PHP sanitise_string函数代码示例

/**
 * Find an API User's details based on the provided public api key.
 * These users are not users in the traditional sense.
 *
 * @param string $api_key   The API Key
 *
 * @return mixed stdClass representing the database row or false.
 */
function get_api_user($api_key)
{
    $dbprefix = elgg_get_config('dbprefix');
    $api_key = sanitise_string($api_key);
    $query = "SELECT * from {$dbprefix}api_users" . " where api_key='{$api_key}' and active=1";
    return get_data_row($query);
}

/**
 * Encode a location into a latitude and longitude, caching the result.
 *
 * Works by triggering the 'geocode' 'location' plugin
 * hook, and requires a geocoding plugin to be installed.
 *
 * @param string $location The location, e.g. "London", or "24 Foobar Street, Gotham City"
 * @return string|false
 */
function elgg_geocode_location($location)
{
    global $CONFIG;
    if (is_array($location)) {
        return false;
    }
    $location = sanitise_string($location);
    // Look for cached version
    $query = "SELECT * from {$CONFIG->dbprefix}geocode_cache WHERE location='{$location}'";
    $cached_location = get_data_row($query);
    if ($cached_location) {
        return array('lat' => $cached_location->lat, 'long' => $cached_location->long);
    }
    // Trigger geocode event if not cached
    $return = false;
    $return = elgg_trigger_plugin_hook('geocode', 'location', array('location' => $location), $return);
    // If returned, cache and return value
    if ($return && is_array($return)) {
        $lat = (double) $return['lat'];
        $long = (double) $return['long'];
        // Put into cache at the end of the page since we don't really care that much
        $query = "INSERT DELAYED INTO {$CONFIG->dbprefix}geocode_cache " . " (location, lat, `long`) VALUES ('{$location}', '{$lat}', '{$long}')" . " ON DUPLICATE KEY UPDATE lat='{$lat}', `long`='{$long}'";
        execute_delayed_write_query($query);
    }
    return $return;
}

/**
 * Get security token, forward to action.
 *
 * @param unknown_type $page
 * @return unknown_type
 */
function uservalidationbyemail_page_handler($page)
{
    global $CONFIG;
    if (isset($page[0]) && $page[0] == 'confirm') {
        $code = sanitise_string(get_input('c', FALSE));
        $user_guid = get_input('u', FALSE);
        // new users are not enabled by default.
        $access_status = access_get_show_hidden_status();
        access_show_hidden_entities(true);
        $user = get_entity($user_guid);
        if ($code && $user) {
            if (uservalidationbyemail_validate_email($user_guid, $code)) {
                system_message(elgg_echo('email:confirm:success'));
                $user = get_entity($user_guid);
                $user->enable();
                notify_user($user_guid, $CONFIG->site->guid, sprintf(elgg_echo('email:validate:success:subject'), $user->username), sprintf(elgg_echo('email:validate:success:body'), $user->name), NULL, 'email');
            } else {
                register_error(elgg_echo('email:confirm:fail'));
            }
        } else {
            register_error(elgg_echo('email:confirm:fail'));
        }
        access_show_hidden_entities($access_status);
    } else {
        register_error(elgg_echo('email:confirm:fail'));
    }
    forward();
}

/**
 * Custom clauses for forum keyword search
 */
function hj_forum_filter_forum_list($hook, $type, $options, $params)
{
    if (!is_array($options['subtypes'])) {
        if (isset($options['subtype'])) {
            $options['subtypes'] = array($options['subtype']);
            unset($options['subtype']);
        } elseif (isset($options['subtypes'])) {
            $options['subtypes'] = array($options['subtypes']);
        } else {
            return $options;
        }
    }
    if (!in_array('hjforum', $options['subtypes']) && !in_array('hjforumtopic', $options['subtypes'])) {
        return $options;
    }
    $query = get_input("__q", false);
    if (!$query || empty($query)) {
        return $options;
    }
    $query = sanitise_string(urldecode($query));
    $dbprefix = elgg_get_config('dbprefix');
    $options['joins'][] = "JOIN {$dbprefix}objects_entity oe_q ON e.guid = oe_q.guid";
    $options['wheres'][] = "MATCH(oe_q.title, oe_q.description) AGAINST ('{$query}')";
    return $options;
}

