PHP xEscSQL函数代码示例

function repGetProductReportByCategoryID($callBackParam, &$count_row, $navigatorParams = null)
{
    if ($navigatorParams != null) {
        $offset = $navigatorParams["offset"];
        $CountRowOnPage = $navigatorParams["CountRowOnPage"];
    } else {
        $offset = 0;
        $CountRowOnPage = 0;
    }
    $where_clause = "";
    $order_clause = "";
    if (isset($callBackParam["categoryID"])) {
        if ($callBackParam["categoryID"] != 0) {
            $where_clause = " where categoryID=" . (int) $callBackParam["categoryID"];
        }
    }
    if (isset($callBackParam["sort"])) {
        $order_clause = " order by " . xEscSQL($callBackParam["sort"]);
        if (isset($callBackParam["direction"])) {
            $order_clause .= " " . xEscSQL($callBackParam["direction"]);
        }
    }
    $res = array();
    $q = db_query("select name, customers_rating, customer_votes, items_sold, " . " viewed_times, in_stock, sort_order  from " . PRODUCTS_TABLE . " " . $where_clause . " " . $order_clause);
    $i = 0;
    while ($row = db_fetch_row($q)) {
        if ($i >= $offset && $i < $offset + $CountRowOnPage || $navigatorParams == null) {
            $res[] = $row;
        }
        $i++;
    }
    $count_row = $i;
    return $res;
}

function configUpdateOptionValue($productID, $updatedValues)
{
    foreach ($updatedValues as $key => $value) {
        if ($updatedValues[$key]["option_radio_type"] == "UN_DEFINED" || $updatedValues[$key]["option_radio_type"] == "ANY_VALUE") {
            $option_type = 0;
        } else {
            $option_type = 1;
        }
        if ($updatedValues[$key]["option_radio_type"] == "UN_DEFINED") {
            $option_value = null;
        } else {
            if (isset($updatedValues[$key]["option_value"])) {
                $option_value = $updatedValues[$key]["option_value"];
            } else {
                $option_value = null;
            }
        }
        $where_clause = " where optionID=" . (int) $key . " AND productID=" . (int) $productID;
        $q = db_query("select count(*) from " . PRODUCT_OPTIONS_VALUES_TABLE . " " . $where_clause);
        $r = db_fetch_row($q);
        if ($r[0] == 1) {
            db_query("update " . PRODUCT_OPTIONS_VALUES_TABLE . " set option_value='" . xEscSQL($option_value) . "', option_type=" . (int) $option_type . " " . $where_clause);
        } else {
            db_query("insert into " . PRODUCT_OPTIONS_VALUES_TABLE . "(optionID, productID, option_value, option_type)" . "values ('" . (int) $key . "', '" . (int) $productID . "', '" . xEscSQL($option_value) . "', '" . (int) $option_type . "')");
        }
    }
}

 function _setCallBackParamsToSearchOrders(&$callBackParam)
 {
     $callBackParam = array("customerID" => regGetIdByLogin($_SESSION["log"]));
     if (isset($_GET["sort"])) {
         $callBackParam["sort"] = xEscSQL($_GET["sort"]);
         if (isset($_GET["direction"])) {
             $callBackParam["direction"] = xEscSQL($_GET["direction"]);
         }
     } else {
         $callBackParam["sort"] = "order_time";
         $callBackParam["direction"] = "DESC";
     }
     if ($_GET["order_search_type"] == "SearchByOrderID") {
         $callBackParam["orderID"] = (int) $_GET["orderID_textbox"];
     } else {
         if ($_GET["order_search_type"] == "SearchByStatusID") {
             $orderStatuses = array();
             $data = ScanGetVariableWithId(array("checkbox_order_status"));
             foreach ($data as $key => $val) {
                 if ($val["checkbox_order_status"] == "1") {
                     $orderStatuses[] = (int) $key;
                 }
             }
             $callBackParam["orderStatuses"] = $orderStatuses;
         }
     }
 }

