PHP pg_escape_string函数代码示例

 function upload($database, $userlogin, $file, $maxsize, $extensions)
 {
     if (isset($_FILES[$file]) && $_FILES[$file]['error'] == 0) {
         $upload = false;
         $upload_dest = '../Users/Images/' . $_SESSION['login'] . '.jpg';
         if ($_FILES[$file]['size'] <= $maxsize) {
             $infosfichier = pathinfo($_FILES[$file]['name']);
             $extension_upload = $infosfichier['extension'];
             if (in_array($extension_upload, $extensions)) {
                 $upload = move_uploaded_file($_FILES[$file]['tmp_name'], $upload_dest);
             }
         } else {
             $msg = "<span class=\"red\">Photo volumineuse</span>";
         }
         if ($upload == true) {
             $photo = pg_escape_string($upload_dest);
             $query_photo = pg_query($database, "UPDATE users SET photo='{$photo}' WHERE login='{$userlogin}'") or die('Échec requête : ' . pg_last_error());
             if ($query_photo != false) {
                 $msg = "Envoi du fichier \"" . $_FILES[$file]['name'] . "\" r&eacute;ussi";
             } else {
                 $msg = "Photo envoy&eacute;e mais non ajout&eacute; &agrave; la base";
             }
             pg_free_result($query_photo);
         } else {
             $msg = "<span class=\"red\">Envoi du fichier \"" . $_FILES[$file]['name'] . "\" &eacute;chou&eacute;</span>";
         }
     } else {
         $msg = "Photo de profil supprim&eacute;e";
     }
     return $msg;
 }

 function Q($sql, $str = false)
 {
     if ($str == false && !is_integer($sql)) {
         $value = -1;
     }
     return pg_escape_string($sql);
 }

 function check_str($string, $trim = true)
 {
     global $db_type, $db;
     //when code in db is urlencoded the ' does not need to be modified
     if ($db_type == "sqlite") {
         if (function_exists('sqlite_escape_string')) {
             $string = sqlite_escape_string($string);
         } else {
             $string = str_replace("'", "''", $string);
         }
     }
     if ($db_type == "pgsql") {
         $string = pg_escape_string($string);
     }
     if ($db_type == "mysql") {
         if (function_exists('mysql_real_escape_string')) {
             $tmp_str = mysql_real_escape_string($string);
         } else {
             $tmp_str = mysqli_real_escape_string($db, $string);
         }
         if (strlen($tmp_str)) {
             $string = $tmp_str;
         } else {
             $search = array("", "\n", "\r", "\\", "'", "\"", "");
             $replace = array("\\x00", "\\n", "\\r", "\\\\", "\\'", "\\\"", "\\");
             $string = str_replace($search, $replace, $string);
         }
     }
     $string = $trim ? trim($string) : $string;
     return $string;
 }

function fnSanitizePost($data, $sdb = "PG")
{
    //escapes,strips and trims all members of the post array
    if (is_array($data)) {
        $areturn = array();
        foreach ($data as $skey => $svalue) {
            $areturn[$skey] = fnSanitizePost($svalue);
        }
        return $areturn;
    } else {
        if (!is_numeric($data)) {
            //with magic quotes on, the input gets escaped twice, we want to avoid this.
            if (get_magic_quotes_gpc()) {
                $data = stripslashes($data);
            }
            //escapes a string for insertion into the database
            switch ($sdb) {
                case "MySQL":
                    $data = mysql_real_escape_string($data);
                    break;
                case "PG":
                    $data = pg_escape_string($data);
                    break;
            }
            $data = strip_tags($data);
            //strips HTML and PHP tags from a string
        }
        $data = trim($data);
        //trims whitespace from beginning and end of a string
        return $data;
    }
}

 function escape_string($s, $strip_tags = true)
 {
     if ($strip_tags) {
         $s = strip_tags($s);
     }
     return pg_escape_string($s);
 }

