PHP quote_smart函数代码示例

function printTestUsers($accounts)
{
    $connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS) or die("Problemas en la conexion");
    mysql_select_db(DB_NAME, $connection);
    $html = "";
    if (isset($accounts['data']) && count($accounts['data'])) {
        $html .= "<table>";
        $html .= "<tr class=\"head\"><td colspan=\"5\">Usuarios de prueba</td></tr>";
        $html .= "<tr class=\"head\"><td>ID</td><td>Nombre</td><td>App user</td><td>Login URL</td><td>Borrar</td></tr>";
        foreach ($accounts['data'] as $arr) {
            $html .= "<tr>";
            $html .= "<td>{$arr['id']}</td>";
            $fbid = $arr['id'];
            $fbid = quote_smart($fbid, $connection);
            $SQL = "SELECT * FROM USER_APP2 WHERE fbid = {$fbid}";
            $result = mysql_query($SQL) or die("MySQL-err.Query: " . $SQL . " - Error: (" . mysql_errno() . ") " . mysql_error());
            $num_rows = mysql_num_rows($result);
            if ($num_rows == 1) {
                $aRow = mysql_fetch_array($result);
                $html .= "<td>" . $aRow['fbname'] . "</td>";
            } else {
                $html .= "<td>-</td>";
            }
            $html .= "<td>" . (empty($arr['access_token']) ? "NO" : "YES") . "</td>";
            $html .= "<td><a href=\"{$arr['login_url']}\" target=\"_blank\">Test User Login</a></td>";
            $html .= "<td><a href=\"{$_SERVER['PHP_SELF']}?id={$arr['id']}&action=delete\">Delete Test User</a></td>";
            $html .= "</tr>";
        }
        $html .= "</table>";
    } else {
        $html = "No hay usuarios";
    }
    closeConnection($connection);
    return $html;
}

 public static function deleteByLanguage($intLanguageId)
 {
     self::$__object = "ElementLanguage";
     self::$__table = "pcms_element_language";
     $strSql = sprintf("DELETE FROM " . self::$__table . " WHERE languageId = '%s'", quote_smart($intLanguageId));
     self::select($strSql);
 }

 function setFromPost()
 {
     global $strEvent;
     if (isset($_POST["person"])) {
         $this->person_id = quote_smart($_POST["person"]);
     }
     if (isset($_POST["frmChild"])) {
         $this->child_id = quote_smart($_POST["frmChild"]);
     }
     if (isset($_POST["frmGender"])) {
         $this->gender = $_POST["frmGender"];
     }
     //Ignore the rest if we don't need them
     if (!isset($_POST["frmSurname"])) {
         return;
     }
     @($frmBCert = $_POST["frmBCert"]);
     if ($frmBCert == "") {
         $frmBCert = "N";
     }
     @($frmDCert = $_POST["frmDCert"]);
     if ($frmDCert == "") {
         $frmDCert = "N";
     }
     $this->name = new Name();
     $this->name->setFromPost();
     $this->death_reason = htmlspecialchars($_POST["frmDeathReason"], ENT_QUOTES);
     $this->mother = new PersonDetail();
     @($this->mother->person_id = $_POST["frmMother"]);
     $this->father = new PersonDetail();
     @($this->father->person_id = $_POST["frmFather"]);
     $this->narrative = add_quotes($_POST["frmNarrative"]);
 }

function insertIfNotExists($keysArray, $table, $values, $userID = "")
{
    global $connection;
    $selectClauseArray = array();
    $whereClauseArray = array();
    foreach ($keysArray as $keyColumn => $keyValue) {
        $selectClauseArray[] = $keyColumn;
        $whereClauseArray[] = $keyColumn . " = " . quote_smart($keyValue);
    }
    $query = "SELECT " . implode(", ", $selectClauseArray) . " FROM " . $table . " WHERE " . implode(" AND ", $whereClauseArray);
    if ($userID != "") {
        // note that 'if (!empty($userID))' doesn't work here since '$userID = 0' would incorrectly be treated as 'empty'
        $query .= " AND user_id = " . $userID;
    }
    $result = queryMySQLDatabase($query);
    // function 'queryMySQLDatabase()' is defined in 'include.inc.php'
    $rowsFound = @mysql_num_rows($result);
    if ($rowsFound == 0) {
        $query = "INSERT INTO " . $table . " VALUES " . $values;
        $result = queryMySQLDatabase($query);
        return "true";
    } else {
        return "false";
    }
}