function modGetModuleConfigs($_ModuleClassName)
{
    $ModuleConfigs = array();
    $sql = "select * FROM " . MODULES_TABLE . " WHERE ModuleClassName='" . xEscSQL($_ModuleClassName) . "' ORDER BY module_name ASC\n        ";
    $Result = db_query($sql);
    while ($_Row = db_fetch_row($Result)) {
        $ModuleConfigs[] = array('ConfigID' => $_Row['module_id'], 'ConfigName' => $_Row['module_name'], 'ConfigClass' => $_ModuleClassName);
    }
    return $ModuleConfigs;
}

function blockspgAddblocksPageFile($page_name, $page_file, $which, $bposition, $active, $admin, $s, $d, $c, $p)
{
    $rs = isset($s) ? serialize($s) : serialize(array());
    $rd = isset($d) ? serialize($d) : serialize(array());
    $rc = isset($c) ? serialize($c) : serialize(array());
    $rpt = explode("\n", chop($p));
    $rp = array();
    for ($i = 0; $i < count($rpt); $i++) {
        if ($tmp = (int) rtrim($rpt[$i]) > 0 && rtrim($rpt[$i]) !== "") {
            $rp[] = (int) rtrim($rpt[$i]);
        }
    }
    $rp = serialize($rp);
    db_query("insert into " . BLOCKS_TABLE . " ( title, bposition, active, which, html, url, admin, pages, dpages, categories, products )  " . " values( '" . xToText($page_name) . "', " . (int) $bposition . ", " . (int) $active . ", " . (int) $which . ", '1', '" . $page_file . "', " . (int) $admin . ", '" . xEscSQL($rs) . "',\n                '" . xEscSQL($rd) . "', '" . xEscSQL($rc) . "', '" . xEscSQL($rp) . "') ");
}

function settingCallHtmlFunction($constantName)
{
    $q = db_query("select settings_html_function, settingsID, settings_constant_name from " . SETTINGS_TABLE . " where settings_constant_name='" . xEscSQL($constantName) . "' ");
    if ($row = db_fetch_row($q)) {
        $function = $row["settings_html_function"];
        $settingsID = $row["settingsID"];
        $str = "";
        if (preg_match('/,[ ]*$|\\([ ]*$/', $function)) {
            eval("\$str=" . $function . "{$settingsID});");
        } else {
            eval("\$str=" . $function . ";");
        }
        return $str;
    }
    return false;
}

function _getInsertStatement($xmlTable, $row, $columns = NULL, $attributes = NULL, $columnsClause)
{
    $sql = "INSERT INTO ";
    if (!$attributes) {
        $attributes = $xmlTable->GetXmlNodeAttributes();
    }
    $tableAlias = $attributes["NAME"];
    $tableName = $attributes["NAME"];
    // exceptions
    if ($tableName == CATEGORIES_TABLE) {
        if ($row["categoryID"] == 1) {
            return "";
        }
    }
    $sql .= $tableAlias;
    $valueClause = "";
    if (!$columns) {
        $columns = $xmlTable->SelectNodes("table/column");
    }
    $i = 0;
    foreach ($columns as $xmlColumn) {
        $attributes = $xmlColumn->GetXmlNodeAttributes();
        $columnName = $xmlColumn->GetXmlNodeData();
        $columnName = trim($columnName);
        $type = strtoupper($attributes["TYPE"]);
        if (strstr($type, "CHAR") || strstr($type, "VARCHAR") || strstr($type, "TEXT") || strstr($type, "DATETIME")) {
            $cellValue = $row[$i];
            $cellValue = xEscSQL($cellValue);
            $value = "'" . $cellValue . "'";
        } else {
            $value = $row[$i];
        }
        if ($row[$i] == null && trim($row[$i]) == "") {
            $value = "NULL";
        }
        if ($i == 0) {
            $valueClause .= $value;
        } else {
            $valueClause .= ", " . $value;
        }
        $i++;
    }
    $sql .= " (" . $columnsClause . ") values (" . $valueClause . ")";
    $sql = str_replace(DB_PRFX, "DBPRFX_", $sql);
    return $sql;
}

