PHP stripsearchkey函数代码示例

 public function fetch_all_validate_uid($submittimes = '', $regdate = '', $moddate = '', $regip = '')
 {
     $sql = 'm.groupid=8';
     $sql .= $submittimes ? ' AND v.submittimes>' . intval($submittimes) : '';
     $sql .= $regdate ? ' AND m.regdate<' . (TIMESTAMP - intval($regdate) * 86400) : '';
     $sql .= $moddate ? ' AND v.moddate<' . (TIMESTAMP - intval($moddate) * 86400) : '';
     $sql .= ($regip = stripsearchkey(addslashes((string) $regip))) ? " AND m.regip LIKE '" . $regip . "%'" : '';
     return DB::fetch_all("SELECT v.uid FROM " . DB::table('common_member_validate') . " v, " . DB::table('common_member') . " m\n\t\t\tWHERE {$sql} AND m.uid=v.uid", null, 'uid');
 }

 public function count_by_type_find($type = null, $find = null)
 {
     $parameter = array($this->_table);
     $wherearr = array();
     if ($type !== null) {
         $parameter[] = $type;
         $wherearr[] = "`type`=%d";
     }
     if ($find !== null) {
         $parameter[] = '%' . addslashes(stripsearchkey($find)) . '%';
         $wherearr[] = "`find` LIKE %s";
     }
     $wheresql = !empty($wherearr) && is_array($wherearr) ? ' WHERE ' . implode(' AND ', $wherearr) : '';
     return DB::result_first("SELECT COUNT(*) FROM %t {$wheresql}", $parameter);
 }

 public function fetch_all_for_search($cid, $ctid, $username, $uid, $useip, $rate, $message, $starttime, $endtime, $start = 0, $limit = 20)
 {
     $where = '1';
     $where .= $cid ? ' AND ' . DB::field('cid', $cid) : '';
     $where .= $ctid ? ' AND ' . DB::field('ctid', $ctid) : '';
     $where .= $username ? ' AND ' . DB::field('username', '%' . stripsearchkey($username) . '%', 'like') : '';
     $where .= $uid ? ' AND ' . DB::field('uid', $uid) : '';
     $where .= $useip ? ' AND ' . DB::field('useip', stripsearchkey($useip) . '%', 'like') : '';
     $where .= $rate ? ' AND ' . DB::field('rate', $rate, '>') : '';
     $where .= $message ? ' AND ' . DB::field('message', '%' . stripsearchkey($message) . '%', 'like') : '';
     $where .= $starttime != '' ? ' AND ' . DB::field('dateline', $starttime, '>') : '';
     $where .= $endtime != '' ? ' AND ' . DB::field('dateline', $endtime, '<') : '';
     if ($start == -1) {
         return DB::result_first("SELECT count(*) FROM %t WHERE %i", array($this->_table, $where));
     }
     return DB::fetch_all("SELECT * FROM %t WHERE %i ORDER BY dateline DESC %i", array($this->_table, $where, DB::limit($start, $limit)));
 }

function getwheres($intkeys, $strkeys, $randkeys, $likekeys, $pre='') {
	
	$wherearr = array();
	$urls = array();
	
	foreach ($intkeys as $var) {
		$value = isset($_GET[$var])?$_GET[$var]:'';
		if(strlen($value)) {
			$wherearr[] = "{$pre}{$var}='".intval($value)."'";
			$urls[] = "$var=$value";
		}
	}
	
	foreach ($strkeys as $var) {
		$value = isset($_GET[$var])?trim($_GET[$var]):'';
		if(strlen($value)) {
			$wherearr[] = "{$pre}{$var}='$value'";
			$urls[] = "$var=".rawurlencode($value);
		}
	}
	
	foreach ($randkeys as $vars) {
		$value1 = isset($_GET[$vars[1].'1'])?$vars[0]($_GET[$vars[1].'1']):'';
		$value2 = isset($_GET[$vars[1].'2'])?$vars[0]($_GET[$vars[1].'2']):'';
		if($value1) {
			$wherearr[] = "{$pre}{$vars[1]}>='$value1'";
			$urls[] = "{$vars[1]}1=".rawurlencode($_GET[$vars[1].'1']);
		}
		if($value2) {
			$wherearr[] = "{$pre}{$vars[1]}<='$value2'";
			$urls[] = "{$vars[1]}2=".rawurlencode($_GET[$vars[1].'2']);
		}
	}
	