 protected function processValid()
 {
     global $cfg;
     $db = Database::getInstance($cfg['DPS']['dsn']);
     if (is_numeric($this->fieldData['resultCount'])) {
         if ($this->fieldData['submit'] == 'Clear List') {
             for ($i = 0; $i < $this->fieldData['resultCount']; $i++) {
                 $cb = 'checkbox_' . $i;
                 $id = 'trackID_' . $i;
                 if (is_numeric(pg_escape_string($this->fieldData[$id])) && pg_escape_string($this->fieldData[$id] != "")) {
                     $trUpdate['censor'] = 'f';
                     $trUpdate['flagged'] = 'f';
                     $trWhere = "id = " . pg_escape_string($this->fieldData[$id]);
                     $db->update('audio', $trUpdate, $trWhere, true);
                 }
             }
         } else {
             for ($i = 0; $i < $this->fieldData['resultCount']; $i++) {
                 $cb = 'checkbox_' . $i;
                 $id = 'trackID_' . $i;
                 if ($this->fieldData[$cb] == "on" && is_numeric(pg_escape_string($this->fieldData[$id])) && pg_escape_string($this->fieldData[$id] != "")) {
                     $trUpdate['censor'] = 't';
                     $trUpdate['flagged'] = 'f';
                     $trWhere = "id = " . pg_escape_string($this->fieldData[$id]);
                     $db->update('audio', $trUpdate, $trWhere, true);
                 }
             }
         }
     }
 }

 protected function processValid()
 {
     global $cfg;
     $db = Database::getInstance($cfg['DPS']['dsn']);
     $audio = $this->fieldData['audioID'];
     $style = $this->fieldData['style'];
     $AwWall = $this->fieldData['awwallID'];
     $AwItemPos = $this->fieldData['awitemPos'];
     $text = "";
     $subStr = explode("\n", $_POST["text"]);
     foreach ($subStr as $value) {
         $text = $text . pg_escape_string($value) . "\n";
     }
     $text = rtrim($text, "\n");
     if ($text != '' && $audio != '' && is_numeric($audio)) {
         $sql = "SELECT COUNT(*) FROM aw_items, aw_walls \n\t\t\t\tWHERE aw_walls.id = aw_items.wall_id\n\t\t\t\tAND aw_walls.id = " . pg_escape_string($AwWall) . " \n\t\t\t\tAND aw_items.item = " . pg_escape_string($AwItemPos);
         $count = $db->getOne($sql);
         if ($count == 0) {
             $AwItem = array();
             $AwItem['text'] = $text;
             $AwItem['audio_id'] = $audio;
             $AwItem['style_id'] = $style;
             $AwItem['wall_id'] = $AwWall;
             $AwItem['item'] = $AwItemPos;
             $db->insert('aw_items', $AwItem, true);
         } else {
             //do error stuff
         }
     }
 }

function FetchLogs($channel)
{
    $html = "";
    $c = 0;
    $logs = array();
    $display_joins = isset($_GET['data']);
    if ($display_joins) {
        $sql = "SELECT * FROM logs WHERE channel = '" . pg_escape_string($channel) . "' and time > to_timestamp( '" . pg_escape_string($_GET["start"] . " 00:00:00") . "', 'MM/DD/YYYY HH24:MI:SS' ) and time < to_timestamp( '" . pg_escape_string($_GET["end"] . " 23:59:59") . "', 'MM/DD/YYYY HH24:MI:SS' ) order by time asc;";
    } else {
        $sql = "SELECT * FROM logs WHERE channel = '" . pg_escape_string($channel) . "' and time > to_timestamp( '" . pg_escape_string($_GET["start"] . " 00:00:00") . "', 'MM/DD/YYYY HH24:MI:SS' ) and time < to_timestamp( '" . pg_escape_string($_GET["end"] . " 23:59:59") . "', 'MM/DD/YYYY HH24:MI:SS' ) and type = 0 order by time asc;";
    }
    $query = pg_query($sql);
    if (!$query) {
        die('SQL failure: ' . pg_last_error());
    }
    while ($item = pg_fetch_assoc($query)) {
        $logs[] = $item;
        $c++;
    }
    if ($c == 0) {
        return "No logs found, try a different filter";
    }
    $html .= "<p>Displaying {$c} items:</p>\n";
    if (isset($_GET["wiki"])) {
        $html .= LogsWiki::Render2($logs);
    } else {
        $html .= LogsHtml::RenderLogs($logs);
    }
    return $html;
}

