fieldname' value specified!");
    }
    if (!$recordNumber) {
        die(__FUNCTION__ . ": No 'recordNumber' value specified!");
    }
    // update counter
    $escapedTableName = mysql_escape(getTableNameWithPrefix($tablename));
    $query = "UPDATE `{$escapedTableName}` SET `{$fieldname}` = IFNULL(`{$fieldname}`,0) + 1";
    $query .= " WHERE `num` = '" . mysql_escape($recordNumber) . "'";
    $result = @mysql_query($query);
    if (!$result) {
        die(__FUNCTION__ . " MySQL Error: " . htmlencode(mysql_error()) . "\n");
    }
    if (!mysql_affected_rows()) {
        die(__FUNCTION__ . ": Couldn't find record '" . htmlencode($recordNumber) . "'!");
    }
}

    die("403 - Access Forbidden");
}
if ($_SESSION['id']) {
    echo "\n\t\t<h2 class=\"text-left\">Account Settings</h2><hr/>";
    if (!isset($_POST['modify'])) {
        $query = $mysqli->query("SELECT * FROM `accounts` WHERE `id`='" . $_SESSION['id'] . "'") or die(mysql_error());
        $row = $query->fetch_assoc();
        echo "\n\t\t<div class=\"alert alert-warning\">If you want to keep your current password, leave the password fields blank! <a class=\"close\" data-dismiss=\"alert\" href=\"#\" aria-hidden=\"true\">&times;</a></div>\n\t\t<form method=\"post\" role=\"form\">\n\t\t\t<b><abbr title=\"You can't change this!\">Username</abbr></b>\n\t\t\t\t" . $row['name'] . "\n\t\t<div class=\"form-group\">\n\t\t\t<label for=\"cPassword\">Current Password</label>\n\t\t\t<input type=\"password\" class=\"form-control\" id=\"cPassword\" placeholder=\"Current Password\" name=\"current\" />\n\t\t</div>\n\t\t<div class=\"form-group\">\n\t\t\t<label for=\"nPassword\">New Password</label>\n\t\t\t<input type=\"password\" class=\"form-control\" id=\"nPassword\" placeholder=\"New Password\" name=\"password\" />\n\t\t</div>\n\t\t<div class=\"form-group\">\n\t\t\t<label for=\"coPassword\">Confirm Password</label>\n\t\t\t<input type=\"password\" class=\"form-control\" id=\"coPassword\" placeholder=\"Confirm Password\" name=\"copassword\" />\n\t\t</div>\n\t\t<div class=\"form-group\">\n\t\t\t<label for=\"Email\">Email</label>\n\t\t\t<input type=\"email\" class=\"form-control\" id=\"Email\" placeholder=\"email@dot.com\" maxlength=\"50\" name=\"email\" value=\"" . $row['email'] . "\" />\n\t\t</div>\n\t\t<div class=\"form-group\">\n\t\t\t<label for=\"Birthday\">Birthday</label>\n\t\t\t<input type=\"text\" class=\"form-control\" id=\"Birthday\" placeholder=\"1990-01-01\" name=\"birth\" value=\"" . $row['birthday'] . "\" />\n\t\t</div>\n\t\t\t<input type=\"submit\" name=\"modify\" class=\"btn btn-primary\" value=\"Modify &raquo;\" />\n\t\t</form><br/>";
    } else {
        $u = $mysqli->query("SELECT * FROM `accounts` WHERE `id`='" . $_SESSION['id'] . "'") or die;
        $userz = $u->fetch_assoc();
        $current = mysql_escape($_POST['current']);
        $pass = mysql_escape($_POST['password']);
        $cpass = mysql_escape($_POST['copassword']);
        $email = mysql_escape($_POST['email']);
        $birth = mysql_escape($_POST['birth']);
        if ($current) {
            if ($userz['password'] == hash('sha512', $current . $userz['salt']) || sha1($current) == $userz['password']) {
                if ($pass != $cpass) {
                    echo "<div class=\"alert alert-danger\">Passwords do not match.</div>";
                } else {
                    if (strlen($pass) < 6) {
                        echo "<div class=\"alert alert-danger\">Your password must be between 6 and 12 characters.</div>";
                    } elseif (strlen($pass) > 12) {
                        echo "<div class=\"alert alert-danger\">Your password must be between 6 and 12 characters.</div>";
                    } else {
                        $u = $mysqli->query("UPDATE `accounts` SET `password`='" . sha1($pass) . "',`salt`=NULL WHERE `name`='" . $userz['name'] . "'") or die;
                        echo "<div class=\"alert alert-success\">Your changes have successfully been saved.</div>";
                    }
                }
            } else {