function db_query($s)
{
    //database query
    global $sc_4, $sc_8, $gmc;
    if (isset($gmc) && $gmc == 1) {
        $sc_81 = getmicrotime();
    }
    // $scriptv = getmicrotime();
    $res = array();
    $res["resource"] = mysql_query($s);
    /*
     $scriptp = getmicrotime();
     $rom = $scriptp-$scriptv;
     print $rom." - ".$s."<br>";
    */
    if (!$res['resource']) {
        $out = "ERROR: " . mysql_errno() . ":" . mysql_error() . "\nSql: " . $s . "\nLink: " . $_SERVER["REQUEST_URI"] . "\nDate: " . date("d.m.y - H:i:s") . "\nDump:\n";
        ob_start();
        var_dump($_GET);
        var_dump($_POST);
        $tmpa = ob_get_contents();
        ob_end_clean();
        $out .= $tmpa;
        mysql_query("insert into " . MYSQL_ERROR_LOG_TABLE . " (errors, tstamp) VALUES ('" . xEscSQL(ToText($out)) . "', NOW())");
        $ecount = mysql_fetch_row(mysql_query("select count(*) from " . MYSQL_ERROR_LOG_TABLE));
        $ecount = $ecount[0] - 50;
        if ($ecount > 0) {
            mysql_query("delete from " . MYSQL_ERROR_LOG_TABLE . " ORDER BY tstamp ASC LIMIT " . $ecount);
        }
        // die('Wrong database query!');
    }
    $res["columns"] = array();
    $column_index = 0;
    while ($xwer = @mysql_fetch_field($res["resource"])) {
        $res["columns"][$xwer->name] = $column_index;
        $column_index++;
    }
    if (isset($gmc) && $gmc == 1) {
        $sc_82 = getmicrotime();
        $sc_4++;
        $sc_8 = $sc_8 + $sc_82 - $sc_81;
    }
    return $res;
}

/**
 * return array of categories by requested params
 *
 * @return array
 */
function le_getCategories($_where = '1', $_what = 'le_cID, le_cName, le_cSortOrder', $_order = "le_cSortOrder ASC, le_cName ASC")
{
    $categories = array();
    if (is_array($_where)) {
        foreach ($_where as $_col => $_val) {
            $_where[$_col] = $_col . " = '" . $_val . "'";
        }
        $_where = implode(" AND ", $_where);
    }
    if (is_array($_what)) {
        $_what = implode(", ", xEscSQL($_what));
    } else {
        $_what = xEscSQL($_what);
    }
    $sql = "select " . $_what . " FROM " . LINK_EXCHANGE_CATEGORIES_TABLE . "\n                WHERE " . $_where . " ORDER BY " . xEscSQL($_order);
    $result = db_query($sql);
    while ($_row = db_fetch_row($result)) {
        $categories[] = $_row;
    }
    return $categories;
}

function error_reporting_log($error_num, $error_var, $error_file, $error_line)
{
    $error_write = false;
    switch ($error_num) {
        case 1:
            $error_desc = "ERROR";
            $error_write = true;
            break;
        case 2:
            $error_desc = "WARNING";
            $error_write = true;
            break;
        case 4:
            $error_desc = "PARSE";
            $error_write = true;
            break;
        case 8:
            $error_desc = "NOTICE";
            $error_write = false;
            break;
    }
    if ($error_write) {
        if (strpos($error_file, "mysql.php") == false && strpos($error_file, "smarty") == false) {
            $out = $error_desc . ": " . $error_var . "\nLine: " . $error_line . "\nFile: " . $error_file . "\nLink: " . $_SERVER["REQUEST_URI"] . "\nDate: " . date("d.m.y - H:i:s") . "\nDump:\n";
            ob_start();
            var_dump($_GET);
            var_dump($_POST);
            $tmpa = ob_get_contents();
            ob_end_clean();
            $out .= $tmpa;
            db_query("insert into " . ERROR_LOG_TABLE . " (errors, tstamp) VALUES ('" . xEscSQL(ToText($out)) . "', NOW())");
            $ecount = db_fetch_row(db_query("select count(*) from " . ERROR_LOG_TABLE));
            $ecount = $ecount[0] - 50;
            if ($ecount > 0) {
                db_query("delete from " . ERROR_LOG_TABLE . " ORDER BY tstamp ASC LIMIT " . $ecount);
            }
        }
    }
}