function sites_getSiteInfo($site_id)
{
    $site_id = quote_smart($site_id);
    $sql = "\n\t\tSELECT\n\t\t\t*\n\t\tFROM\n\t\t\tcs_company_sites\n\t\tWHERE\n\t\t\tcs_id = '{$site_id}';\n\t";
    $res = sql_query_read($sql) or dieLog(mysql_error() . "<pre>{$sql}</pre>");
    return mysql_fetch_assoc($res);
}

function call_tribename_text(){
    global $id,$confirm,$Aname,$tool;
	
	include_once('inc/functions/resort_tools.php');
	if (! user_has_access($tool))
	{
        echo "Sorry, this page is restricted to ORKFiA Staff";
        include_game_down();
        exit;
    }
    
    echo "<form method=\"post\" action=\"".$_SERVER['REQUEST_URI']."\">";
    ECHO "Input ID#: <input name=id size=5><br>";
    ECHO "Change Name to: <input type=text name=Aname maxlength=30 size=25><br>";
    ECHO "<input type=submit value=Save name=confirm>";
    ECHO "</form>";
    ECHO "<br><br>";
    IF($confirm && $id && $Aname)
    {
    	$Aname = quote_smart(strip_tags(trim($Aname)));
        $check = mysql_query("SELECT * FROM stats WHERE tribe = $Aname AND id != $id");
        if(mysql_num_rows($check) != 0){
            echo "that name is already in use";
        } else {
            $result = mysql_query("UPDATE stats SET tribe = $Aname where id = $id");
            $result = mysql_query("UPDATE ranking_write SET tribe_name = $Aname where id = $id");
            ECHO "Done =)";
        }
    }
}

function genPincodes($data)
{
    global $userId;
    $pinInfo_list = array();
    $rd_subaccount = quote_smart($_REQUEST['sa']);
    $gen_num = intval($_REQUEST['gn']);
    $sql = "\n\t\tSELECT \n\t\t\tcount(*) as cnt\n\t\tFROM \n\t\t\tcs_pincodes \n\t\tLEFT JOIN cs_rebillingdetails ON  pc_subAccount = rd_subAccount\n\t\tWHERE \n\t\t\tcs_rebillingdetails.company_user_id = '{$userId}'\n\t\t\tand rd_subaccount = '{$rd_subaccount}'\n\t\t\tand pc_used = '0'\n\t\t;";
    // Only get required pincode info, not *.
    $result = mysql_query($sql) or dieLog(mysql_error());
    $cnt = mysql_result($result, 0, 0);
    if ($gen_num > 1000 - $cnt) {
        $gen_num = 1000 - $cnt;
    }
    //$pinInfo_list[] = array("pc" => "$subaccount", "used" => "0","pass"=>"subaccount");
    $mode = "pincode";
    if ($_REQUEST['mode'] == "userpass") {
        $mode = "userpass";
    }
    for ($j = 0; $j < $gen_num; $j++) {
        $code = rand(1000000, 9999999);
        $pass = rand(1000000, 9999999);
        $sql = "\n\t\t\tINSERT INTO \n\t\t\t\tcs_pincodes\n\t\t\tSET\n\t\t\t\tpc_subAccount = \"" . $rd_subaccount . "\",\n\t\t\t\tpc_type = \"" . $mode . "\",\n\t\t\t\tpc_code = \"" . $code . "\",\n\t\t\t\tpc_pass = \"" . $pass . "\",\n\t\t\t\tpc_used = \"0\"\n\t\t;";
        $result = mysql_query($sql) or dieLog(mysql_error());
    }
    $data['created_num'] = $gen_num . " " . $_REQUEST['mode'];
}

