PHP protect_data_sql函数代码示例

 static function set($_name, $_value)
 {
     if (isset(self::$grrSettings[$_name])) {
         $sql = "UPDATE " . TABLE_PREFIX . "_setting set VALUE = '" . protect_data_sql($_value) . "' where NAME = '" . protect_data_sql($_name) . "'";
         $res = grr_sql_query($sql);
         if (!$res) {
             return false;
         }
     } else {
         $sql = "INSERT INTO " . TABLE_PREFIX . "_setting set NAME = '" . protect_data_sql($_name) . "', VALUE = '" . protect_data_sql($_value) . "'";
         $res = grr_sql_query($sql);
         if (!$res) {
             return false;
         }
     }
     self::$grrSettings[$_name] = $_value;
     return true;
 }

        $today[$row[0]][$start_t]["data"] = affichage_lien_resa_planning($row[3],$row[4]);
        // Info-bulle
        if (getSettingValue("display_info_bulle") == 1)
            $today[$row[0]][$start_t]["who"] = get_vocab("reservation au nom de").affiche_nom_prenom_email($row[6],$row[11]);
        else if (getSettingValue("display_info_bulle") == 2)
            $today[$row[0]][$start_t]["who"] = $row[8];
        else
            $today[$row[0]][$start_t]["who"] = "";
    }
}
grr_sql_free($res);
# We need to know what all the rooms area called, so we can show them all
# pull the data from the db and store it. Convienently we can print the room
# headings and capacities at the same time

$sql = "select room_name, capacity, id, description, statut_room, show_fic_room, delais_option_reservation, moderate from ".TABLE_PREFIX."_room where area_id='".protect_data_sql($area)."' order by order_display, room_name";
$res = grr_sql_query($sql);

# It might be that there are no rooms defined for this area.
# If there are none then show an error and dont bother doing anything
# else
if (! $res) fatal_error(0, grr_sql_error());
if (grr_sql_count($res) == 0)
{
    echo "<h1>".get_vocab('no_rooms_for_area')."</h1>";
    grr_sql_free($res);
}
else
{
    #This is where we start displaying stuff
    echo "<table cellspacing=\"0\" border=\"1\" width=\"100%\">";

        } else {
            $today[$row['0']][$start_t]["data"] = affichage_lien_resa_planning($row['3'], $row['4']);
            if ($settings->get("display_info_bulle") == 1) {
                $today[$row['0']][$start_t]["who"] = get_vocab("reservation au nom de") . affiche_nom_prenom_email($row['6'], $row['11']);
            } else {
                if ($settings->get("display_info_bulle") == 2) {
                    $today[$row['0']][$start_t]["who"] = $row['8'];
                } else {
                    $today[$row['0']][$start_t]["who"] = "";
                }
            }
        }
    }
}
grr_sql_free($res);
$sql = "SELECT room_name, capacity, id, description, statut_room, show_fic_room, delais_option_reservation, moderate FROM " . TABLE_PREFIX . "_room WHERE area_id='" . protect_data_sql($area) . "' ORDER BY order_display, room_name";
$res = grr_sql_query($sql);
if (!$res) {
    fatal_error(0, grr_sql_error());
}
if (grr_sql_count($res) == 0) {
    echo '<h1>' . get_vocab("no_rooms_for_area") . '</h1>';
    grr_sql_free($res);
} else {
    echo '<div class="row">' . PHP_EOL;
    include "menu_gauche.php";
    if ($_GET['pview'] != 1) {
        echo '<div class="col-lg-9 col-md-12 col-xs-12">' . PHP_EOL;
        echo '<div id="planning">' . PHP_EOL;
    } else {
        echo '<div id="print_planning">' . PHP_EOL;

