PHP sqlesc函数代码示例

 function set_count_so_far()
 {
     $userid = $this->userid;
     $now = date("Y-m-d H:i:s", TIMENOW - 86400);
     $countsofar = get_row_count("attachments", "WHERE userid=" . sqlesc($userid) . " AND added > " . sqlesc($now));
     $this->countsofar = $countsofar;
 }

function autoshout($msg)
{
    global $INSTALLER09, $mc1;
    require_once INCL_DIR . 'bbcode_functions.php';
    sql_query('INSERT INTO shoutbox(userid,date,text,text_parsed,autoshout)VALUES (' . $INSTALLER09['bot_id'] . ',' . TIME_NOW . ',' . sqlesc($msg) . ',' . sqlesc(format_comment($msg)) . ', "yes")');
    $mc1->delete_value('auto_shoutbox_');
}

function deletetorrent($id)
{
    global $INSTALLER09, $mc1, $CURUSER, $lang;
    sql_query("DELETE peers.*, files.*, comments.*, snatched.*, thanks.*, bookmarks.*, coins.*, rating.*, torrents.* FROM torrents \n\t\t\t\t LEFT JOIN peers ON peers.torrent = torrents.id\n\t\t\t\t LEFT JOIN files ON files.torrent = torrents.id\n\t\t\t\t LEFT JOIN comments ON comments.torrent = torrents.id\n\t\t\t\t LEFT JOIN thanks ON thanks.torrentid = torrents.id\n\t\t\t\t LEFT JOIN bookmarks ON bookmarks.torrentid = torrents.id\n\t\t\t\t LEFT JOIN coins ON coins.torrentid = torrents.id\n\t\t\t\t LEFT JOIN rating ON rating.torrent = torrents.id\n\t\t\t\t LEFT JOIN snatched ON snatched.torrentid = torrents.id\n\t\t\t\t WHERE torrents.id =" . sqlesc($id)) or sqlerr(__FILE__, __LINE__);
    unlink("{$INSTALLER09['torrent_dir']}/{$id}.torrent");
    $mc1->delete_value('MyPeers_' . $CURUSER['id']);
}

function addspam($type, $rlsname, $url, $filename, $fromnet, $ann = true)
{
    global $mc;
    $whichdb = array('ADDNFO' => 'nfosdb', 'OLDNFO' => 'nfosdb', 'ADDSFV' => 'sfvsdb', 'OLDSFV' => 'sfvsdb', 'ADDM3U' => 'm3usdb', 'OLDM3U' => 'm3usdb');
    $w = mysql_query("SELECT COUNT(id) AS tid FROM " . $whichdb[$type] . " WHERE rlsname = " . sqlesc($rlsname) . "") or exit("Err1 " . mysql_error());
    $qw = mysql_fetch_assoc($w);
    if ($qw['tid'] == 0) {
        $a = get_url_data(trim($url));
        $size = $a['size'] == 0 ? strlen($a['data']) : $a['size'];
        if ($size == 0 || $size < 25 || $a['error'] == 404 || $a['data'] == "") {
            return 'URL FAIL';
        } else {
            $crc = strtoupper(dechex(crc32($a['data'])));
            $newdata = gzcompress($a['data'], 9);
            $grp = explode("-", $rlsname);
            $grp = $grp[count($grp) - 1];
            $fromdata = explode(":", trim($fromnet));
            $fromdata[1] = "#" . $fromdata[1];
            mysql_query("INSERT INTO " . $whichdb[$type] . " ( `rlsname` , `grp` , `time` , `data` , `filename` , `size` ) VALUES (" . sqlesc($rlsname) . "," . sqlesc($grp) . "," . time() . "," . sqlesc($newdata) . "," . sqlesc($filename) . "," . sqlesc($size) . ")") or exit('Err2 ' . mysql_error());
            $id = mysql_insert_id();
            mysql_query("INSERT INTO fromspamdata ( `spamid` , `type` , `time` , `nick` , `chan` , `network` ) VALUES (" . $id . "," . sqlesc($type) . "," . time() . "," . sqlesc($fromdata[0]) . "," . sqlesc($fromdata[1]) . "," . sqlesc($fromdata[2]) . ")") or exit('Err3 ' . mysql_error());
            if ($ann == true) {
                $mcdata = array('ID' => $id, 'TYPE' => $type);
                $hash1 = md5($id . $type . $rlsname . $url);
                $hash2 = md5(md5($filename . time()) . time() . $rlsname);
                $key = md5(md5($hash1 . $hash2) . md5($hash2 . $hash1));
                $mc->set($key, $mcdata, false, 300) or die("Failed to save data at memcache server");
                return $key . " " . $crc . " " . $size;
            } else {
                return;
            }
        }
    }
}