	foreach ($likekeys as $var) {
		$value = isset($_GET[$var])?stripsearchkey($_GET[$var]):'';
		if(strlen($value)>1) {
			$wherearr[] = "{$pre}{$var} LIKE BINARY '%$value%'";
			$urls[] = "$var=".rawurlencode($value);
		}
	}
	
	return array('wherearr'=>$wherearr, 'urls'=>$urls);
}

        showmessage('not_find_qualified_information', $theurl);
    }
} elseif (submitcheck('search2submit') || !empty($search2)) {
    $_SGET['message'] = trim(postget('message'));
    $_SGET['postip'] = trim(postget('postip'));
    $_SGET['type'] = trim(postget('type'));
    $_SGET['detail'] = trim(postget('detail'));
    $urlplusarr[] = 'search2=1';
    $urlplusarr[] = 'type=' . $_SGET['type'];
    $where1arr = array();
    if (!empty($_SGET['message'])) {
        $urlplusarr[] = 'message=' . $_SGET['message'];
        $sarr = explode(',', $_SGET['message']);
        $newsarr = array();
        foreach ($sarr as $value) {
            $value = stripsearchkey($value);
            if (!empty($value)) {
                $newsarr[] = "ii.message LIKE '%" . $value . "%'";
            }
        }
        if (!empty($newsarr)) {
            $where1arr[] = "(" . implode(" OR ", $newsarr) . ")";
        }
    }
    if (!empty($_SGET['postip'])) {
        $urlplusarr[] = 'postip=' . $_SGET['postip'];
        $_SGET['postip'] = str_replace('*', '888', $_SGET['postip']);
        $sarr = explode('.', $_SGET['postip']);
        $newips = array();
        foreach ($sarr as $value) {
            $value = intval($value);

     $tablename = 'postitems';
 } else {
     $tablename = 'spaceitems';
     if ($status == 'yes') {
         if (empty($grade)) {
             $wheresqlarr[] = 'i.grade>0';
         } else {
             $wheresqlarr[] = 'i.grade=\'' . $grade . '\'';
         }
     } elseif ($status == 'ban') {
         $wheresqlarr[] = 'i.grade=\'-1\'';
     } else {
         $wheresqlarr[] = 'i.grade=0';
     }
 }
 if ($searchkeys = stripsearchkey($searchkey)) {
     if ($searchtype == 'username') {
         $wheresqlarr[] = 'i.username LIKE \'%' . $searchkeys . '%\'';
     } else {
         $wheresqlarr[] = 'i.subject LIKE \'%' . $searchkeys . '%\'';
     }
 }
 $wheresqlstr = implode(' AND ', $wheresqlarr);
 $query = $_SGLOBAL['db']->query('SELECT COUNT(*) FROM ' . tname($tablename) . ' i WHERE ' . $wheresqlstr);
 $listcount = $_SGLOBAL['db']->result($query, 0);
 $multipage = '';
 if ($listcount) {
     $query = $_SGLOBAL['db']->query('SELECT i.*, f.name FROM ' . tname($tablename) . ' i LEFT JOIN ' . tname('categories') . ' f ON f.catid=i.catid WHERE ' . $wheresqlstr . ' ORDER BY i.dateline DESC LIMIT ' . $start . ',' . $perpage);
     while ($item = $_SGLOBAL['db']->fetch_array($query)) {
         $item['url'] = geturl('action/viewnews/itemid/' . $item['itemid']);
         $listarr[] = $item;

 public function fetch_all_stat_memberlist($username, $orderby = '', $sort = '', $start = 0, $limit = 0)
 {
     $orderby = in_array($orderby, array('uid', 'credits', 'regdate', 'gender', 'username', 'posts', 'lastvisit'), true) ? $orderby : 'uid';
     $sql = '';
     $sql = !empty($username) ? " WHERE username LIKE '" . addslashes(stripsearchkey($username)) . "%'" : '';
     $memberlist = array();
     $query = DB::query("SELECT m.uid, m.username, mp.gender, m.email, m.regdate, ms.lastvisit, mc.posts, m.credits\n\t\t\tFROM " . DB::table($this->_table) . " m\n\t\t\tLEFT JOIN " . DB::table('common_member_profile') . " mp ON mp.uid=m.uid\n\t\t\tLEFT JOIN " . DB::table('common_member_status') . " ms ON ms.uid=m.uid\n\t\t\tLEFT JOIN " . DB::table('common_member_count') . " mc ON mc.uid=m.uid\n\t\t\t{$sql} ORDER BY " . DB::order($orderby, $sort) . DB::limit($start, $limit));
     while ($member = DB::fetch($query)) {
         $member['usernameenc'] = rawurlencode($member['username']);
         $member['regdate'] = dgmdate($member['regdate']);
         $member['lastvisit'] = dgmdate($member['lastvisit']);
         $memberlist[$member['uid']] = $member;
     }
     return $memberlist;
 }

