PHP secureMySQL函数代码示例

 function deposit($userid, $value, $description = '')
 {
     global $db;
     global $log;
     $db->insert($this->table, array("userid", "timestamp", "description", "value"), array((int) $userid, time(), "'" . secureMySQL($description) . "'", (int) $value));
     $log->add('credit', 'increased balance of user ' . $userid . ' by ' . $value . ' (currency)');
 }

 function registerFile($file)
 {
     global $db;
     $c = $db->num_rows($this->table, "`file`='" . secureMySQL($file) . "'");
     if ($c == 0) {
         $db->insert($this->table, array('file'), array("'" . secureMySQL($file) . "'"));
     }
 }

function addClanPrefix($userid, $prefix)
{
    global $db, $config;
    if ($config->get('clan', 'enable-prefix') == '1') {
        $sep = $config->get('clan', 'prefix-seperator');
        $oldnick = $db->selectOne('users', 'nickname', "`userid`=" . (int) $userid);
        $newnick = secureMySQL($prefix) . $sep . $oldnick;
        $db->update('users', "`nickname`='" . $newnick . "'", "`userid`=" . (int) $userid);
    }
}

 function add($mod, $description)
 {
     global $login;
     if ($this->file_enabled == 1) {
         $h = fopen($this->path, 'a');
         fwrite($h, '[ ' . date("d.m.Y") . " | " . date("H:i.s") . " ] userid = " . $this->makeSpace($login->currentUserID(), 4) . " mod = " . $this->makeSpace($mod, 14) . "  " . $description . "\r\n");
         fclose($h);
     }
     if ($this->mysql_enabled == 1) {
         global $db;
         $db->insert($this->table, array('userid', 'timestamp', 'mod', 'description'), array($login->currentUserID(), time(), "'" . secureMySQL($mod) . "'", "'" . secureMySQL($description) . "'"));
     }
 }

 function makeNews(&$comments, &$db, $table, $tbl_users, $start, $end, $title)
 {
     global $lng;
     $news = '';
     $result = $db->query("SELECT * FROM `" . $table . "`, `" . $tbl_users . "`\r\n\t\t\t\t\t\t\t\t\t\t\t\tWHERE `" . $table . "`.`userid` = `" . $tbl_users . "`.`userid` \r\n\t\t\t\t\t\t\t\t\t\t\t\tAND `timestamp`>" . $start . " \r\n\t\t\t\t\t\t\t\t\t\t\t\tAND `timestamp`<" . $end . " \r\n\t\t\t\t\t\t\t\t\t\t\t\tAND (`language` = '" . secureMySQL($lng) . "' OR `language` = '')\r\n\t\t\t\t\t\t\t\t\t\t\t\tAND (`domainid` = 0 OR `domainid` = " . getCurrentDomainIndex() . ")\r\n\t\t\t\t\t\t\t\t\t\t\t\tORDER BY `timestamp` DESC;");
     while ($row = mysql_fetch_assoc($result)) {
         $row['time'] = timeElapsed($row['timestamp']);
         $row['url'] = makeURL('news', array('newsid' => $row['newsid']));
         $row['text'] = stripslashes($row['text']);
         $row['title'] = stripslashes($row['title']);
         $row['user_url'] = makeURL('profile', array('userid' => $row['userid']));
         $row['comments'] = $comments->count('news', $row['newsid']);
         $news[] = $row;
     }
     return array('title' => $title, 'news' => $news, 'news_count' => mysql_num_rows($result));
 }

 function getConfigList($mod)
 {
     $sql = "SELECT * FROM `" . $this->table . "` WHERE `mod`='" . secureMySQL($mod) . "' ORDER BY `key` ASC;";
     $result = $this->db->query($sql);
     while ($row = mysql_fetch_assoc($result)) {
         if ($row['type'] == 'list') {
             $pos = strpos($row['description'], '|');
             if ($pos !== false) {
                 $row['list'] = explode(',', substr($row['description'], $pos + 1));
                 $row['description'] = substr($row['description'], 0, $pos);
             }
         }
         $o[] = $row;
         $pos = 0;
     }
     return $o;
 }

 function doLogin($email, $password, $save_login, $period = 86400)
 {
     global $log;
     global $config;
     global $user;
     $email = secureMySQL($email);
     if ($this->passwordValid($email, $password)) {
         $u = $user->getUserByEmail($email);
         if ($u['activated'] == 1 || $config->get('login', 'register-activation-required') == 0) {
             $_SESSION['email'] = $email;
             $_SESSION['password'] = $password;
             if ($save_login == '1' && $config->get('core', 'save-login-disabled') == 0) {
                 setcookie('hfh_email', $email, time() + 31536000);
                 setcookie('hfh_password', $password, time() + 31536000);
             }
             $log->add('login', 'valid login by ' . $email);
             return true;
         }
     } else {
         $log->add('login', 'login by ' . $email . ' failed');
         return false;
     }
 }