/**
 * Create or update the extras table for a given object.
 * Call create_entity first.
 *
 * @param int    $guid        The guid of the entity you're creating (as obtained by create_entity)
 * @param string $title       The title of the object
 * @param string $description The object's description
 *
 * @return bool
 */
function create_object_entity($guid, $title, $description)
{
    global $CONFIG;
    $guid = (int) $guid;
    $title = sanitise_string($title);
    $description = sanitise_string($description);
    $row = get_entity_as_row($guid);
    if ($row) {
        // Core entities row exists and we have access to it
        $query = "SELECT guid from {$CONFIG->dbprefix}objects_entity where guid = {$guid}";
        if ($exists = get_data_row($query)) {
            $query = "UPDATE {$CONFIG->dbprefix}objects_entity\n\t\t\t\tset title='{$title}', description='{$description}' where guid={$guid}";
            $result = update_data($query);
            if ($result != false) {
                // Update succeeded, continue
                $entity = get_entity($guid);
                elgg_trigger_event('update', $entity->type, $entity);
                return $guid;
            }
        } else {
            // Update failed, attempt an insert.
            $query = "INSERT into {$CONFIG->dbprefix}objects_entity\n\t\t\t\t(guid, title, description) values ({$guid}, '{$title}','{$description}')";
            $result = insert_data($query);
            if ($result !== false) {
                $entity = get_entity($guid);
                if (elgg_trigger_event('create', $entity->type, $entity)) {
                    return $guid;
                } else {
                    $entity->delete();
                }
            }
        }
    }
    return false;
}

function bulk_user_admin_get_users_by_email_domain($domain, $options = array())
{
    $domain = sanitise_string($domain);
    $db_prefix = elgg_get_config('dbprefix');
    $where = "ue.email LIKE '%@{$domain}'";
    if (!isset($options['wheres'])) {
        $options['wheres'] = array($where);
    } else {
        if (!is_array($options['wheres'])) {
            $options['wheres'] = array($options['wheres']);
        }
        $options['wheres'][] = $where;
    }
    $join = "JOIN {$db_prefix}users_entity ue on e.guid = ue.guid";
    if (!isset($options['joins'])) {
        $options['joins'] = array($join);
    } else {
        if (!is_array($options['joins'])) {
            $options['joins'] = array($options['joins']);
        }
        $options['joins'][] = $join;
    }
    $options['type'] = 'user';
    return elgg_get_entities($options);
}

/**
 * Find an API User's details based on the provided public api key.
 * These users are not users in the traditional sense.
 *
 * @param int    $site_guid The GUID of the site.
 * @param string $api_key   The API Key
 *
 * @return mixed stdClass representing the database row or false.
 */
function get_api_user($site_guid, $api_key)
{
    global $CONFIG;
    $api_key = sanitise_string($api_key);
    $site_guid = (int) $site_guid;
    $query = "SELECT * from {$CONFIG->dbprefix}api_users" . " where api_key='{$api_key}' and site_guid={$site_guid} and active=1";
    return get_data_row($query);
}

 /**
  * Find an API User's details based on the provided public api key.
  * These users are not users in the traditional sense.
  *
  * @param string $api_key Pulic API key
  * @return \hypeJunction\Graph\ApiUser|false
  */
 public function get($api_key)
 {
     $api_key = sanitise_string($api_key);
     $row = get_data_row("SELECT * FROM {$this->dbprefix}api_users\n\t\t\t\t\t\t\t\tWHERE api_key='{$api_key}' AND site_guid={$this->site_guid} AND active=1");
     if (!$row) {
         return false;
     }
     return new ApiUser($row);
 }