<?php

/*
	[UCenter Home] (C) 2007-2008 Comsenz Inc.
	$Id: space_tag.php 10944 2009-01-09 01:56:13Z liguode $
*/
if (!defined('IN_UCHOME')) {
    exit('Access Denied');
}
$id = empty($_GET['id']) ? 0 : intval($_GET['id']);
$name = empty($_GET['name']) ? 0 : stripsearchkey($_GET['name']);
$start = empty($_GET['start']) ? 0 : intval($_GET['start']);
$list = array();
$count = 0;
if ($id || $name) {
    // pagination
    $perpage = 30;
    //Check start number
    ckstart($start, $perpage);
    //获取TAG
    $query = $_SGLOBAL['db']->query("SELECT * FROM " . tname('tag') . " WHERE " . ($id ? "tagid='{$id}'" : "tagname='{$name}'") . " LIMIT 1");
    $tag = $_SGLOBAL['db']->fetch_array($query);
    if (empty($tag)) {
        showmessage('tag_does_not_exist');
    } elseif ($tag['close']) {
        showmessage('tag_locked');
    }
    //获取tag关联
    $prinum = 0;
    $query = $_SGLOBAL['db']->query("SELECT blog.* FROM " . tname('tagblog') . " tb , " . tname('blog') . " blog WHERE tb.tagid='{$tag['tagid']}' AND blog.blogid=tb.blogid LIMIT {$start},{$perpage}");
    while ($value = $_SGLOBAL['db']->fetch_array($query)) {

 function goods()
 {
     global $_G;
     $sql = make_sql();
     $url = 'm=ajax&a=goods';
     $size = $_G[setting][cate_page] ? $_G[setting][cate_page] : 120;
     if ($_GET['field']) {
         $sql['field'] = trim($_GET['field']);
     }
     $and = '';
     if ($_GET['kw']) {
         $string = stripsearchkey(trim($_GET['kw']));
         if (preg_match("/^%+\$|^_+\$|^\\*+\$/is", $string)) {
             msg('非法搜索关键字');
         }
         $string = safe_output($string);
         if (dstrlen($string) < 2) {
             msg('要搜索的关键字长度不能小于2');
         }
         $_GET[kw] = $string;
         $and .= " AND title like '%{$string}%' ";
         $url .= "&kw=" . urlencode_utf8($string);
     }
     if ($_GET[tag]) {
         $tag = trim_html($tag, 1);
         $tag = daddslashes($_GET[tag]);
         $and .= "AND FIND_IN_SET('" . $tag . "', keywords) ";
         $url .= "&tag=" . urlencode_utf8($tag);
         $sql['and'] .= $and;
         $sql['url'] .= $url;
     }
     $rs = D(array('and' => $and . $sql['and'], 'all' => false, 'order' => $sql[order]), array('url' => $url . $sql[url], 'size' => $size));
     $goods = array();
     foreach ($rs['goods'] as $k => $v) {
         $tmp = array();
         $tmp['picurl'] = $v['picurl'];
         $tmp['url'] = $v['url'];
         $tmp['id_url'] = $v['id_url'];
         $tmp['num_iid'] = $v['num_iid'];
         $tmp['aid'] = $v['aid'];
         $tmp['yh_price'] = $v['yh_price'];
         $tmp['sum'] = $v['sum'];
         $tmp['like'] = $v['like'];
         $tmp['title'] = $v['title'];
         $tmp['username'] = $v['username'];
         $goods[] = $tmp;
     }
     json(array('data' => $goods, 'status' => 'success'));
 }

