PHP BoincDb::escape_string方法代码示例

function get_output_file($instance_name, $file_num, $auth_str)
{
    $result = BoincResult::lookup_name(BoincDb::escape_string($instance_name));
    if (!$result) {
        die("no job instance {$instance_name}");
    }
    $workunit = BoincWorkunit::lookup_id($result->workunitid);
    if (!$workunit) {
        die("no job {$result->workunitid}");
    }
    $batch = BoincBatch::lookup_id($workunit->batch);
    if (!$batch) {
        die("no batch {$workunit->batch}");
    }
    $user = BoincUser::lookup_id($batch->user_id);
    if (!$user) {
        die("no user {$batch->user_id}");
    }
    $x = md5($user->authenticator . $result->name);
    if ($x != $auth_str) {
        die("bad auth str");
    }
    $names = get_outfile_names($result);
    if ($file_num >= count($names)) {
        die("bad file num: {$file_num} > " . count($names));
    }
    $name = $names[$file_num];
    $fanout = parse_config(get_config(), "<uldl_dir_fanout>");
    $upload_dir = parse_config(get_config(), "<upload_dir>");
    $path = dir_hier_path($name, $upload_dir, $fanout);
    if (!is_file($path)) {
        die("no such file {$path}");
    }
    do_download($path);
}

function search_action()
{
    $where = "true";
    $search_string = get_str('search_string');
    if (strlen($search_string)) {
        if (strlen($search_string) < 3) {
            error_page(tra("search string must be at least 3 characters"));
        }
        $s = BoincDb::escape_string($search_string);
        $s = escape_pattern($s);
        $where .= " and name like '{$s}%'";
    }
    $country = get_str('country');
    if ($country != 'any') {
        $s = BoincDb::escape_string($country);
        $where .= " and country='{$s}'";
    }
    $t = get_str('team');
    if ($t == 'yes') {
        $where .= " and teamid<>0";
    } else {
        if ($t == 'no') {
            $where .= " and teamid=0";
        }
    }
    $t = get_str('profile');
    if ($t == 'yes') {
        $where .= " and has_profile<>0";
    } else {
        if ($t == 'no') {
            $where .= " and has_profile=0";
        }
    }
    $search_type = get_str('search_type', true);
    $order_clause = "id desc";
    if ($search_type == 'rac') {
        $order_clause = "expavg_credit desc";
    } else {
        if ($search_type == 'total') {
            $order_clause = "total_credit desc";
        }
    }
    $fields = "id, create_time, name, country, total_credit, expavg_credit, teamid, url, has_profile, donated";
    $users = BoincUser::enum_fields($fields, $where, "order by {$order_clause} limit 100");
    page_head(tra("User search results"));
    $n = 0;
    foreach ($users as $user) {
        if ($n == 0) {
            start_table();
            table_header(tra("Name"), tra("Team"), tra("Average credit"), tra("Total credit"), tra("Country"), tra("Joined"));
        }
        show_user($user);
        $n++;
    }
    end_table();
    if (!$n) {
        echo tra("No users match your search criteria.");
    }
    page_tail();
}

function add_app()
{
    $name = BoincDb::escape_string(post_str('add_name'));
    $user_friendly_name = BoincDb::escape_string(post_str('add_user_friendly_name'));
    if (empty($name) || empty($user_friendly_name)) {
        admin_error_page("To add a new application please supply both a brief name and a longer 'user-friendly' name.</font></p>");
    }
    $now = time();
    $id = BoincApp::insert("(name,user_friendly_name,create_time) VALUES ('{$name}', '{$user_friendly_name}', {$now})");
    if (!$id) {
        admin_error_page("insert failed");
    }
    echo "Application added.\n        <p>\n        You must restart the project for this to take effect.\n    ";
}