                 settype($number_periodes, "integer");
                 if ($number_periodes < 1) {
                     $number_periodes = 1;
                 }
                 $del_periode = grr_sql_query("delete from " . TABLE_PREFIX . "_area_periodes where id_area='" . $id_area . "'");
                 #on efface le modele par defaut avec area=0
                 $del_periode = grr_sql_query("delete from " . TABLE_PREFIX . "_area_periodes where id_area='0'");
                 $i = 0;
                 $num = 0;
                 while ($i < $number_periodes) {
                     $temp = "periode_" . $i;
                     if (isset($_POST[$temp])) {
                         $nom_periode = corriger_caracteres($_POST[$temp]);
                         $reg_periode = grr_sql_query("insert into " . TABLE_PREFIX . "_area_periodes set\n\t\t\t\t\t\t\t\tid_area='" . $id_area . "',\n\t\t\t\t\t\t\t\tnum_periode='" . $num . "',\n\t\t\t\t\t\t\t\tnom_periode='" . protect_data_sql($nom_periode) . "'\n\t\t\t\t\t\t\t\t");
                         #on cree un modele par defaut avec area=0
                         $reg_periode = grr_sql_query("insert into " . TABLE_PREFIX . "_area_periodes set\n\t\t\t\t\t\t\t\tid_area='0',\n\t\t\t\t\t\t\t\tnum_periode='" . $num . "',\n\t\t\t\t\t\t\t\tnom_periode='" . protect_data_sql($nom_periode) . "'");
                         $num++;
                     }
                     $i++;
                 }
             }
         }
         $msg = get_vocab("message_records");
     }
 }
 if ($access == 'a') {
     $sql = "DELETE FROM " . TABLE_PREFIX . "_j_user_area WHERE id_area='{$id_area}'";
     if (grr_sql_command($sql) < 0) {
         fatal_error(0, get_vocab('update_area_failed') . grr_sql_error());
     }
 }

grr_sql_mutex_unlock('' . TABLE_PREFIX . '_entry');
if ($error_booking_in_past == 'yes') {
    $str_date = utf8_strftime('%d %B %Y, %H:%M', $date_now);
    print_header();
    echo '<h2>' . get_vocab('booking_in_past') . '</h2>';
    if ($rep_type != 0 && !empty($reps)) {
        echo '<p>' . get_vocab('booking_in_past_explain_with_periodicity') . $str_date . '</p>';
    } else {
        echo '<p>' . get_vocab('booking_in_past_explain') . $str_date . '</p>';
    }
    echo '<a href="' . $back . '&amp;Err=yes">' . get_vocab('returnprev') . '</a>';
    include 'include/trailer.inc.php';
    die;
}
if ($error_duree_max_resa_area == 'yes') {
    $area_id = grr_sql_query1('SELECT area_id FROM ' . TABLE_PREFIX . "_room WHERE id='" . protect_data_sql($room_id) . "'");
    $duree_max_resa_area = grr_sql_query1('SELECT duree_max_resa_area FROM ' . TABLE_PREFIX . "_area WHERE id='" . $area_id . "'");
    print_header();
    $temps_format = $duree_max_resa_area * 60;
    toTimeString($temps_format, $dur_units, true);
    echo '<h2>' . get_vocab('error_duree_max_resa_area') . $temps_format . ' ' . $dur_units . '</h2>';
    echo '<a href="' . $back . '&amp;Err=yes">' . get_vocab('returnprev') . '</a>';
    include 'include/trailer.inc.php';
    die;
}
if ($error_delais_max_resa_room == 'yes') {
    print_header();
    echo '<h2>' . get_vocab('error_delais_max_resa_room') . '</h2>';
    echo '<a href="' . $back . '&amp;Err=yes">' . get_vocab('returnprev') . '</a>';
    include 'include/trailer.inc.php';
    die;

    $back = htmlspecialchars($_SERVER['HTTP_REFERER']);
}
if (Settings::get("sso_ac_corr_profil_statut") != 'y') {
    showAccessDenied($back);
    exit;
}
check_access(5, $back);
$themessage = str_replace("'", "\\'", get_vocab("confirmdel"));
$themessage2 = str_replace("'", "\\'", get_vocab("confirm_del"));
//
// Ajout d'une correspondance fonction/statut
//
$msg = "";
if (isset($_GET['action_add']) && $_GET['action_add'] == 'yes') {
    if ($_POST['codefonc'] != "" && $_POST['libfonc'] != "" && $_POST['statutgrr'] != "") {
        $sql = "INSERT INTO " . TABLE_PREFIX . "_correspondance_statut (code_fonction, libelle_fonction, statut_grr) VALUES ('" . strtoupper(protect_data_sql($_POST['codefonc'])) . "', '" . ucfirst(protect_data_sql($_POST['libfonc'])) . "','" . $_POST['statutgrr'] . "')";
        if (grr_sql_command($sql) < 0) {
            fatal_error(0, "<p>" . grr_sql_error());
        } else {
            $msg = get_vocab("message_records");
        }
    } else {
        $msg = get_vocab("champs_non_remplis");
    }
}
//
// Modification d'une correspondance fonction/statut
//
if (isset($_GET['action_mod']) && ($_GET['action_mod'] = 'yes')) {
    if (isset($_POST['idselect'])) {
        $select = "statut" . $_POST['idselect'];