 function updateConfig($c)
 {
     global $tblprefix;
     $q = "UPDATE " . $tblprefix . "config SET `email` = " . quote_smart($c->email) . "," . "`mailto` = " . ($c->mailto ? 1 : 0) . "," . "`desc` = " . quote_smart($c->desc) . "," . "`styledir` = " . quote_smart($c->styledir) . "," . "`imagedir` = " . quote_smart($c->imagedir) . "," . "`filedir` = " . quote_smart($c->filedir) . "," . "`defaultstyle` = " . quote_smart($c->defaultstyle) . "," . "`lang` = " . quote_smart($c->lang) . "," . "`timing` = " . ($c->timing ? 1 : 0) . "," . "`gedcom` = " . ($c->gedcom ? 1 : 0) . "," . "`restricttype` = " . $c->restricttype . "," . "`restrictyears` = " . $c->restrictyears . "," . "`restrictdate` = " . quote_smart($c->restrictdate) . "," . "`tracking` = " . ($c->tracking ? 1 : 0) . "," . "`trackemail` = " . quote_smart($c->trackemail) . "," . "`absurl` = " . quote_smart($c->absurl) . "," . "`bbtracking` = " . ($c->bbtracking ? 1 : 0) . "," . "`img_max` = " . $c->img_max . "," . "`img_min` = " . $c->img_min . "," . "`layout` = " . $c->layout . "," . "`gmapshost` = " . quote_smart($c->gmapshost) . "," . "`gmapskey` = " . quote_smart($c->gmapskey) . "," . "`smtp_host` = " . quote_smart($c->smtp_host) . "," . "`smtp_user` = " . quote_smart($c->smtp_user) . "," . "`smtp_password` = " . quote_smart($c->smtp_password) . "," . "`recaptcha_public` = " . quote_smart($c->recaptcha_public) . "," . "`recaptcha_private` = " . quote_smart($c->recaptcha_private) . "," . "`analytics_key` = " . quote_smart($c->analytics_key);
     //TODO - add a proper error message
     $ret = $this->runQuery($q, "Error updating config");
     return $ret;
 }

 function setFromRequest()
 {
     $this->person->setFromRequest();
     $this->event->setFromRequest();
     if (isset($_REQUEST["spouse"])) {
         $this->relation->person_id = quote_smart($_REQUEST["spouse"]);
     }
 }

 function getImages(&$img, $eid = -1, $sid = -1)
 {
     global $tblprefix, $err_images;
     $iquery = "SELECT image_id, i.title, p.person_id as p_person_id, i.event_id, " . Event::getFields("e") . "," . PersonDetail::getFields() . "," . Source::getFields("s") . ", s.source_id as s_source_id" . " FROM " . $tblprefix . "images i " . " LEFT JOIN " . $tblprefix . "event e ON e.event_id = i.event_id " . " LEFT JOIN " . $tblprefix . "people p ON p.person_id = e.person_id " . " LEFT JOIN " . $tblprefix . "source s ON s.source_id = i.source_id " . PersonDetail::getJoins();
     switch ($img->queryType) {
         case Q_RANDOM:
             $iquery .= $this->addPersonRestriction(" WHERE ") . $this->addRandom();
             break;
         default:
             if ($sid > 0) {
                 $iquery .= " WHERE s.source_id = " . quote_smart($sid);
             } else {
                 if ($eid > 0) {
                     $iquery .= " WHERE e.event_id = " . quote_smart($eid);
                 } else {
                     if (isset($img->person->person_id)) {
                         $iquery .= " WHERE ";
                         $iquery .= "p.person_id = " . quote_smart($img->person->person_id);
                         $iquery .= $this->addPersonRestriction(" AND ");
                         if (isset($img->image_id)) {
                             $iquery .= " AND image_id=" . $img->image_id;
                         }
                         $iquery .= " ORDER BY e.date1";
                     } else {
                         $bool = " WHERE ";
                         if (isset($img->image_id)) {
                             $iquery .= " WHERE image_id=" . $img->image_id;
                             $bool = " AND ";
                         }
                         $iquery .= $this->addPersonRestriction($bool) . " ORDER BY b.date1";
                     }
                 }
             }
             break;
     }
     $this->addLimit($img, $query);
     $iresult = $this->runQuery($iquery, $err_images);
     $res = array();
     $img->numResults = 0;
     while ($row = $this->getNextRow($iresult)) {
         $image = new Image();
         $image->person = new PersonDetail();
         $image->person->loadFields($row, L_HEADER, "p_");
         $image->person->name->loadFields($row, "n_");
         $image->image_id = $row["image_id"];
         $image->title = $row["title"];
         $image->event = new Event();
         $image->event->loadFields($row, "e_");
         $image->source = new Source();
         $image->source->loadFields($row, "s_");
         $image->description = $image->event->descrip;
         $image->date = $image->event->date1;
         $res[] = $image;
         $img->numResults++;
     }
     $this->freeResultSet($iresult);
     $img->results = $res;
 }