        $search = '/(' . $item . ')/i';
        $replace = '<span style="background-color:#FFD800;">$1</span>';
        $haystack = preg_replace($search, $replace, $haystack);
    }
    return $haystack;
}
foreach ($engines as $e) {
    if ($e['key'] == '' || $e['key'] == 'users' || $this->isInstalled($e['key'])) {
        $t['key'] = $e['key'];
        $t['name'] = $e['name'];
        $engines2[] = $t;
    }
}
$smarty->assign('engines', $engines2);
@$smarty->assign('engine', $_GET['engine']);
@($search_string = trim(secureMySQL($_GET['q'])));
$smarty->assign('search_string', $search_string);
if (strlen($search_string) >= 3 || $search_string == '') {
    // Search button has been pressed
    if ((isset($_GET['find']) || isset($_GET['find_x']) || isset($_GET['q'])) && count($engines) > 0 && $search_string != '') {
        $results = array();
        if (@$_GET['engine'] == '') {
            foreach ($engines as $i => $e) {
                if ($e['key'] == 'users' || $this->isInstalled($e['key'])) {
                    if ($e['key'] != '') {
                        require_once $mod_dir . "/engines/" . $e['file'];
                        $result = call_user_func($e['key'], $search_string);
                        if (count($result) > 0) {
                            $results = array_merge($results, $result);
                        }
                    }

<?php

$tbl_users = MYSQL_TABLE_PREFIX . 'users';
$tbl_register = MYSQL_TABLE_PREFIX . 'register';
$event = $db->selectOneRow($tbl_register, "*", "eventid=" . (int) $_GET['eventid']);
$result = $db->query("SELECT * FROM `" . $tbl_users . "` AS U \r\n\t\t\t\t\tWHERE \r\n\t\t\t\t\t(INSTR(U.`nickname`, '" . secureMySQL($_GET['search_string']) . "') > 0\r\n\t\t\t\t\tOR INSTR(U.`prename`, '" . secureMySQL($_GET['search_string']) . "') > 0\r\n\t\t\t\t\tOR INSTR(U.`lastname`, '" . secureMySQL($_GET['search_string']) . "') > 0)\r\n\t\t\t\t\tLIMIT 5;");
while ($row = mysql_fetch_assoc($result)) {
    $dummy = $row;
    $registered = $db->selectOneRow($tbl_register, '*', "userid=" . $dummy['userid'] . " AND eventid=" . (int) $_GET['eventid']);
    $dummy['reserve'] = (@$event['free'] == 1 or $registered['payed'] > 0);
    $dummy['sitdown'] = $registered['appeared'] != 0;
    $l[] = $dummy;
}
$lang->addModSpecificLocalization('room');
$smarty->assign('seatable', $lang->get('seatable'));
$smarty->assign('search_string', $_GET['search_string']);
$smarty->assign('list', @$l);
$smarty->display('../mod/default/room/userlist.tpl');

     if (count($c) > 0) {
         foreach ($c as $question) {
             // delete?
             if ($_POST['delete_' . $question['id']] == "1") {
                 $db->query("DELETE FROM " . $table . " WHERE id=" . intval($question['id']));
             } else {
                 $db->query("UPDATE " . $table . " SET faqorder=" . intval($_POST['order_' . $question['id']]) . " WHERE id=" . intval($question['id']));
             }
         }
     }
     // add new element
 } elseif (isset($_POST['submit'])) {
     if ($_POST['sid'] > 0) {
         $db->query("UPDATE " . $table . " SET faqorder=" . intval($_POST['new_order']) . ", question='" . secureMySQL($_POST['new_question']) . "', answer='" . secureMySQL($_POST['new_answer']) . "' WHERE id=" . intval($_POST['sid']));
     } else {
         $db->query("INSERT INTO " . $table . " VALUES (NULL,'" . intval($_POST['new_order']) . "','" . secureMySQL($_POST['new_question']) . "','" . secureMySQL($_POST['new_answer']) . "')");
     }
     //EDIT Element
 } elseif (isset($_GET['edit'])) {
     $edit = $db->selectOneRow($table, "*", "id=" . intval($_GET['edit']));
     $smarty->assign('edit', $edit);
 }
 // get questions
 $rows = $db->selectList($table, '*', 'true', '');
 if ($rows) {
     foreach ($rows as $row) {
         $row['edit'] = makeURL($mod, array('mode' => 'admin', 'edit' => $row['id']));
         $list[] = $row;
     }
     $smarty->assign('list', $list);
 }