}
// Description complète
if (authGetUserLevel($getUserName(), -1) >= Settings::get("acces_fiche_reservation") && $row["comment_room"] != '') {
    echo "<h3>" . get_vocab("match_descr") . "</h3>\n";
    echo "<div>" . $row["comment_room"] . "</div>\n";
}
// Afficher capacité
if ($row["capacity"] != '0') {
    echo "<h3>" . get_vocab("capacity_2") . "</h3>\n";
    echo "<p>" . $row["capacity"] . "</p>\n";
}
if ($row["max_booking"] != "-1") {
    echo "<p>" . get_vocab("msg_max_booking") . get_vocab("deux_points") . $row["max_booking"] . "</p>";
}
// Limitation par domaine
$max_booking_per_area = grr_sql_query1("SELECT max_booking FROM " . TABLE_PREFIX . "_area WHERE id = '" . protect_data_sql($id_area) . "'");
if ($max_booking_per_area >= 0) {
    echo "<p>" . get_vocab("msg_max_booking_area") . get_vocab("deux_points") . $max_booking_per_area . "</p>";
}
if ($row["delais_max_resa_room"] != "-1") {
    echo "<p>" . get_vocab("delais_max_resa_room_2") . " <b>" . $row["delais_max_resa_room"] . "</b></p>";
}
if ($row["delais_min_resa_room"] != "0") {
    echo "<p>" . get_vocab("delais_min_resa_room_2") . " <b>" . $row["delais_min_resa_room"] . "</b></p>";
}
$nom_picture = '';
if ($row['picture_room'] != '') {
    $nom_picture = "./images/" . $row['picture_room'];
}
echo "<div style=\"text-align:center; margin-top:30px\"><b>";
if (@file_exists($nom_picture) && $nom_picture) {

 function handleSlo($ret)
 {
     //error_log("handleSlo");
     $r = $this->relayState;
     if ($this->currentHttpMethod == LASSO_HTTP_METHOD_GET && $this->currentHttpMethod == LASSO_HTTP_METHOD_POST) {
         $this->headerHtml("SLO endpoint", $r);
         if ($ret) {
             echo "Demande de slo échoué: " . strError($ret) . "({$ret})";
         } else {
             echo "Demande de slo réussie";
         }
         echo "Go to <a href='{$r}'>{$r}</a>";
         $this->footerHtml();
         lassospkit_clean();
         grr_closeSession($_GET['auto']);
     } else {
         # Specialized
         $id = lassospkit_userid();
         if (isset($id)) {
             //error_log("Trying to destroy session $id");
             chdir("..");
             global $dbsys;
             require_once "./include/config.inc.php";
             include "./include/connect.inc.php";
             require_once "./include/{$dbsys}.inc.php";
             require_once "./include/functions.inc.php";
             require_once "./include/session.inc.php";
             // See admin_view_connexions.php:67
             $sql = "SELECT session_id FROM " . TABLE_PREFIX . "_log\n                      WHERE login = '" . protect_data_sql($id) . "'\n                      AND end > NOW()";
             $res = grr_sql_query($sql);
             if ($res) {
                 for ($i = 0; $row = grr_sql_row($res, $i); $i++) {
                     $php_session_id = $row[0];
                     //error_log("Erasing GRR session $php_session_id");
                     session_id($php_session_id);
                     // delete spkitlasso session if necessary
                     @session_start();
                     lassospkit_set_nameid(@$_SESSION['lasso_nameid']);
                     lassospkit_clean();
                     // delete GRR session
                     $auto = 0;
                     grr_closeSession($auto);
                     // Done by grr_closeSession:
                     //session_start();
                     //session_destroy();
                 }
             }
         }
     }
     if ($ret) {
         error_log("Demande de slo échoué: {$ret}");
     } else {
         //error_log("Demande de slo réussie: $ret");
     }
     return $ret;
 }

            prenom='".protect_data_sql($reg_prenom)."',
            statut='".protect_data_sql($reg_statut)."',
            email='".protect_data_sql($reg_email)."',";

            if ($reg_type_authentification=="locale") {
              $sql .= "source='local',";
              if ($reg_password_c!='')
                $sql .= "password='".protect_data_sql($reg_password_c)."',";
              } else
              $sql .= "source='ext',password='',";