            $fuid_actives = array($fuid => ' selected');
        } else {
            $wheresql = "t.sellerid IN ({$space['feedfriend']})";
            $theurl = "home.php?mod=space&uid={$space['uid']}&do={$do}&view=we";
        }
        $query = DB::query("SELECT * FROM " . DB::table('home_friend') . " WHERE uid='{$space['uid']}' ORDER BY num DESC LIMIT 0,100");
        while ($value = DB::fetch($query)) {
            $userlist[] = $value;
        }
    } else {
        $need_count = false;
    }
}
$actives = array($_GET['view'] => ' class="a"');
if ($need_count) {
    if ($searchkey = stripsearchkey($_G['gp_searchkey'])) {
        $wheresql .= " AND t.subject LIKE '%{$searchkey}%'";
    }
    $havecache = false;
    if ($_G['gp_view'] == 'all') {
        $cachetime = $_G['gp_order'] == 'hot' ? 43200 : 3000;
        if (!empty($_G['cache']['space_trade'][$alltype]) && is_array($_G['cache']['space_trade'][$alltype])) {
            $cachearr = $_G['cache']['space_trade'][$alltype];
            if (!empty($cachearr['dateline']) && $cachearr['dateline'] > $_G['timestamp'] - $cachetime) {
                $list = $cachearr['data'];
                $hiddennum = $threadarr['hiddennum'];
                $havecache = true;
            }
        }
    }
    if (!$havecache) {

            if ($offset++ == $_GET['line']) {
                $log = parselog($line, true);
                $log['line'] = $_GET['line'];
                $query = $_SGLOBAL['db']->query('SELECT * FROM ' . tname('space') . " WHERE uid = '{$log['uid']}'");
                $value = $_SGLOBAL['db']->fetch_array($query);
                realname_set($value['uid'], $value['username']);
                realname_get();
                break;
            }
        }
        fclose($fp);
    }
} else {
    $perpage = 50;
    $_GET['uid'] = intval($_GET['uid']);
    $_GET['keysearch'] = stripsearchkey($_GET['keysearch']);
    $_GET['ip'] = trim($_GET['ip']);
    $mpurl = "admincp.php?ac=log&file={$_GET['file']}&uid={$_GET['uid']}&ip={$_GET['ip']}&starttime={$_GET['starttime']}&endtime={$_GET['endtime']}&keysearch={$_GET['keysearch']}";
    // use a temporary file cache search results
    $tmpfile = S_ROOT . './data/temp/logsearch_' . substr(md5($mpurl), 8, 8) . '.tmp';
    if (!is_dir(S_ROOT . './data/temp/')) {
        @mkdir(S_ROOT . './data/temp/', 0777);
    }
    $page = empty($_GET['page']) ? 1 : intval($_GET['page']);
    if ($page < 1) {
        $page = 1;
    }
    $start = ($page - 1) * $perpage;
    //Check start number
    ckstart($start, $perpage);
    $list = $uids = array();

 public function fetch_all_search($start, $limit, $fetchtype, $uids, $useip, $keywords, $lengthlimit, $starttime, $endtime, $basickeywords = 0, $doid = '', $findex = '')
 {
     $parameter = array($this->_table);
     $wherearr = array();
     if ($doid) {
         $parameter[] = (array) $doid;
         $wherearr[] = 'doid IN(%n)';
     }
     if (is_array($uids) && count($uids)) {
         $parameter[] = $uids;
         $wherearr[] = 'uid IN(%n)';
     }
     if ($useip) {
         $parameter[] = str_replace('*', '%', $useip);
         $wherearr[] = 'ip LIKE %s';
     }
     if ($keywords) {
         if (!$basickeywords) {
             $sqlkeywords = '';
             $or = '';
             $keywords = explode(',', str_replace(' ', '', $keywords));
             for ($i = 0; $i < count($keywords); $i++) {
                 $keywords[$i] = addslashes(stripsearchkey($keywords[$i]));
                 if (preg_match("/\\{(\\d+)\\}/", $keywords[$i])) {
                     $keywords[$i] = preg_replace("/\\\\{(\\d+)\\\\}/", ".{0,\\1}", preg_quote($keywords[$i], '/'));
                     $sqlkeywords .= " {$or} message REGEXP '" . $keywords[$i] . "'";
                 } else {
                     $sqlkeywords .= " {$or} message LIKE '%" . $keywords[$i] . "%'";
                 }
                 $or = 'OR';
             }
             $parameter[] = $sqlkeywords;
             $wherearr[] = '%i';
         } else {
             $parameter[] = '%' . $basickeywords . '%';
             $wherearr[] = 'message LIKE %s';
         }
     }
     if ($lengthlimit) {
         $parameter[] = intval($lengthlimit);
         $wherearr[] = 'LENGTH(message) < %d';
     }
     if ($starttime) {
         $parameter[] = is_numeric($starttime) ? $starttime : strtotime($starttime);
         $wherearr[] = 'dateline>%d';
     }
     if ($endtime) {
         $parameter[] = is_numeric($endtime) ? $endtime : strtotime($endtime);
         $wherearr[] = 'dateline<%d';
     }
     if ($fetchtype == 3) {
         $selectfield = "count(*)";
     } elseif ($fetchtype == 2) {
         $selectfield = "doid";
     } else {
         $selectfield = "*";
         $parameter[] = DB::limit($start, $limit);
         $ordersql = ' ORDER BY dateline DESC %i';
     }
     if ($findex) {
         $findex = 'USE INDEX(dateline)';
     }
     $wheresql = !empty($wherearr) && is_array($wherearr) ? ' WHERE ' . implode(' AND ', $wherearr) : '';
     if ($fetchtype == 3) {
         return DB::result_first("SELECT {$selectfield} FROM %t {$wheresql}", $parameter);
     } else {
         return DB::fetch_all("SELECT {$selectfield} FROM %t {$findex} {$wheresql} {$ordersql}", $parameter);
     }
 }