 function activate($key)
 {
     global $notify;
     global $lang;
     $sql = "UPDATE `" . $this->table . "` SET `activated`=1 WHERE `activation_key`='" . secureMySQL($key) . "';";
     $this->db->query($sql);
     $notify->add($lang->get('login'), $lang->get('account_activated'));
 }

<?php

@($score = (int) $_GET['score']);
@($lines = (int) $_GET['lines']);
@($level = (int) $_GET['level']);
@($nick = secureMySQL($_GET['nickname']));
@($field = secureMySQL($_GET['field']));
$db->insert('tetris_chat', array('type', 'nickname', 'text'), array(1, "'" . $nick . "'", "'died.'"));
$db->update('tetris_player', "`field`='" . $field . "'", "`nickname`='" . $nick . "'");
if ($db->num_rows('tetris_player', '`alive` > 0') == 2) {
    $winner = $db->selectOneRow('tetris_player', '*', "`alive`=1 && `nickname`!='" . $nick . "'");
    $db->insert('tetris_chat', array('type', 'nickname', 'text'), array('1', "'" . $winner['nickname'] . "'", "'[Wins!]'"));
    $db->update('tetris_player', '`wins`=`wins`+1', "`nickname`='" . $winner['nickname'] . "'");
}
if ($score < 100) {
    die;
}
$user = $db->selectOneRow('tetris_player', '*', "`nickname`= '" . $nick . "'");
// validate if the reported highscore could be possible
if ($level - 1 > $user['level'] || $score * 0.8 > $user['score']) {
    die;
}
$db->insert(MYSQL_TABLE_PREFIX . 'tetris_highscore', array('nickname', 'score', 'lines', 'level', 'timestamp'), array("'" . $nick . "'", $score, $lines, $level, time()));

             $log->add($mod, 'content ' . $_GET['key'] . ' updated');
             $smarty->assign('locked', true);
             unset($_GET['version']);
             redirect(makeURL($mod, array('mode' => 'content', 'action' => 'edit', 'key' => $_GET['key'])));
         } else {
             $notify->add($lang->get('error'), $lang->get('content_error'));
         }
     }
     $ver = isset($_GET['version']) ? (int) $_GET['version'] : -1;
     $page = $content->getPage($_GET['key'], $ver);
     if ($ver == -1) {
         $ver = $page['version'];
     }
     @$smarty->assign('selected_version', $ver);
     $smarty->assign('content', $page);
     $assigned_groups = array_row($db->selectList('content_permissions', '*', "`key`='" . secureMySQL($_GET['key']) . "'"), 'groupid');
     $smarty->assign('permissions', $assigned_groups);
     $breadcrumbs->addElement($page['title'], makeURL($_GET['key']));
     $breadcrumbs->addElement($lang->get('edit'), makeURL($mod, array('mode' => 'content', 'action' => 'edit', 'key' => $_GET['key'])));
     $smarty->assign('path', $template_dir . "/content.edit.tpl");
     break;
 case 'remove':
     if (isset($_POST['yes'])) {
         $content->removePage($_GET['key']);
         $notify->add($lang->get('content'), $lang->get('content_removed'));
         $log->add($mod, 'content ' . $_GET['key'] . ' removed');
     } else {
         $breadcrumbs->addElement($lang->get('remove'), makeURL($mod, array('mode' => 'content', 'action' => 'remove', 'key' => $_GET['key'])));
         $smarty->assign('url_no', makeURL($mod, array('mode' => 'content')));
         $smarty->assign('path', $template_dir . "/content.remove.tpl");
         break;