            $sql .= "etat='".protect_data_sql($reg_etat)."'
            WHERE login='".protect_data_sql($user_login)."'";
            if (grr_sql_command($sql) < 0)
                {fatal_error(0, get_vocab("message_records_error") . grr_sql_error());
            } else {
                $msg = get_vocab("message_records");
            }

            // Cas où on a déclaré un utilisateur inactif, on le supprime dans les tables ".TABLE_PREFIX."_j_user_area,  ".TABLE_PREFIX."_j_mailuser_room
            if ($reg_etat != 'actif') {
                $sql = "DELETE FROM ".TABLE_PREFIX."_j_user_area WHERE login='$user_login'";
                if (grr_sql_command($sql) < 0) fatal_error(0, get_vocab('message_records_error') . grr_sql_error());
                $sql = "DELETE FROM ".TABLE_PREFIX."_j_mailuser_room WHERE login='$user_login'";
                if (grr_sql_command($sql) < 0) fatal_error(0, get_vocab('message_records_error') . grr_sql_error());
                $sql = "DELETE FROM ".TABLE_PREFIX."_j_useradmin_area WHERE login='$user_login'";
                if (grr_sql_command($sql) < 0)
                    fatal_error(0, get_vocab('message_records_error') . grr_sql_error());

        echo " value=\"" . $jour_cycle . "\"";
    }
    echo "/><br /><br /><div style=\"text-align:center;\"><input type=\"submit\" value=\"Enregistrer\" /></div>\n";
    echo "</div></form>\n";
    echo "</fieldset>\n";
}
// Enregistrement du nouveau jour cycle
if (isset($_GET['selection'])) {
    if ($_GET['selection'] == 0) {
        grr_sql_query("delete from " . TABLE_PREFIX . "_calendrier_jours_cycle WHERE DAY = " . $_GET['newdate'] . "");
    } elseif ($_GET['selection'] == 1) {
        grr_sql_query("delete from " . TABLE_PREFIX . "_calendrier_jours_cycle WHERE DAY = " . $_GET['newdate'] . "");
        grr_sql_query("insert into " . TABLE_PREFIX . "_calendrier_jours_cycle set Jours =" . $_GET['newDay'] . ", DAY = " . $_GET['newdate'] . "");
    } elseif ($_GET['selection'] == 2) {
        grr_sql_query("delete from " . TABLE_PREFIX . "_calendrier_jours_cycle WHERE DAY = " . $_GET['newdate'] . "");
        grr_sql_query("insert into " . TABLE_PREFIX . "_calendrier_jours_cycle set Jours ='" . protect_data_sql($_GET['titre']) . "', DAY = " . $_GET['newdate'] . "");
    }
}
$basetime = mktime(12, 0, 0, 6, 11 + $weekstarts, 2000);
echo "<table cellspacing=\"20\" border=\"0\">\n";
$n = Settings::get("begin_bookings");
$end_bookings = Settings::get("end_bookings");
$debligne = 1;
$month = strftime("%m", Settings::get("begin_bookings"));
$year = strftime("%Y", Settings::get("begin_bookings"));
$inc = 0;
while ($n <= $end_bookings) {
    if ($debligne == 1) {
        echo "<tr>\n";
        $inc = 0;
        $debligne = 0;