function file_list($arr, $id)
{
    foreach ($arr as $v) {
        $new[] = "({$id}," . sqlesc($v[0]) . "," . $v[1] . ")";
    }
    return join(",", $new);
}

function docleanup($data)
{
    global $INSTALLER09, $queries, $bdir;
    set_time_limit(0);
    ignore_user_abort(1);
    $mysql_host = $INSTALLER09['mysql_host'];
    $mysql_user = $INSTALLER09['mysql_user'];
    $mysql_pass = $INSTALLER09['mysql_pass'];
    $mysql_db = $INSTALLER09['mysql_db'];
    $bdir = $_SERVER["DOCUMENT_ROOT"] . "/include/backup";
    $c1 = "mysqldump -h " . $mysql_host . " -u " . $mysql_user . " -p" . $mysql_pass . " " . $mysql_db . " -d > " . $bdir . "/db_structure.sql";
    $c = "mysqldump -h " . $mysql_host . " -u " . $mysql_user . " -p" . $mysql_pass . " " . $mysql_db . " " . tables("peers|messages|sitelog") . " | bzip2 -cq9 > " . $bdir . "/db_" . date("m_d_y", TIME_NOW) . ".sql.bz2";
    system($c1);
    system($c);
    $files = glob($bdir . "/db_*");
    foreach ($files as $file) {
        if (TIME_NOW - filemtime($file) > 3 * 86400) {
            unlink($file);
        }
    }
    $ext = "db_" . date("m_d_y", TIME_NOW) . ".sql.bz2";
    sql_query("INSERT INTO dbbackup (name, added, userid) VALUES (" . sqlesc($ext) . ", " . TIME_NOW . ", " . $INSTALLER09['site']['owner'] . ")") or sqlerr(__FILE__, __LINE__);
    if ($queries > 0) {
        write_log("Auto-dbbackup----------------------Auto Back Up Complete using {$queries} queries---------------------");
    }
    if (false !== mysqli_affected_rows($GLOBALS["___mysqli_ston"])) {
        $data['clean_desc'] = mysqli_affected_rows($GLOBALS["___mysqli_ston"]) . " items deleted/updated";
    }
    if ($data['clean_log']) {
        cleanup_log($data);
    }
}

function iUsers($iname, $ipass, $imail)
{
    global $admin_file, $CURUSER;
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        list($iclass) = mysql_fetch_row(sql_query('SELECT class FROM users WHERE username = ' . sqlesc($iname)));
        if (get_user_class() <= $iclass) {
            stdmsg("Ошибка", "Смена пароля завершилась неудачей! Вы пробовали изменить учетные данные пользователя выше. Действие записано в логахъ.", "error");
            write_log('Администратор ' . $CURUSER['username'] . ' пробовал изменить учетные данные пользователя ' . $iname . ' классом выше!', 'red', 'error');
        } else {
            $updateset = array();
            if (!empty($ipass)) {
                $secret = mksecret();
                $hash = md5($secret . $ipass . $secret);
                $updateset[] = "secret = " . sqlesc($secret);
                $updateset[] = "passhash = " . sqlesc($hash);
            }
            if (!empty($imail) && validemail($imail)) {
                $updateset[] = "email = " . sqlesc($imail);
            }
            if (count($updateset)) {
                $res = sql_query("UPDATE users SET " . implode(", ", $updateset) . " WHERE username = " . sqlesc($iname)) or sqlerr(__FILE__, __LINE__);
            }
            if (mysql_modified_rows() < 1) {
                stdmsg("Ошибка", "Смена пароля завершилась неудачей! Возможно указано несуществующее имя пользователя.", "error");
            } else {
                stdmsg("Изменения пользователя прошло успешно", "Имя пользователя: " . $iname . (!empty($hash) ? "<br />Новый пароль: " . $ipass : "") . (!empty($imail) ? "<br />Новая почта: " . $imail : ""));
            }
        }
    } else {
        echo "<form method=\"post\" action=\"" . $admin_file . ".php?op=iUsers\">" . "<table border=\"0\" cellspacing=\"0\" cellpadding=\"3\">" . "<tr><td class=\"colhead\" colspan=\"2\">Смена пароля</td></tr>" . "<tr>" . "<td><b>Пользователь</b></td>" . "<td><input name=\"iname\" type=\"text\"></td>" . "</tr>" . "<tr>" . "<td><b>Новый пароль</b></td>" . "<td><input name=\"ipass\" type=\"password\"></td>" . "</tr>" . "<tr>" . "<td><b>Новая почта</b></td>" . "<td><input name=\"imail\" type=\"text\"></td>" . "</tr>" . "<tr><td colspan=\"2\" align=\"center\"><input type=\"submit\" name=\"isub\" value=\"Сделать\"></td></tr>" . "</table>" . "<input type=\"hidden\" name=\"op\" value=\"iUsers\" />" . "</form>";
    }
}