/**
 * Get an array of tags with weights for use with the output/tagcloud view.
 *
 * @param int $threshold Get the threshold of minimum number of each tags to bother with (ie only show tags where there are more than $threshold occurances)
 * @param int $limit Number of tags to return
 * @param string $metadata_name Optionally, the name of the field you want to grab for
 * @param string $entity_type Optionally, the entity type ('object' etc)
 * @param string $entity_subtype The entity subtype, optionally
 * @param int $owner_guid The GUID of the tags owner, optionally
 * @param int $site_guid Optionally, the site to restrict to (default is the current site)
 * @return array|false Array of objects with ->tag and ->total values, or false on failure
 */
function get_tags($threshold = 1, $limit = 10, $metadata_name = "", $entity_type = "object", $entity_subtype = "", $owner_guid = "", $site_guid = -1)
{
    global $CONFIG;
    $threshold = (int) $threshold;
    $limit = (int) $limit;
    if (!empty($metadata_name)) {
        $metadata_name = (int) get_metastring_id($metadata_name);
    } else {
        $metadata_name = 0;
    }
    $entity_subtype = get_subtype_id($entity_type, $entity_subtype);
    $entity_type = sanitise_string($entity_type);
    if ($owner_guid != "") {
        if (is_array($owner_guid)) {
            foreach ($owner_guid as $key => $val) {
                $owner_guid[$key] = (int) $val;
            }
        } else {
            $owner_guid = (int) $owner_guid;
        }
    }
    if ($site_guid < 0) {
        $site_guid = $CONFIG->site_id;
    }
    //$access = get_access_list();
    $query = "SELECT msvalue.string as tag, count(msvalue.id) as total ";
    $query .= "FROM {$CONFIG->dbprefix}entities e join {$CONFIG->dbprefix}metadata md on md.entity_guid = e.guid ";
    $query .= " join {$CONFIG->dbprefix}entity_subtypes subtype on subtype.id = e.subtype ";
    $query .= " join {$CONFIG->dbprefix}metastrings msvalue on msvalue.id = md.value_id ";
    $query .= " where msvalue.string != '' ";
    if ($metadata_name > 0) {
        $query .= " and md.name_id = {$metadata_name} ";
    }
    if ($site_guid > 0) {
        $query .= " and e.site_guid = {$site_guid} ";
    }
    if ($entity_subtype > 0) {
        $query .= " and e.subtype = {$entity_subtype} ";
    }
    if ($entity_type != "") {
        $query .= " and e.type = '{$entity_type}' ";
    }
    if (is_array($owner_guid)) {
        $query .= " and e.container_guid in (" . implode(",", $owner_guid) . ")";
    } else {
        if (is_int($owner_guid)) {
            $query .= " and e.container_guid = {$owner_guid} ";
        }
    }
    //$userid = get_loggedin_userid();
    //$query .= " and (e.access_id in {$access} or (e.access_id = " . ACCESS_PRIVATE . " and e.owner_guid = {$userid}))";
    $query .= ' and ' . get_access_sql_suffix("e");
    // Add access controls
    $query .= " group by msvalue.string having total > {$threshold} order by total desc limit {$limit} ";
    return get_data($query);
}

/**
 * Return the site via a url.
 *
 * @param string $url The URL of a site
 *
 * @return mixed
 */
function get_site_by_url($url)
{
    global $CONFIG;
    $url = sanitise_string($url);
    $row = get_data_row("SELECT * from {$CONFIG->dbprefix}sites_entity where url='{$url}'");
    if ($row) {
        return get_entity($row->guid);
    }
    return false;
}

 /**
  * listen to the livesearch in order to provide the objects picker
  *
  * @param string $hook         the name of the hook
  * @param string $type         the type of the hook
  * @param array  $return_value current return value
  * @param array  $params       supplied params
  *
  * @return void
  */
 public static function livesearch($hook, $type, $return_value, $params)
 {
     // only return results to logged in users.
     $user = elgg_get_logged_in_user_entity();
     if (empty($user)) {
         return;
     }
     $q = get_input('term', get_input('q'));
     if (empty($q)) {
         return;
     }
     $input_name = get_input('name', 'objects');
     $q = sanitise_string($q);
     // replace mysql vars with escaped strings
     $q = str_replace(['_', '%'], ['\\_', '\\%'], $q);
     $match_on = get_input('match_on', 'all');
     if (!is_array($match_on)) {
         $match_on = [$match_on];
     }
     // only take over groups search
     if (count($match_on) > 1 || !in_array('objects', $match_on)) {
         return;
     }
     $owner_guid = ELGG_ENTITIES_ANY_VALUE;
     if (get_input('match_owner', false)) {
         $owner_guid = $user->getGUID();
     }
     $subtype = get_input('subtype', ELGG_ENTITIES_ANY_VALUE);
     $limit = sanitise_int(get_input('limit', 10), false);
     $container_guid = sanitise_int(get_input('container_guid'), false);
     if (empty($container_guid)) {
         $container_guid = ELGG_ENTITIES_ANY_VALUE;
     }
     if ($subtype === 'static' && $container_guid) {
         $owner_guid = $container_guid;
         $container_guid = ELGG_ENTITIES_ANY_VALUE;
     }
     // grab a list of entities and send them in json.
     $results = [];
     $options = ['type' => 'object', 'subtype' => $subtype, 'limit' => $limit, 'owner_guid' => $owner_guid, 'container_guid' => $container_guid, 'joins' => ['JOIN ' . elgg_get_config('dbprefix') . 'objects_entity oe ON e.guid = oe.guid'], 'wheres' => ["(oe.title LIKE '%{$q}%' OR oe.description LIKE '%{$q}%')"]];
     $entities = elgg_get_entities($options);
     if (!empty($entities)) {
         foreach ($entities as $entity) {
             $output = elgg_view('input/objectpicker/item', ['entity' => $entity, 'input_name' => $input_name, 'owner_guid' => $owner_guid, 'container_guid' => $container_guid]);
             $result = ['type' => 'object', 'name' => $entity->title, 'desc' => $entity->description, 'guid' => $entity->getGUID(), 'label' => $output, 'value' => $entity->getGUID(), 'url' => $entity->getURL(), 'html' => $output];
             $results[] = $result;
         }
     }
     header('Content-Type: application/json');
     echo json_encode($results);
     exit;
 }