 // Mais dans les 2 cas, il faut valider les données
 if (($valid == 'yes') or ($valid=='reset'))
 {
   $default_site = isset($_POST['id_site']) ? $_POST['id_site'] : NULL;
   $default_area = isset($_POST['id_area']) ? $_POST['id_area'] : NULL;
   $default_room = isset($_POST['id_room']) ? $_POST['id_room'] : NULL;
   $default_style = isset($_POST['default_css']) ? $_POST['default_css'] : NULL;
   $default_list_type = isset($_POST['area_list_format']) ? $_POST['area_list_format'] : NULL;
   $default_language = isset($_POST['default_language']) ? $_POST['default_language'] : NULL;
   $sql = "UPDATE ".TABLE_PREFIX."_utilisateurs
           SET default_site = '".protect_data_sql($default_site)."',
               default_area = '".protect_data_sql($default_area)."',
               default_room = '".protect_data_sql($default_room)."',
               default_style = '". protect_data_sql($default_style)."',
               default_list_type = '".protect_data_sql($default_list_type)."',
               default_language = '".protect_data_sql($default_language)."'
           WHERE login='".getUserName()."'";

   if (grr_sql_command($sql) < 0)
     fatal_error(0, get_vocab('message_records_error').grr_sql_error());
   else
   {
     if (($default_site !='') and ($default_site !='0'))
       $_SESSION['default_site'] = $default_site;
     else
       $_SESSION['default_site'] = getSettingValue('default_site');

     if (($default_area !='') and ($default_area !='0'))
       $_SESSION['default_area'] = $default_area;
     else
       $_SESSION['default_area'] = getSettingValue('default_area');

/** mrbsCreateRepeatEntry()
 *
 * Creates a repeat entry in the data base
 *
 * $starttime   - Start time of entry
 * $endtime     - End time of entry
 * $rep_type    - The repeat type
 * $rep_enddate - When the repeating ends
 * $rep_opt     - Any options associated with the entry
 * $room_id     - Room ID
 * $beneficiaire       - beneficiaire
 * $beneficiaire_ext   - beneficiaire extérieur
 * $creator     - celui aui a créé ou modifié la réservation.
 * $name        - Name
 * $type        - Type (Internal/External)
 * $description - Description
  *$rep_jour_c - Le jour cycle d'une réservation, si aucun 0
 *
 * Returns:
 *   0        - An error occured while inserting the entry
 *   non-zero - The entry's ID
 */
function mrbsCreateRepeatEntry($starttime, $endtime, $rep_type, $rep_enddate, $rep_opt,
                               $room_id, $creator, $beneficiaire, $beneficiaire_ext, $name, $type, $description, $rep_num_weeks,$overload_data, $rep_jour_c)
{
  $overload_data_string = "";
  $area_id = mrbsGetAreaIdFromRoomId($room_id);

  $overload_fields_list = mrbsOverloadGetFieldslist($area_id);

  foreach ($overload_fields_list as $field=>$fieldtype)
    {
      $id_field = $overload_fields_list[$field]["id"];
      if (array_key_exists($id_field,$overload_data))
      {
//      $begin_string = "<".$id_field.">"; //tructruc
//      $end_string = "</".$id_field.">";  //tructruc
      $begin_string = "@".$id_field."@";
      $end_string = "@/".$id_field."@";
//    $overload_data_string .= $begin_string.base64_encode($overload_data[$id_field]).$end_string; // tructruc
    $overload_data_string .= $begin_string.urlencode($overload_data[$id_field]).$end_string; // tructruc

      }
    }
  $sql = "INSERT INTO ".TABLE_PREFIX."_repeat (
  start_time, end_time, rep_type, end_date, rep_opt, room_id, create_by, beneficiaire, beneficiaire_ext, type, name, description, rep_num_weeks, overload_desc, jours)
  VALUES ($starttime, $endtime,  $rep_type, $rep_enddate, '$rep_opt', $room_id,   '".protect_data_sql($creator)."','".protect_data_sql($beneficiaire)."','".protect_data_sql($beneficiaire_ext)."', '".protect_data_sql($type)."', '".protect_data_sql($name)."', '".protect_data_sql($description)."', '$rep_num_weeks','".protect_data_sql($overload_data_string)."',".$rep_jour_c.")";


  if (grr_sql_command($sql) < 0)
    {
      return 0;

    }
  return grr_sql_insert_id("".TABLE_PREFIX."_repeat", "id");
}

function effectuer_correspondance_profil_statut($codefonction, $libellefonction) {
    # On récupère le statut par défaut des utilisateurs CAS
    $sso = getSettingValue("sso_statut");
    if ($sso == "cas_visiteur") $_statut = "visiteur";
    else if ($sso == "cas_utilisateur") $_statut = "utilisateur";