function comment_like_unlike()
{
    global $CURUSER, $type, $tb_fields, $the_id, $banned_users, $disabled_time;
    $userip = $_SERVER['REMOTE_ADDR'];
    $res = sql_query("SELECT user_likes,disabled_time FROM " . $tb_fields[$type[0]] . " LEFT OUTER JOIN manage_likes ON manage_likes.user_id = " . sqlesc($CURUSER['id']) . " WHERE " . $tb_fields[$type[0]] . ".id = " . sqlesc($the_id) . "") or sqlerr(__FILE__, __LINE__);
    $data = mysqli_fetch_row($res);
    if ($data[1] + $disabled_time > time()) {
        die($lang['ajlike_you_been_disabled']);
    } elseif (in_array($CURUSER['id'], $banned_users)) {
        die($lang['ajlike_you_been_banned']);
    }
    $exp = explode(',', $data[0]);
    if ($res && $type[1] == 'like' && array_key_exists($type[0], $tb_fields)) {
        if (!in_array($CURUSER['id'], $exp)) {
            $res2 = sql_query("UPDATE " . $tb_fields[$type[0]] . " SET user_likes = IF(LENGTH(user_likes),CONCAT(user_likes,','," . sqlesc((string) $CURUSER['id']) . ")," . sqlesc((string) $CURUSER['id']) . ") WHERE id = " . sqlesc($the_id) . "") or sqlerr(__FILE__, __LINE__);
        } else {
            die($lang['ajlike_you_already_liked']);
        }
    } elseif ($res && $type[1] == 'unlike' && array_key_exists($type[0], $tb_fields)) {
        if (in_array($CURUSER['id'], $exp)) {
            $key = array_search($CURUSER['id'], $exp);
            unset($exp[$key]);
            $exp = implode(",", $exp);
            $res2 = sql_query("UPDATE " . $tb_fields[$type[0]] . " SET user_likes = " . sqlesc($exp) . "WHERE id = " . sqlesc($the_id) . "") or sqlerr(__FILE__, __LINE__);
        } else {
            die($lang['ajlike_you_already_unliked']);
        }
    } else {
        die($lang['ajlike_get_lost']);
    }
}

function docleanup($data)
{
    global $INSTALLER09, $queries, $mc1;
    set_time_limit(1200);
    ignore_user_abort(1);
    //== delete torrents - ????
    $days = 30;
    $dt = TIME_NOW - $days * 86400;
    sql_query("UPDATE torrents SET flags='1' WHERE added < {$dt} AND seeders='0' AND leechers='0'") or sqlerr(__FILE__, __LINE__);
    $res = sql_query("SELECT id, name FROM torrents WHERE mtime < {$dt} AND seeders='0' AND leechers='0' AND flags='1'") or sqlerr(__FILE__, __LINE__);
    while ($arr = mysqli_fetch_assoc($res)) {
        sql_query("DELETE files.*, comments.*, thankyou.*, thanks.*, thumbsup.*, bookmarks.*, coins.*, rating.*, xbt_files_users.* FROM xbt_files_users\n                                 LEFT JOIN files ON files.torrent = xbt_files_users.fid\n                                 LEFT JOIN comments ON comments.torrent = xbt_files_users.fid\n                                 LEFT JOIN thankyou ON thankyou.torid = xbt_files_users.fid\n                                 LEFT JOIN thanks ON thanks.torrentid = xbt_files_users.fid\n                                 LEFT JOIN bookmarks ON bookmarks.torrentid = xbt_files_users.fid\n                                 LEFT JOIN coins ON coins.torrentid = xbt_files_users.fid\n                                 LEFT JOIN rating ON rating.torrent = xbt_files_users.fid\n                                 LEFT JOIN thumbsup ON thumbsup.torrentid = xbt_files_users.fid\n                                 WHERE xbt_files_users.fid =" . sqlesc($arr['id'])) or sqlerr(__FILE__, __LINE__);
        @unlink("{$INSTALLER09['torrent_dir']}/{$arr['id']}.torrent");
        write_log("Torrent " . (int) $arr['id'] . " (" . htmlsafechars($arr['name']) . ") was deleted by system (older than {$days} days and no seeders)");
    }
    if ($queries > 0) {
        write_log("Delete Old Torrents XBT Clean -------------------- Delete Old XBT Torrents cleanup Complete using {$queries} queries --------------------");
    }
    if (false !== mysqli_affected_rows($GLOBALS["___mysqli_ston"])) {
        $data['clean_desc'] = mysqli_affected_rows($GLOBALS["___mysqli_ston"]) . " items deleted/updated";
    }
    if ($data['clean_log']) {
        cleanup_log($data);
    }
}