 function DDLB_Choices($Name = 'page_size', $selected = '', $ChoiceSuffix = '')
 {
     # return the HTML which forms a dropdown list box.
     # optionally, select the item identified by $selected.
     $Debug = 0;
     $HTML = '<select name="' . htmlentities($Name);
     $HTML .= '" title="select a page size"';
     $HTML .= ">\n";
     if ($Debug) {
         echo "{$NumRows} rows found!<br>";
         echo "selected = '{$selected}'<br>";
     }
     foreach ($this->Choices as $choice => $value) {
         $HTML .= '<option value="' . htmlspecialchars(pg_escape_string($value)) . '"';
         if ($value == $selected) {
             $HTML .= ' selected';
         }
         $HTML .= '>' . htmlspecialchars(pg_escape_string($choice));
         if ($ChoiceSuffix) {
             $HTML .= ' ' . htmlspecialchars(pg_escape_string($ChoiceSuffix));
         }
         $HTML .= "</option>\n";
     }
     $HTML .= '</select>';
     return $HTML;
 }

 function CreateHTML()
 {
     global $freshports_CommitMsgMaxNumOfLinesToShow;
     if (isset($this->Filter)) {
         $sql = "select * from LatestCommitsFiltered({$this->MaxNumberOfPorts}, {$this->UserID}, '" . pg_escape_string($this->Filter) . "')";
     } else {
         #			$sql = "select * from LatestCommits($this->MaxNumberOfPorts, $this->UserID)";
         $sql = "\n  SELECT LC.*, STF.message AS stf_message\n    FROM LatestCommits({$this->MaxNumberOfPorts}, 0, '" . pg_escape_string($this->BranchName) . "') LC LEFT OUTER JOIN sanity_test_failures STF\n      ON LC.commit_log_id = STF.commit_log_id\nORDER BY LC.commit_date_raw DESC, LC.category, LC.port, element_pathname";
     }
     if ($this->Debug) {
         echo "\n<p>sql={$sql}</p>\n";
     }
     $result = pg_exec($this->dbh, $sql);
     if (!$result) {
         die("read from database failed");
         exit;
     }
     $DisplayCommit = new DisplayCommit($this->dbh, $result);
     $DisplayCommit->Debug = $this->Debug;
     $DisplayCommit->SetDaysMarkedAsNew($this->DaysMarkedAsNew);
     $DisplayCommit->SetUserID($this->UserID);
     $DisplayCommit->SetWatchListAsk($this->WatchListAsk);
     $RetVal = $DisplayCommit->CreateHTML();
     $this->HTML = $DisplayCommit->HTML;
     return $RetVal;
 }

 public function quote($string, $withQuotes = true)
 {
     if (!is_scalar($string) && !is_null($string) && (!is_object($string) || !method_exists($string, '__toString'))) {
         throw new Exception('Trying to quote "' . gettype($string) . '". Value: "' . var_export($string, true) . '"');
     }
     return $withQuotes ? "'" . pg_escape_string($string) . "'" : pg_escape_string($string);
 }