function search_post_content($keyword_list, $forum, $user, $time, $limit, $sort_style, $show_hidden)
{
    $db = BoincDb::get();
    $search_string = "%";
    foreach ($keyword_list as $key => $word) {
        $search_string .= BoincDb::escape_string($word) . "%";
    }
    $optional_join = "";
    // if looking in a single forum, need to join w/ thread table
    // because that's where the link to forum is
    //
    if ($forum) {
        $optional_join = " LEFT JOIN " . $db->db_name . ".thread ON post.thread = thread.id";
    }
    $query = "select post.* from " . $db->db_name . ".post" . $optional_join . " where content like '" . $search_string . "'";
    if ($forum) {
        $query .= " and forum = {$forum->id}";
    }
    if ($user) {
        $query .= " and post.user = {$user->id} ";
    }
    if ($time) {
        $query .= " and post.timestamp > {$time}";
    }
    if (!$show_hidden) {
        $query .= " AND post.hidden = 0";
    }
    switch ($sort_style) {
        case VIEWS_MOST:
            $query .= ' ORDER BY views DESC';
            break;
        case CREATE_TIME_NEW:
            $query .= ' ORDER by post.timestamp desc';
            break;
        case CREATE_TIME_OLD:
            $query .= ' ORDER by post.timestamp asc';
            break;
        case POST_SCORE:
            $query .= ' ORDER by post.score desc';
            break;
        default:
            $query .= ' ORDER BY post.timestamp DESC';
            break;
    }
    $query .= " limit {$limit}";
    return BoincPost::enum_general($query);
}

function add_admin($team)
{
    $email_addr = get_str('email_addr');
    $email_addr = BoincDb::escape_string($email_addr);
    $user = BoincUser::lookup("email_addr='{$email_addr}'");
    if (!$user) {
        error_page(tra("no such user"));
    }
    if ($user->teamid != $team->id) {
        error_page(tra("User is not member of team"));
    }
    if (is_team_admin($user, $team)) {
        error_page(tra("%1 is already an admin of %2", $email_addr, $team->name));
    }
    $now = time();
    $ret = BoincTeamAdmin::insert("(teamid, userid, create_time) values ({$team->id}, {$user->id}, {$now})");
    if (!$ret) {
        error_page(tra("Couldn't add admin"));
    }
}

    error_page("no such team");
}
require_admin($user, $team);
$team_url = BoincDb::escape_string(strip_tags(post_str("url", true)));
$x = strstr($team_url, "http://");
if ($x) {
    $team_url = substr($team_url, 7);
}
$team_name = BoincDb::escape_string(strip_tags(post_str("name")));
$team_name_lc = strtolower($team_name);
$tnh = post_str("name_html", true);
$team_name_html = sanitize_html($tnh);
$team_name_html = BoincDb::escape_string($team_name_html);
$team_description = BoincDb::escape_string(post_str("description", true));
$type = BoincDb::escape_string(post_str("type", true));
$country = BoincDb::escape_string(post_str("country", true));
if ($country == "") {
    $country = "International";
}
if (!is_valid_country($country)) {
    error_page("bad country");
}
$joinable = post_str('joinable', true) ? 1 : 0;
$t = BoincTeam::lookup("name='{$team_name}'");
if ($t && $t->id != $teamid) {
    error_page("The name '{$team_name}' is being used by another team.");
}
if (strlen($team_name) == 0) {
    error_page("Must specify team name");
}
// Should be caught up with the post_str("name"),

            if ($existing) {
                echo tra("There's already an account with that email address");
            } else {
                $passwd_hash = md5($passwd . $user->email_addr);
                // deal with the case where user hasn't set passwd
                // (i.e. passwd is account key)
                //
                if ($passwd_hash != $user->passwd_hash) {
                    $passwd = $user->authenticator;
                    $passwd_hash = md5($passwd . $user->email_addr);
                }
                if ($passwd_hash != $user->passwd_hash) {
                    echo tra("Invalid password.");
                } else {
                    $passwd_hash = md5($passwd . $email_addr);
                    $email_addr = BoincDb::escape_string($email_addr);
                    $result = $user->update("email_addr='{$email_addr}', passwd_hash='{$passwd_hash}', email_validated=0");
                    if ($result) {
                        echo tra("The email address of your account is now %1.", $email_addr);
                        if (defined("SHOW_NONVALIDATED_EMAIL_ADDR")) {
                            echo "<p>" . tra("Please %1validate this email address%2.", "<a href=validate_email_addr.php>", "</a>") . "\n";
                        }
                    } else {
                        echo tra("We can't update your email address due to a database problem.  Please try again later.");
                    }
                }
            }
        }
    }
}
page_tail();