/**
|--------------------------------------------------------------------------|
|   https://github.com/Bigjoos/                                |
|--------------------------------------------------------------------------|
|   Licence Info: GPL                                              |
|--------------------------------------------------------------------------|
|   Copyright (C) 2010 U-232 V5                        |
|--------------------------------------------------------------------------|
|   A bittorrent tracker source based on TBDev.net/tbsource/bytemonsoon.   |
|--------------------------------------------------------------------------|
|   Project Leaders: Mindless, Autotron, whocares, Swizzles.                       |
|--------------------------------------------------------------------------|
 _   _   _   _   _     _   _   _   _   _   _     _   _   _   _
/ \ / \ / \ / \ / \   / \ / \ / \ / \ / \ / \   / \ / \ / \ / \
( U | - | 2 | 3 | 2 )-( S | o | u | r | c | e )-( C | o | d | e )
\_/ \_/ \_/ \_/ \_/   \_/ \_/ \_/ \_/ \_/ \_/   \_/ \_/ \_/ \_/
*/
function docleanup($data)
{
    global $INSTALLER09, $queries, $mc1;
    set_time_limit(0);
    ignore_user_abort(1);
    //== Delete snatched
    $dt = TIME_NOW - 30 * 86400;
    sql_query("DELETE FROM snatched WHERE complete_date < " . sqlesc($dt)) or sqlerr(__FILE__, __LINE__);
    if (false !== mysqli_affected_rows($GLOBALS["___mysqli_ston"])) {
        $data['clean_desc'] = mysqli_affected_rows($GLOBALS["___mysqli_ston"]) . " items deleted/updated";
    }
    $snatchedcounts = array();
    $snatchedres = sql_query("SELECT torrentid, COUNT(*) AS count FROM snatched WHERE complete_date > 0 GROUP BY torrentid");
    while ($row = mysqli_fetch_assoc($snatchedres)) {
        $snatchedcounts[$row['torrentid']] = (int) $row['count'];
    }
    $tcompletedres = sql_query("SELECT id, times_completed FROM torrents");
    while ($row2 = mysqli_fetch_assoc($tcompletedres)) {
        if (!array_key_exists($row2['id'], $snatchedcounts) || array_key_exists($row2['id'], $snatchedcounts) && $row2['times_completed'] != $snatchedcounts[$row2['id']]) {
            sql_query("UPDATE torrents SET times_completed = " . $snatchedcounts[$row2['id']] . " WHERE id = " . $row2['id']);
            ++$snatchedcounts;
        }
    }
    if ($queries > 0) {
        write_log("Snatch list clean-------------------- Removed snatches not seeded for 99 days. Cleanup Complete using {$queries} queries --------------------");
    }
    if ($data['clean_log']) {
        cleanup_log($data);
    }
}

function docleanup($data)
{
    global $INSTALLER09, $queries, $mc1;
    set_time_limit(0);
    ignore_user_abort(1);
    //== Delete old backup's
    $days = 3;
    $res = sql_query("SELECT id, name FROM dbbackup WHERE added < " . sqlesc(TIME_NOW - $days * 86400)) or sqlerr(__FILE__, __LINE__);
    if (mysqli_num_rows($res) > 0) {
        $ids = array();
        while ($arr = mysqli_fetch_assoc($res)) {
            $ids[] = (int) $arr['id'];
            $filename = $INSTALLER09['backup_dir'] . '/' . $arr['name'];
            if (is_file($filename)) {
                unlink($filename);
            }
        }
        sql_query('DELETE FROM dbbackup WHERE id IN (' . implode(', ', $ids) . ')') or sqlerr(__FILE__, __LINE__);
    }
    //== end
    if ($queries > 0) {
        write_log("Backup Clean -------------------- Backup Clean Complete using {$queries} queries--------------------");
    }
    if (false !== mysqli_affected_rows($GLOBALS["___mysqli_ston"])) {
        $data['clean_desc'] = mysqli_affected_rows($GLOBALS["___mysqli_ston"]) . " items deleted/updated";
    }
    if ($data['clean_log']) {
        cleanup_log($data);
    }
}