 function Add($UserID, $CommitLogID)
 {
     #
     # Add an item to the list
     #
     #
     # make sure we don't report the duplicate entry error when adding...
     #
     $PreviousReportingLevel = error_reporting(E_ALL ^ E_WARNING);
     #
     # The subselect ensures the user can only add things to their
     # own watch list
     #
     $sql = "\nINSERT INTO {$this->_TableName}\nSELECT {$UserID} as user_id, \n\t   (SELECT id from commit_log where message_id = '" . pg_escape_string($CommitLogID) . "') as commit_log_id\n WHERE not exists (\n    SELECT T.user_id, T.commit_log_id\n      FROM {$this->_TableName} T\n     WHERE T.user_id       = {$UserID}\n       AND T.commit_log_id = (SELECT id from commit_log where message_id = '" . pg_escape_string($CommitLogID) . "'))";
     if ($this->_Debug) {
         echo "<pre>{$sql}</pre>";
     }
     $result = pg_exec($this->dbh, $sql);
     if ($result) {
         $return = 1;
     } else {
         # If this isn't a duplicate key error, then break
         if (stristr(pg_last_error(), "Cannot insert a duplicate key") == '') {
             $return = -1;
         } else {
             $return = 1;
         }
     }
     error_reporting($PreviousReportingLevel);
     return $return;
 }

 public static function _run($xml, $conn_pg)
 {
     global $user_maclabel;
     $table = array();
     $data = array();
     foreach ($xml->children() as $k => $v) {
         if (!isset($table[$k])) {
             $table[$k] = array();
         }
         if (!isset($data[$k])) {
             $data[$k] = array();
         }
         $assoc = array();
         foreach ($v->children() as $r => $c) {
             $d = (string) $c;
             if ($d !== '') {
                 if (is_numeric($d)) {
                     $d = floatval($d);
                     if (!isset($table[$k][$r])) {
                         $table[$k][$r] = 'float';
                     }
                 } else {
                     $table[$k][$r] = 'varchar(255)';
                 }
             }
             if ($d !== '') {
                 $assoc[$r] = "'" . pg_escape_string($d) . "'";
             }
         }
         $data[$k][] = $assoc;
     }
     //ooo, how much memory is used here...
     foreach ($table as $k => $v) {
         $mod = "";
         if ($user_maclabel) {
             $mod .= "ALTER TABLE {$k} SET MAC TO NULL; ALTER TABLE {$k} DISABLE COLUMN MACS;";
         }
         $mod .= "DROP TABLE IF EXISTS {$k}; CREATE TABLE {$k} ( ";
         foreach ($v as $col => $typ) {
             if ($col != 'maclabel') {
                 $mod .= "\"{$col}\" {$typ},";
             }
         }
         $mod .= "CHECK(TRUE))";
         $mod .= ($_POST['mac_records'] ? " WITH (MACS = true)" : "") . ";";
         if ($_POST['mac_columns']) {
             $mod .= "ALTER TABLE {$k} ENABLE COLUMN MACS;";
         }
         pg_query($conn_pg, $mod) or die("error on query " . pg_last_error($conn_pg));
     }
     foreach ($data as $k => $t) {
         pg_query($conn_pg, "BEGIN;");
         foreach ($t as $v) {
             $ins = "INSERT INTO {$k} ( " . implode(",", array_keys($v)) . ") VALUES (" . implode(",", array_values($v)) . ");";
             pg_query($conn_pg, $ins) or die("error on query " . pg_last_error($conn_pg));
         }
         pg_query($conn_pg, "ANALYZE {$k};");
         pg_query($conn_pg, "COMMIT;");
     }
 }