function discGetAllDiscussion($callBackParam, &$count_row, $navigatorParams = null)
{
    $data = array();
    $orderClause = "";
    if (isset($callBackParam["sort"])) {
        $orderClause = " order by " . xEscSQL($callBackParam["sort"]);
        if (isset($callBackParam["direction"])) {
            if ($callBackParam["direction"] == "ASC") {
                $orderClause .= " ASC ";
            } else {
                $orderClause .= " DESC ";
            }
        }
    }
    $filter = "";
    if (isset($callBackParam["productID"])) {
        if ($callBackParam["productID"] != 0) {
            $filter = " AND " . PRODUCTS_TABLE . ".productID=" . (int) $callBackParam["productID"];
        }
    }
    $q = db_query("select DID, Author, Body, add_time, Topic, name AS product_name from " . DISCUSSIONS_TABLE . ", " . PRODUCTS_TABLE . " where " . DISCUSSIONS_TABLE . ".productID=" . PRODUCTS_TABLE . ".productID " . $filter . " " . $orderClause);
    if ($navigatorParams != null) {
        $offset = $navigatorParams["offset"];
        $CountRowOnPage = $navigatorParams["CountRowOnPage"];
    } else {
        $offset = 0;
        $CountRowOnPage = 0;
    }
    $i = 0;
    while ($row = db_fetch_row($q)) {
        if ($i >= $offset && $i < $offset + $CountRowOnPage || $navigatorParams == null) {
            $row["add_time"] = format_datetime($row["add_time"]);
            $data[] = $row;
        }
        $i++;
    }
    $count_row = $i;
    return $data;
}

function payUpdatePaymentMethod($PID, $Name, $description, $Enabled, $sort_order, $module_id, $email_comments_text, $calculate_tax)
{
    db_query("update " . PAYMENT_TYPES_TABLE . " set" . " Name='" . xToText($Name) . "', description='" . xEscSQL($description) . "', email_comments_text='" . xEscSQL($email_comments_text) . "', " . " Enabled=" . (int) $Enabled . ", module_id=" . (int) $module_id . ", sort_order=" . (int) $sort_order . ", calculate_tax = " . (int) $calculate_tax . " where PID=" . (int) $PID);
}

function shUpdateShippingMethod($SID, $Name, $description, $Enabled, $sort_order, $module_id, $email_comments_text)
{
    db_query("update " . SHIPPING_METHODS_TABLE . " set Name='" . xToText(trim($Name)) . "', description='" . xEscSQL($description) . "', email_comments_text='" . xEscSQL($email_comments_text) . "', " . " Enabled=" . (int) $Enabled . ", module_id=" . (int) $module_id . ", sort_order=" . (int) $sort_order . " where SID=" . (int) $SID);
}