function print_list()
{
    global $uid, $tid, $ajax;
    $target = $ajax ? '_self' : '_parent';
    $qt = sql_query("SELECT th.userid, u.username, u.seedbonus FROM thanks as th INNER JOIN users as u ON u.id=th.userid WHERE th.torrentid=" . sqlesc($tid) . " ORDER BY u.class DESC") or sqlerr(__FILE__, __LINE__);
    $list = array();
    $hadTh = false;
    if (mysqli_num_rows($qt) > 0) {
        while ($a = mysqli_fetch_assoc($qt)) {
            $list[] = '<a href=\'userdetails.php?id=' . (int) $a['userid'] . '\' target=\'' . $target . '\'>' . htmlsafechars($a['username']) . '</a>';
            $ids[] = (int) $a['userid'];
        }
        $hadTh = in_array($uid, $ids) ? true : false;
    }
    if ($ajax) {
        return json_encode(array('list' => count($list) > 0 ? join(', ', $list) : 'Not yet', 'hadTh' => $hadTh, 'status' => true));
    } else {
        $form = !$hadTh ? "<br/><form action='thanks.php' method='post'><input type='submit' class='btn' name='submit' value='Say thanks' /><input type='hidden' name='torrentid' value='{$tid}' /><input type='hidden' name='action' value='add' /></form>" : "";
        $out = count($list) > 0 ? join(', ', $list) : 'Not yet';
        return <<<IFRAME
        
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<style type='text/css'>
body { margin:0;padding:0; 
\t   font-size:12px;
\t   font-family:arial,sans-serif;
\t   color: #FFFFFF;
}
a, a:link, a:visited {
  text-decoration: none;
  color: #FFFFFF;
  font-size:12px;
}
a:hover {
  color: #FFFFFF
  text-decoration:underline;
  
}
.btn {
background-color:#890537;
border:1px solid #000000;
color:#FFFFFF;
font-family:arial,sans-serif;
font-size:12px;
padding:1px 3px;
}
</style>
<title>::</title>
</head>
<body>
{$out}{$form}
</body>
</html>

IFRAME;
    }
}

function getpage()
{
    global $CURUSER;
    $page = getenv("SCRIPT_NAME");
    if ($CURUSER && $CURUSER["page_now"] != $page) {
        sql_query("UPDATE users SET page_now = " . sqlesc($page) . " WHERE id = {$CURUSER['id']}") or sqlerr(__FILE__, __LINE__);
    }
}

function cleanup_log($data)
{
    $text = sqlesc($data['clean_title']);
    $added = TIME_NOW;
    $ip = sqlesc($_SERVER['REMOTE_ADDR']);
    $desc = sqlesc($data['clean_desc']);
    sql_query("INSERT INTO cleanup_log (clog_event, clog_time, clog_ip, clog_desc) VALUES ({$text}, {$added}, {$ip}, {$desc})") or sqlerr(__FILE__, __LINE__);
}

function deletetorrent_xbt($id)
{
    global $INSTALLER09, $mc1, $CURUSER, $lang;
    sql_query("UPDATE torrents SET flags = 1 WHERE id = " . sqlesc($id)) or sqlerr(__FILE__, __LINE__);
    sql_query("DELETE files.*, comments.*, thankyou.*, thanks.*, thumbsup.*, bookmarks.*, coins.*, rating.*, xbt_files_users.* FROM xbt_files_users\n                                     LEFT JOIN files ON files.torrent = xbt_files_users.fid\n                                     LEFT JOIN comments ON comments.torrent = xbt_files_users.fid\n                                     LEFT JOIN thankyou ON thankyou.torid = xbt_files_users.fid\n                                     LEFT JOIN thanks ON thanks.torrentid = xbt_files_users.fid\n                                     LEFT JOIN bookmarks ON bookmarks.torrentid = xbt_files_users.fid\n                                     LEFT JOIN coins ON coins.torrentid = xbt_files_users.fid\n                                     LEFT JOIN rating ON rating.torrent = xbt_files_users.fid\n                                     LEFT JOIN thumbsup ON thumbsup.torrentid = xbt_files_users.fid\n                                     WHERE xbt_files_users.fid =" . sqlesc($id)) or sqlerr(__FILE__, __LINE__);
    unlink("{$INSTALLER09['torrent_dir']}/{$id}.torrent");
    $mc1->delete_value('MyPeers_XBT_' . $CURUSER['id']);
}