function recache_forum($forum)
{
    global $ir, $c, $userid, $h, $db;
    global $db;
    $q = $db->query("SELECT p.*,t.* FROM forum_posts p LEFT JOIN forum_topics t ON p.fp_topic_id=t.ft_id WHERE p.fp_forum_id={$forum} ORDER BY p.fp_time DESC LIMIT 1");
    if (!$db->num_rows($q)) {
        $db->query("update forum_forums set ff_lp_time=0, ff_lp_poster_id=0, ff_lp_poster_name='N/A', ff_lp_t_id=0, ff_lp_t_name='N/A',ff_posts=0, ff_topics=0 where ff_id={$forum}");
    } else {
        $r = $db->fetch_row($q);
        $tn = mysql_escape($r['ft_name']);
        $pn = mysql_escape($r['fp_poster_name']);
        $posts = $db->num_rows($db->query("SELECT fp_id FROM forum_posts WHERE fp_forum_id={$forum}"));
        $topics = $db->num_rows($db->query("SELECT ft_id FROM forum_topics WHERE ft_forum_id={$forum}"));
        $db->query("update forum_forums set ff_lp_time={$r['fp_time']}, ff_lp_poster_id={$r['fp_poster_id']}, ff_lp_poster_name='{$pn}', ff_lp_t_id={$r['ft_id']}, ff_lp_t_name='{$tn}',ff_posts={$posts}, ff_topics={$topics} where ff_id={$forum}");
    }
}

function categoryMoveDrag()
{
    global $tableName, $escapedTableName, $isMyAccountMenu;
    if ($isMyAccountMenu) {
        die("Access not permitted for My Account menu!");
    }
    if (!isset($_REQUEST['sourceNum'])) {
        die('sourceNum not set.');
    }
    if (!isset($_REQUEST['targetNum'])) {
        die('targetNum not set.');
    }
    if (!isset($_REQUEST['position'])) {
        die('position not set.');
    }
    $sourceNum = $_REQUEST['sourceNum'];
    $targetNum = $_REQUEST['targetNum'];
    $position = $_REQUEST['position'];
    if (!is_numeric($sourceNum) || !is_numeric($targetNum)) {
        redirectBrowserToURL("?menu={$tableName}", true);
        exit;
    }
    security_dieUnlessPostForm();
    security_dieUnlessInternalReferer();
    security_dieOnInvalidCsrfToken();
    // load categoriesByNum
    $categoriesByNum = array();
    $query = "SELECT * FROM `{$escapedTableName}` ORDER BY globalOrder";
    $result = mysql_query($query) or die("MySQL Error: " . mysql_error() . "\n");
    while ($row = mysql_fetch_assoc($result)) {
        $categoriesByNum[$row['num']] = $row;
        $categoriesByNum[$row['num']]['oldSiblingOrder'] = $row['siblingOrder'];
    }
    if (is_resource($result)) {
        mysql_free_result($result);
    }
    // update order
    $parentNum = $position == 'child' ? $targetNum : $categoriesByNum[$targetNum]['parentNum'];
    // Source cannot be made a child of its decendent.
    $currParentNum = $categoriesByNum[$targetNum]['parentNum'];
    while ($currParentNum) {
        if ($currParentNum == $sourceNum) {
            redirectBrowserToURL("?menu={$tableName}", true);
            exit;
        }
        $currParentNum = $categoriesByNum[$currParentNum]['parentNum'];
    }
    $categoriesByNum[$sourceNum]['parentNum'] = $parentNum;
    foreach (array_keys($categoriesByNum) as $num) {
        $category =& $categoriesByNum[$num];
        if ($category['parentNum'] != $parentNum) {
            continue;
        }
        // only modify siblings on branch
        $category['siblingOrder'] = 2 + $category['siblingOrder'] * 2;
        // double space entries
        unset($category);
    }
    //showme($categoriesByNum[$sourceNum]);
    //showme($categoriesByNum[$targetNum]);
    if ($position == 'child') {
        $categoriesByNum[$sourceNum]['siblingOrder'] = 1;
        // if adding as child, default to first sibling
    } else {
        if ($position == 'above') {
            $categoriesByNum[$sourceNum]['siblingOrder'] = $categoriesByNum[$targetNum]['siblingOrder'] - 1;
        } else {
            if ($position == 'below') {
                $categoriesByNum[$sourceNum]['siblingOrder'] = $categoriesByNum[$targetNum]['siblingOrder'] + 1;
            }
        }
    }
    //showme($categoriesByNum[$sourceNum]);
    //showme($categoriesByNum[$targetNum]);
    // save new sibling order
    foreach ($categoriesByNum as $num => $category) {
        if ($category['oldSiblingOrder'] == $category['siblingOrder']) {
            continue;
        }
        // skip if order didn't change
        $query = "UPDATE `{$escapedTableName}` SET ";
        $query .= "`siblingOrder` = '" . mysql_escape($category['siblingOrder']) . "' ";
        $query .= "WHERE num = '{$category['num']}'";
        //showme($query);
        mysql_query($query) or die("There was an error updating the category metadata:\n\n" . htmlencode(mysql_error()) . "\n");
    }
    //exit;
    // save new parent
    $query = "UPDATE `{$escapedTableName}` SET ";
    $query .= "`parentNum` = '" . mysql_escape($parentNum) . "' ";
    $query .= "WHERE num = '{$sourceNum}'";
    mysql_query($query) or die("There was an error updating the category metadata:\n\n" . htmlencode(mysql_error()) . "\n");
    // update global order, etc
    updateCategoryMetadataDrag();
    // refresh page
    redirectBrowserToURL("?menu={$tableName}", true);
    exit;
}