function update_badge()
{
    $id = post_int("id");
    $badge = BoincBadge::lookup_id($id);
    if (!$badge) {
        admin_error_page("no such badge");
    }
    $name = BoincDb::escape_string(post_str("name"));
    $type = post_int("type");
    $title = BoincDb::escape_string(post_str("title"));
    $description = BoincDb::escape_string(post_str("description"));
    $image_url = BoincDb::escape_string(post_str("image_url"));
    $level = BoincDb::escape_string(post_str("level"));
    $tags = BoincDb::escape_string(post_str("tags"));
    $sql_rule = BoincDb::escape_string(post_str("sql_rule"));
    $retval = $badge->update("name='{$name}', type={$type}, title='{$title}', description='{$description}', image_url='{$image_url}', level='{$level}', tags='{$tags}', sql_rule='{$sql_rule}'");
    if (!$retval) {
        admin_error_page("update failed");
    }
}

function process_create_profile($user, $profile)
{
    global $config;
    $response1 = post_str('response1', true);
    $response2 = post_str('response2', true);
    $language = post_str('language', true);
    $privatekey = parse_config($config, "<recaptcha_private_key>");
    if ($privatekey) {
        $recaptcha = new ReCaptcha($privatekey);
        $resp = $recaptcha->verifyResponse($_SERVER["REMOTE_ADDR"], $_POST["g-recaptcha-response"]);
        if (!$resp->success) {
            $profile->response1 = $response1;
            $profile->response2 = $response2;
            show_profile_form($profile, tra("Your ReCaptcha response was not correct.  Please try again."));
            return;
        }
    }
    if (!akismet_check($user, $response1)) {
        $profile->response1 = $response1;
        $profile->response2 = $response2;
        show_profile_form($profile, tra("Your first response was flagged as spam by the Akismet anti-spam system.  Please modify your text and try again."));
        return;
    }
    if (!akismet_check($user, $response2)) {
        $profile->response1 = $response1;
        $profile->response2 = $response2;
        show_profile_form($profile, tra("Your second response was flagged as spam by the Akismet anti-spam system.  Please modify your text and try again."));
        return;
    }
    if (isset($_POST['delete_pic'])) {
        $delete_pic = $_POST['delete_pic'];
    } else {
        $delete_pic = "off";
    }
    if (strlen($response1) == 0 && strlen($response2) == 0 && $delete_pic != "on" && !is_uploaded_file($_FILES['picture']['tmp_name'])) {
        error_page(tra("Your profile submission was empty."));
        exit;
    }
    if ($delete_pic == "on") {
        delete_user_pictures($profile->userid);
        $profile->has_picture = false;
        $profile->verification = 0;
    }
    $profile ? $has_picture = $profile->has_picture : ($has_picture = false);
    if (is_uploaded_file($_FILES['picture']['tmp_name'])) {
        $has_picture = true;
        if ($profile) {
            $profile->verification = 0;
        }
        // echo "<br>Name: " . $_FILES['picture']['name'];
        // echo "<br>Type: " . $_FILES['picture']['type'];
        // echo "<br>Size: " . $_FILES['picture']['size'];
        // echo "<br>Temp name: " . $_FILES['picture']['tmp_name'];
        $images = getImages($_FILES['picture']['tmp_name']);
        // Write the original image file to disk.
        // TODO: define a constant for image quality.
        ImageJPEG($images[0], IMAGE_PATH . $user->id . '.jpg');
        ImageJPEG($images[1], IMAGE_PATH . $user->id . '_sm.jpg');
    }
    $response1 = sanitize_html($response1);
    $response2 = sanitize_html($response2);
    $has_picture = $has_picture ? 1 : 0;
    if ($profile) {
        $query = " response1 = '" . BoincDb::escape_string($response1) . "'," . " response2 = '" . BoincDb::escape_string($response2) . "'," . " language = '" . BoincDb::escape_string($language) . "'," . " has_picture = {$has_picture}," . " verification = {$profile->verification}" . " WHERE userid = {$user->id}";
        $result = BoincProfile::update_aux($query);
        if (!$result) {
            error_page(tra("Could not update the profile: database error"));
        }
    } else {
        $query = 'SET ' . " userid={$user->id}," . " language = '" . BoincDb::escape_string($language) . "'," . " response1 = '" . BoincDb::escape_string($response1) . "'," . " response2 = '" . BoincDb::escape_string($response2) . "'," . " has_picture = {$has_picture}," . " recommend=0, " . " reject=0, " . " posts=0, " . " uotd_time=0, " . " verification=0";
        $result = BoincProfile::insert($query);
        if (!$result) {
            error_page(tra("Could not create the profile: database error"));
        }
    }
    $user->update("has_profile=1");
    page_head(tra("Profile saved"));
    echo tra("Congratulations! Your profile was successfully entered into our database.") . "<br><br>" . "<a href=\"view_profile.php?userid=" . $user->id . "\">" . tra("View your profile") . "</a><br>";
    page_tail();
}