     // save new data
     $start_date = @explode("/", $_POST['start_date']);
     $end_date = @explode("/", $_POST['end_date']);
     $start = mktime((int) $_POST['start_Hour'], (int) $_POST['start_Minute'], 0, (int) $start_date[0], (int) $start_date[1], (int) $start_date[2]);
     $end = mktime((int) $_POST['end_Hour'], (int) $_POST['end_Minute'], 0, (int) $end_date[0], (int) $end_date[1], (int) $end_date[2]);
     $fifteen_min = 15 * 60;
     if ($end - $start < $fifteen_min) {
         $end = $end + $fifteen_min;
     }
     if (count($start_date) == 3 && count($end_date) == 3 && trim($_POST['title']) != '') {
         if ($start >= $end) {
             $tmp = $start;
             $start = $end;
             $end = $tmp;
         }
         $db->update($tbl, "`title`='" . secureMySQL($_POST['title']) . "',\r\n\t\t\t\t\t\t\t\t\t`start`=" . $start . ", `end`=" . $end . ", `visible`=" . (int) $_POST['visibility'] . ",\r\n\t\t\t\t\t\t\t\t\t`description`='" . secureMySQL($_POST['description']) . "',\r\n\t\t\t\t\t\t\t\t\t`language`='" . secureMySQL($_POST['language']) . "',\r\n\t\t\t\t\t\t\t\t\t`categoryId`='" . secureMySQL((int) $_POST['category']) . "'", "`calendarid`=" . $calendarid);
         writeExport();
         redirect(makeURL($mod, array('day' => $start, 'view' => $view)));
     } else {
         $notify->add($lang->get('calendar'), $lang->get('new_calendar_entry_fill'));
     }
     $entry['title'] = $_POST['title'];
     $entry['start'] = $start;
     $entry['start_date'] = $_POST['start_date'];
     $entry['end'] = $end;
     $entry['end_date'] = $_POST['end_date'];
     $entry['description'] = $_POST['description'];
     $entry['visible'] = $_POST['visibility'];
     $entry['category'] = $_POST['category'];
     redirect(makeURL($mod));
 }

 case 'add':
     if ($isAllowed) {
         $smarty->assign('domains', getDomainList());
         $smarty->assign('languages', array_merge(array('' => ''), $lang->listLanguages()));
         $breadcrumbs->addElement($lang->get('manage_movies'), makeURL($mod, array('mode' => 'manage')));
         if ($mode == 'add') {
             $breadcrumbs->addElement($lang->get('add'), makeURL($mod, array('mode' => 'add')));
         } else {
             $breadcrumbs->addElement($lang->get('edit'), makeURL($mod, array('mode' => 'edit', 'movieid' => $movieid)));
         }
         if (isset($_POST['save'])) {
             if ($movieid == 0) {
                 $db->insert('movies', array('title', 'description', 'urlid', 'order', 'thumbnail', 'language', 'hidden', 'domainid'), array("'" . $_POST['title'] . "'", "'" . $_POST['description'] . "'", "'" . $_POST['urlid'] . "'", (int) $_POST['order'], (int) $_POST['thumbnail'], "'" . $_POST['language'] . "'", @(int) $_POST['hidden'], @(int) $_POST['domainid']));
                 redirect(makeURL($mod, array('mode' => 'manage')));
             } else {
                 $db->update('movies', "`title`='" . secureMySQL($_POST['title']) . "',\r\n\t\t\t\t\t\t\t`description`='" . secureMySQL($_POST['description']) . "',\r\n\t\t\t\t\t\t\t`urlid`='" . secureMySQL($_POST['urlid']) . "',\r\n\t\t\t\t\t\t\t`order`=" . (int) $_POST['order'] . ",\r\n\t\t\t\t\t\t\t`thumbnail`=" . (int) $_POST['thumbnail'] . ",\r\n\t\t\t\t\t\t\t`language`='" . secureMySQL($_POST['language']) . "',\r\n\t\t\t\t\t\t\t`hidden`=" . @(int) $_POST['hidden'] . ",\r\n\t\t\t\t\t\t\t`domainid`=" . @(int) $_POST['domainid'], "`movieid`=" . $movieid);
             }
         }
         if ($movieid > 0) {
             $movie = $db->selectOneRow('movies', '*', 'movieid = ' . $movieid);
             $smarty->assign('movie', $movie);
         }
         $smarty->assign('path', $template_dir . '/manage_movie.tpl');
     }
     break;
 case 'manage':
     if ($isAllowed) {
         $breadcrumbs->addElement($lang->get('manage_movies'), makeURL($mod, array('mode' => 'manage')));
         $movies = $db->selectList('movies', '*', '1', '`order` ASC');
         $smarty->assign('movies', $movies);
         $smarty->assign('path', $template_dir . '/manage.tpl');