 public static function selectByFeed($intFeedId)
 {
     global $_CONF;
     $objReturn = NULL;
     $strSql = "SELECT pcms_element_feed.* \n\t\t\t\t\tFROM pcms_element_feed, pcms_feed \n\t\t\t\t\tWHERE pcms_element_feed.feedId = '%s' \n\t\t\t\t\tAND pcms_feed.accountId = '%s' \n\t\t\t\t\tAND pcms_element_feed.feedId = pcms_feed.id ORDER BY pcms_element_feed.elementId ASC";
     $strSql = sprintf($strSql, quote_smart($intFeedId), quote_smart($_CONF['app']['account']->getId()));
     $objReturn = self::select($strSql);
     return $objReturn;
 }

 public static function SetConfig($strConfig, $strValue, $path = "")
 {
     include $path . "conn.php";
     require_once "protection.php";
     $Query = sprintf("UPDATE " . TABLE_PREFIX . "configs SET config_value = %s WHERE config_name = '{$strConfig}'", quote_smart($strValue));
     //echo($Query . "<br>\n");
     $AffectedRows = $dblink->exec($Query);
     return $AffectedRows == 1 || $AffectedRows == 0;
 }

 public static function selectByElement($intElementId)
 {
     global $_CONF;
     $objReturn = NULL;
     $strSql = "SELECT pcms_element_schedule.* \n\t\t\t\t\tFROM pcms_element_schedule, pcms_element \n\t\t\t\t\tWHERE pcms_element_schedule.elementId = '%s' \n\t\t\t\t\tAND pcms_element.accountId = '%s' \n\t\t\t\t\tAND pcms_element_schedule.elementId = pcms_element.id";
     $strSql = sprintf($strSql, quote_smart($intElementId), quote_smart($_CONF['app']['account']->getId()));
     $objSchedules = self::select($strSql);
     return $objSchedules;
 }

 function get_entity_id_by_name($type, $name)
 {
     $type = quote_smart($type);
     $name = quote_smart($name);
     $sql = "\n\t\t\tSELECT\n\t\t\t\tet_ID\n\t\t\tFROM\n\t\t\t\tcs_entities\n\t\t\tWHERE\n\t\t\t\tet_type = '{$type}'\n\t\t\t\tAND et_username = '{$name}'\n\t\t";
     $res = sql_query_read($sql) or dieLog(mysql_error() . "<pre>{$sql}</pre>");
     $r = mysql_fetch_assoc($res);
     return $r['et_ID'];
 }

 public static function getByAccount($intAccountId = 0)
 {
     global $_CONF;
     if ($intAccountId == 0) {
         $intAccountId = $_CONF['app']['account']->getId();
     }
     $objSettings = Setting::select(sprintf("SELECT * FROM pcms_setting WHERE accountId = '%s' ORDER BY sort", quote_smart($intAccountId)));
     return $objSettings;
 }