<?php

if (basename($_SERVER["PHP_SELF"]) == "banner.php") {
    die("403 - Access Forbidden");
}
if ($_SESSION['admin']) {
    if (!isset($_POST['url'])) {
        echo "<h2 class=\"text-left\">Site Banner</h2><hr/>\n\t\t<p>Many sites have a banner at the top of the page to make the website more personalized. There is not a default image size, but you may want to play around with some sizes to see what you like.</p>\n\t\t<p>To upload an image, please go to <a href=\"http://www.imgur.com\">imgur.com</a>, and then enter in the image url below. The URL will look like this: i.imgur.com/abcdefghi.jpg. Of course, you may use any other website to host your image.</p><hr/>\n\t\t<form method=\"post\">\n\t\t\t<div class=\"form-group\">\n\t\t\t\t<label for=\"inputURL\">Banner URL</label>\n\t\t\t\t<input type=\"text\" class=\"form-control\" name=\"url\" id=\"inputURL\" placeholder=\"Enter image URL\" value=\"" . $banner . "\">\n\t\t\t</div>\n\t\t\t<hr/>\n\t\t\t<button type=\"submit\" class=\"btn btn-primary\" required>Submit &raquo;</button>\n\t\t</form>\n\t\t";
    } else {
        $url = mysql_escape($_POST["url"]);
        $mysqli->query("UPDATE " . $prefix . "properties SET banner='{$url}'");
        echo "<div class=\"alert alert-success\">Successfully updated banner.</div>";
        redirect_wait5("?base=admin");
    }
} else {
    redirect("?base");
}

    if (mysql_affected_rows() == 1) {
        close('恭喜你，添加成功，请等待对方同意');
    } else {
        location('很遗憾请求发送失败，请重新发送', '');
    }
    session_destroy();
    mysql_close();
    exit;
    //必须退出，因为此时的id已经不存在，继续往下执行会会错
}
//开始接收数据
if (isset($_GET['id'])) {
    //如果接收到id，那么开始获取收件人！
    $row = mysql_fetch_array(mysql_query("select username from user where id='{$_GET['id']}'")) or die(mysql_error());
    if (isset($row)) {
        $clean_username = mysql_escape($row['username']);
    } else {
        close('用户名不存在');
    }
} else {
    close('非法操作');
}
?>
<div id="head">
	<h3>添加好友</h3>
</div>
<div id="message">
	<form action="friend.php?action=add" method="post">
	<input  type="hidden" name="touser" value="<?php 
echo $clean_username;
?>