//.........这里部分代码省略.........
    }
    $paymentMethod = payGetPaymentMethodById($paymentMethodID);
    if ($paymentMethod) {
        $currentPaymentModule = modGetModuleObj($paymentMethod['module_id'], PAYMENT_MODULE);
    } else {
        $currentPaymentModule = null;
    }
    if ($currentPaymentModule != null) {
        //define order details for payment module
        $order_payment_details = array('customer_email' => $customer_email, 'customer_ip' => $customer_ip, 'order_amount' => $order_amount, 'currency_code' => $currency_code, 'currency_value' => $currency_value, 'shipping_cost' => $shipping_costUC, 'order_tax' => $tax, 'shipping_info' => $shippingAddress, 'billing_info' => $billingAddress);
        $process_payment_result = $currentPaymentModule->payment_process($order_payment_details);
        //gets payment processing result
        if (!($process_payment_result == 1)) {
            //die ($process_payment_result);
            if (isset($_POST)) {
                $_SESSION['order4confirmation_post'] = $_POST;
            }
            xSaveData('PaymentError', $process_payment_result);
            if (!$customerID) {
                RedirectProtected('index.php?order4_confirmation_quick=yes' . '&shippingMethodID=' . $_GET['shippingMethodID'] . '&paymentMethodID=' . $_GET['paymentMethodID'] . '&shServiceID=' . $shServiceID);
            } else {
                RedirectProtected('index.php?order4_confirmation=yes' . '&shippingAddressID=' . $_GET['shippingAddressID'] . '&shippingMethodID=' . $_GET['shippingMethodID'] . '&billingAddressID=' . $_GET['billingAddressID'] . '&paymentMethodID=' . $_GET['paymentMethodID'] . '&shServiceID=' . $shServiceID);
            }
            return false;
        }
    }
    $customerID = (int) $customerID;
    //    debug($cartContent['cart_content']);
    //
    //    exit;
    $sql = 'INSERT INTO ' . ORDERS_TABLE . '
    SET
    customerID =  ' . (int) $customerID . ',
    order_time = "' . xEscSQL($order_time) . '",
    customer_ip = "' . xToText($customer_ip) . '",
    shipping_type = "' . xToText($shippingName) . '",
    payment_type = "' . xToText($paymentName) . '",
    customers_comment = "' . xToText($customers_comment) . '",
    statusID = ' . (int) $statusID . ',
    shipping_cost = "' . (double) $shipping_costUC . '",
    order_discount = "' . (double) $discount_percent . '",
    order_amount= "' . (double) $order_amount . '",
    currency_code = "' . xEscSQL($currency_code) . '",
    currency_value = "' . (double) $currency_value . '",
    customer_firstname = "' . xToText($customerInfo['first_name']) . '",
    customer_lastname = "' . xToText($customerInfo['last_name']) . '",
    customer_email = "' . xToText($customer_email) . '",
    shipping_firstname = "' . xToText($shippingAddress['first_name']) . '",
    shipping_lastname = "' . xToText($shippingAddress['last_name']) . '",
    shipping_country= "' . xToText($shippingAddress['country_name']) . '",
    shipping_state= "' . xToText($shippingAddress['state']) . '",
    shipping_city= "' . xToText($shippingAddress['city']) . '",
    shipping_address= "' . xToText($shippingAddress['address']) . '",
    billing_firstname= "' . xToText($billingAddress['first_name']) . '",
    billing_lastname= "' . xToText($billingAddress['last_name']) . '",
    billing_country= "' . xToText($billingAddress['country_name']) . '",
    billing_state= "' . xToText($billingAddress['state']) . '",
    billing_city= "' . xToText($billingAddress['city']) . '",
    billing_address= "' . xToText($billingAddress['address']) . '",
    cc_number= "' . xEscSQL($cc_number) . '",
    cc_holdername= "' . xToText($cc_holdername) . '",
    cc_expires= "' . xEscSQL($cc_expires) . '",
    cc_cvv= "' . xEscSQL($cc_cvv) . '",
    affiliateID= "' . (isset($_SESSION['refid']) ? $_SESSION['refid'] : regGetIdByLogin($customer_affiliationLogin)) . '",
    shippingServiceInfo= "' . $shServiceInfo . '",
    custlink= "' . xEscSQL($order_active_link) . '",

 function admin_print_html($orderID)
 {
     $order = ordGetOrder($orderID);
     if (!$this->ModuleConfigID) {
         $sql = 'SELECT module_id FROM ' . MODULES_TABLE . ' WHERE module_name="' . xEscSQL($this->title) . '"';
         @(list($this->ModuleConfigID) = db_fetch_row(db_query($sql)));
     }
     $result = 'admin.php?do=invoice_phys&moduleID=' . (int) $this->ModuleConfigID . '&orderID=' . (int) $orderID;
     return $result;
 }