/**
 * Sets a configuration value
 *
 * @param string $name The name of the configuration value
 * @param string $value Its value
 * @param int $site_guid Optionally, the GUID of the site (current site is assumed by default)
 * @return 0
 * @todo The config table doens't have numeric primary keys so insert_data returns 0.
 */
function set_config($name, $value, $site_guid = 0)
{
    global $CONFIG;
    // Unset existing
    unset_config($name, $site_guid);
    $site_guid = (int) $site_guid;
    if ($site_guid == 0) {
        $site_guid = (int) $CONFIG->site_id;
    }
    $CONFIG->{$name} = $value;
    $value = sanitise_string(serialize($value));
    return insert_data("insert into {$CONFIG->dbprefix}config set name = '{$name}', value = '{$value}', site_guid = {$site_guid}");
}

function widget_favorites_is_linked($url = "")
{
    $result = false;
    if (empty($url)) {
        $url = current_page_url();
    }
    if (!empty($url)) {
        $options = array("type" => "object", "subtype" => "widget_favorite", "joins" => array("JOIN " . elgg_get_config("dbprefix") . "objects_entity oe ON e.guid = oe.guid"), "wheres" => array("oe.description = '" . sanitise_string($url) . "'"), "limit" => 1);
        if ($entities = elgg_get_entities($options)) {
            $result = $entities[0];
        }
    }
    return $result;
}

/**
*function to update the metadata
*same as the update_metadata, only made metadata editable
*/
function izap_update_metadata($id, $name, $value, $value_type, $owner_guid, $access_id)
{
    $id = (int) $id;
    if (!($md = elgg_get_metadata_from_id($id))) {
        return false;
    }
    // If memcached then we invalidate the cache for this entry
    static $metabyname_memcache;
    if (!$metabyname_memcache && is_memcache_available()) {
        $metabyname_memcache = new ElggMemcache('metabyname_memcache');
    }
    if ($metabyname_memcache) {
        $metabyname_memcache->delete("{$md->entity_guid}:{$md->name_id}");
    }
    $value_type = detect_extender_valuetype($value, sanitise_string(trim($value_type)));
    $owner_guid = (int) $owner_guid;
    if ($owner_guid == 0) {
        $owner_guid = elgg_get_logged_in_user_guid();
    }
    $access_id = (int) $access_id;
    // Support boolean types (as integers)
    if (is_bool($value)) {
        if ($value) {
            $value = 1;
        } else {
            $value = 0;
        }
    }
    // Add the metastring
    $value = elgg_get_metastring_id($value);
    if (!$value) {
        return false;
    }
    $name = elgg_get_metastring_id($name);
    if (!$name) {
        return false;
    }
    // If ok then add it
    $db_prefix = elgg_get_config('dbprefix');
    $result = update_data("UPDATE {$db_prefix}metadata set value_id='{$value}', value_type='{$value_type}', access_id={$access_id}, owner_guid={$owner_guid} where id={$id} and name_id='{$name}'");
    if ($result !== false) {
        $obj = elgg_get_metadata_from_id($id);
        if (elgg_trigger_event('update', 'metadata', $obj)) {
            return true;
        } else {
            elgg_delete_metadata(array('metadata_id' => $id));
        }
    }
    return $result;
}

function entity_view_counter_add_view(ElggEntity $entity)
{
    if (entity_view_counter_is_counted($entity)) {
        return;
    }
    if (is_memcache_available()) {
        $cache = new ElggMemcache('entity_view_counter');
        $key = "view_" . session_id() . "_" . $entity->guid;
        $cache->save($key, 1);
    }
    $guid = (int) $entity->guid;
    $type = sanitise_string($entity->type);
    $subtype = (int) $entity->subtype;
    insert_data("\r\n    \tINSERT INTO elgg_entity_views (guid, type, subtype, container_guid, site_guid, views)\r\n    \tVALUES ({$guid}, '{$type}', {$subtype}, {$entity->container_guid}, {$entity->site_guid}, 1)\r\n    \tON DUPLICATE KEY UPDATE views = views + 1;\r\n    ");
}