 //开始搜索
 $wherearr = array();
 if ($gets['username']) {
     $wherearr[] = "main.username = '{$gets['username']}'";
 }
 if ($gets['tagid']) {
     $wherearr[] = "main.tagid = '{$gets['tagid']}'";
 }
 if ($value = sstrtotime($gets['starttime'])) {
     $wherearr[] = "main.dateline >= '{$value}'";
 }
 if ($value = sstrtotime($gets['endtime'])) {
     $wherearr[] = "main.dateline <= '{$value}'";
 }
 //关键字
 if ($inkey = stripsearchkey($gets['key'])) {
     if (preg_match("/( AND |\\+|&|\\s)/i", $inkey) && !preg_match("/( OR |\\|)/i", $inkey)) {
         $keys = preg_replace("/( AND |&| )/i", "+", $inkey);
         $andor = ' AND ';
     } else {
         $keys = preg_replace("/( OR |\\|)/i", "+", $inkey);
         $andor = ' OR ';
     }
     $is = array();
     foreach (explode('+', $keys) as $value) {
         if ($value = trim($value)) {
             $is[] = "main.subject LIKE '%{$value}%'";
         }
     }
     if ($is) {
         $wherearr[] = '(' . implode($andor, $is) . ')';

            realname_set($value['uid'], $value['username'], $value['name'], $value['namestatus']);
            $fuids[] = $value['uid'];
            $list[] = $value;
        }
    }
    $multi = multi($count, $perpage, $page, $theurl);
} else {
    //处理查询
    $theurl = "space.php?uid={$space['uid']}&do={$do}";
    $actives = array('me' => ' class="active"');
    //好友分组
    $wheresql = '';
    if ($space['self']) {
        $groups = getfriendgroup();
        $group = !isset($_GET['group']) ? '-1' : intval($_GET['group']);
        $get_key = empty($_GET['key']) ? '' : stripsearchkey($_GET['key']);
        if ($group > -1) {
            $wheresql = "AND main.gid='{$group}'";
            $theurl .= "&group={$group}";
        } elseif ($get_key) {
            if ($_SCONFIG['realname']) {
                //搜索实名
                $uids = array();
                $query = $_SGLOBAL['db']->query("SELECT s.uid FROM " . tname('space') . " s, " . tname('friend') . " f\r\n\t\t\t\t\tWHERE s.name LIKE '%{$get_key}%' AND s.uid=f.fuid AND f.uid='{$_SGLOBAL['supe_uid']}' AND f.status='1'");
                while ($value = $_SGLOBAL['db']->fetch_array($query)) {
                    $uids[] = $value['uid'];
                }
                $wheresql = "AND (main.fuid IN (" . simplode($uids) . ") OR main.fusername LIKE '%{$get_key}%')";
            } else {
                $wheresql = "AND main.fusername LIKE '%{$get_key}%'";
            }

function stripsearchkey($string)
{
    if (is_array($string)) {
        foreach ($string as $key => $val) {
            $string[$key] = stripsearchkey($val);
        }
    } else {
        $string = trim($string);
        $string = str_replace('*', '%', addcslashes($string, '%_'));
        $string = str_replace('_', '\\_', $string);
    }
    return $string;
}