    # Le code fonction est défini
    if ($codefonction != "") {
        $sql = grr_sql_query1("select statut_grr from ".TABLE_PREFIX."_correspondance_statut where code_fonction='".$codefonction."'");
        if ($sql != -1) { // Si la fonction existe dans la table de correspondance, on retourne le statut_grr associé
            return $sql;
        }	else {
            // Le code n'existe pas dans la base, alors on l'insère en lui attribuant le statut par défaut.
		        $libellefonction = protect_data_sql($libellefonction);
			      $sql = grr_sql_command("insert into grr_correspondance_statut(code_fonction,libelle_fonction,statut_grr) values('$codefonction', '$libellefonction', '$_statut')");
			      return $_statut;
		    }
    # Le code fonction n'est pas défini, alors on retourne le statut par défaut.
    }	else {
        return $_statut;
    }
}

 $end_month = strftime('%m', $row[4]);
 $end_year = strftime('%Y', $row[4]);
 $end_hour = strftime('%H', $row[4]);
 $end_min = strftime('%M', $row[4]);
 $duration = $row[4] - $row[3];
 $etype = $row[5];
 $room_id = $row[6];
 $entry_type = $row[7];
 $rep_id = $row[8];
 $option_reservation = $row[9];
 $jours_c = $row[10];
 $clef = $row[14];
 $courrier = $row[15];
 $modif_option_reservation = 'n';
 if ($entry_type >= 1) {
     $sql = "SELECT rep_type, start_time, end_date, rep_opt, rep_num_weeks, end_time, type, name, beneficiaire, description\n\t\tFROM " . TABLE_PREFIX . "_repeat WHERE id='" . protect_data_sql($rep_id) . "'";
     $res = grr_sql_query($sql);
     if (!$res) {
         fatal_error(1, grr_sql_error());
     }
     if (grr_sql_count($res) != 1) {
         fatal_error(1, get_vocab('repeat_id') . $rep_id . get_vocab('not_found'));
     }
     $row = grr_sql_row($res, 0);
     grr_sql_free($res);
     $rep_type = $row[0];
     if ($rep_type == 2) {
         $rep_num_weeks = $row[4];
     }
     if ($edit_type == "series") {
         $start_day = (int) strftime('%d', $row[1]);

                 $retry = 'yes';
             }
         }
     }
 }
 if ($retry != 'yes') {
     $sql = "UPDATE " . TABLE_PREFIX . "_utilisateurs SET nom='" . protect_data_sql($reg_nom) . "',\n\t\t\t\tprenom='" . protect_data_sql($reg_prenom) . "',\n\t\t\t\tstatut='" . protect_data_sql($reg_statut) . "',\n\t\t\t\temail='" . protect_data_sql($reg_email) . "',";
     if ($reg_type_authentification == "locale") {
         $sql .= "source='local',";
         if ($reg_password_c != '') {
             $sql .= "password='" . protect_data_sql($reg_password_c) . "',";
         }
     } else {
         $sql .= "source='ext',password='',";
     }
     $sql .= "etat='" . protect_data_sql($reg_etat) . "'\n\t\t\t\tWHERE login='" . protect_data_sql($user_login) . "'";
     if (grr_sql_command($sql) < 0) {
         fatal_error(0, get_vocab("message_records_error") . grr_sql_error());
     } else {
         $msg = get_vocab("message_records");
     }
     // Cas où on a déclaré un utilisateur inactif, on le supprime dans les tables ".TABLE_PREFIX."_j_user_area,  ".TABLE_PREFIX."_j_mailuser_room
     if ($reg_etat != 'actif') {
         $sql = "DELETE FROM " . TABLE_PREFIX . "_j_user_area WHERE login='{$user_login}'";
         if (grr_sql_command($sql) < 0) {
             fatal_error(0, get_vocab('message_records_error') . grr_sql_error());
         }
         $sql = "DELETE FROM " . TABLE_PREFIX . "_j_mailuser_room WHERE login='{$user_login}'";
         if (grr_sql_command($sql) < 0) {
             fatal_error(0, get_vocab('message_records_error') . grr_sql_error());
         }