 function Fetch()
 {
     $sql = "\n\t\tSELECT DISTINCT\n\t\t\tcommit_log.commit_date - SystemTimeAdjust()        AS commit_date_raw,\n\t\t\tcommit_log.id                                      AS commit_log_id,\n\t\t\tcommit_log.encoding_losses                         AS encoding_losses,\n\t\t\tcommit_log.message_id                              AS message_id,\n\t\t\tcommit_log.committer                               AS committer,\n\t\t\tcommit_log.description                             AS commit_description,\n\t\t\tto_char(commit_log.commit_date - SystemTimeAdjust(), 'DD Mon YYYY')  AS commit_date,\n\t\t\tto_char(commit_log.commit_date - SystemTimeAdjust(), 'HH24:MI')      AS commit_time,\n\t\t\tNULL                                               AS port_id,\n\t\t\tNULL                                               AS category,\n\t\t\tNULL                                               AS category_id,\n\t\t\tNULL                                               AS port,\n\t\t\telement_pathname(element.id)                       AS pathname,\n\t\t\tNULL AS version,\n\t\t\tcommit_log_elements.revision_name AS revision,\n\t\t\tNULL AS epoch,\n\t\t\telement.status                                     AS status,\n\t\t\tNULL AS needs_refresh,\n\t\t\tNULL                                               AS forbidden,\n\t\t\tNULL                                               AS broken,\n\t\t\tNULL                                               AS deprecated,\n\t\t\tNULL                                               AS ignore,\n\t\t\tNULL                                               AS expiration_date,\n\t\t\tNULL                                               AS date_added,\n\t\t\tNULL                                               AS element_id,\n\t\t\tNULL                                               AS short_description,\n\t\t\tNULL                                               AS stf_message";
     if ($this->UserID) {
         $sql .= ",\n\t        onwatchlist ";
     }
     $sql .= "\n    FROM commit_log, commit_log_elements, element ";
     if ($this->UserID) {
         $sql .= "\n\t      LEFT OUTER JOIN\n\t (SELECT element_id as wle_element_id, COUNT(watch_list_id) as onwatchlist\n\t    FROM watch_list JOIN watch_list_element \n\t        ON watch_list.id      = watch_list_element.watch_list_id\n\t       AND watch_list.user_id = " . $this->UserID . "\n\t       AND watch_list.in_service\t\t\n\t  GROUP BY wle_element_id) AS TEMP\n\t       ON TEMP.wle_element_id = element.id";
     }
     $sql .= "\n\t  WHERE commit_log.id IN (SELECT tmp.id FROM (SELECT DISTINCT CL.id, CL.commit_date\n  FROM commit_log CL\n WHERE CL.committer  = '" . pg_escape_string($this->Committer) . "'\nORDER BY CL.commit_date DESC ";
     if ($this->Limit) {
         $sql .= " LIMIT " . $this->Limit;
     }
     if ($this->Offset) {
         $sql .= " OFFSET " . $this->Offset;
     }
     $sql .= ")as tmp)\n\t    AND commit_log_elements.commit_log_id = commit_log.id\n\t    AND commit_log_elements.element_id    = element.id\n   ORDER BY 1 desc,\n\t\t\tcommit_log_id";
     if ($this->Debug) {
         echo '<pre>' . $sql . '</pre>';
     }
     $this->LocalResult = pg_exec($this->dbh, $sql);
     if ($this->LocalResult) {
         $numrows = pg_numrows($this->LocalResult);
         if ($this->Debug) {
             echo "That would give us {$numrows} rows";
         }
     } else {
         $numrows = -1;
         echo 'pg_exec failed: ' . "<pre>{$sql}</pre>";
     }
     return $numrows;
 }

function search_db($netid)
{
    global $dbfields;
    if (!preg_match("/\\A[a-z]{3}([0-9]*)\\Z/i", $netid)) {
        return array();
    }
    init_db();
    $query = "select * from users where netid='" . pg_escape_string($netid) . "'";
    $result = pg_query($query);
    $present = pg_fetch_array($result, null, PGSQL_ASSOC);
    if ($present == null) {
        return array();
    }
    $person = new Person($netid);
    pg_free_result($result);
    foreach ($dbfields as $f) {
        $query = "select * from " . $f . " where netid='" . pg_escape_string($netid) . "'";
        $result = pg_query($query);
        while ($line = pg_fetch_array($result, null, PGSQL_ASSOC)) {
            $value = $line[$f];
            if ($line["ldap"] === "f") {
                $person->db_fields[$f][] = $value;
            } else {
                $person->ldap_fields[$f][] = $value;
            }
        }
        pg_free_result($result);
    }
    $person->refresh_db();
    return array($person);
}