require_once "../inc/countries.inc";
$user = get_logged_in_user();
check_tokens($user->authenticator);
$name = boinc_htmlentities(post_str("user_name"));
if ($name != strip_tags($name)) {
    error_page("HTML tags not allowed in name");
}
if (strlen($name) == 0) {
    error_page("You must supply a name for your account.");
}
$url = post_str("url", true);
$url = strip_tags($url);
$country = post_str("country");
if ($country == "") {
    $country = "International";
}
if (!is_valid_country($country)) {
    error_page("bad country");
}
$country = BoincDb::escape_string($country);
$postal_code = post_str("postal_code", true);
$postal_code = strip_tags($postal_code);
$name = BoincDb::escape_string($name);
$url = BoincDb::escape_string($url);
$postal_code = BoincDb::escape_string($postal_code);
$result = $user->update("name='{$name}', url='{$url}', country='{$country}', postal_code='{$postal_code}'");
if ($result) {
    Header("Location: home.php");
} else {
    error_page("Couldn't update user info.");
}

function update_team($t, $team, $user)
{
    global $dry_run;
    if (trim($t->url) == $team->url && $t->type == $team->type && trim($t->name_html) == $team->name_html && trim($t->description) == $team->description && $t->country == $team->country && $t->id == $team->seti_id) {
        echo "   no changes\n";
        return;
    }
    echo "   updating\n";
    $url = BoincDb::escape_string($t->url);
    $name_html = BoincDb::escape_string($t->name_html);
    $description = BoincDb::escape_string($t->description);
    $country = BoincDb::escape_string($t->country);
    $query = "update team set url='{$url}', type={$t->type}, name_html='{$name_html}', description='{$description}', country='{$country}', seti_id={$t->id} where id={$team->id}";
    if ($dry_run) {
        echo "   {$query}\n";
        return;
    }
    $retval = mysql_query($query);
    if (!$retval) {
        echo "   update failed: {$query}\n";
        exit;
    }
}

    xml_error(ERR_BAD_EMAIL_ADDR);
}
if (strlen($passwd_hash) != 32) {
    xml_error(-1, "password hash length not 32");
}
$user = BoincUser::lookup_email_addr($email_addr);
if ($user) {
    if ($user->passwd_hash != $passwd_hash) {
        xml_error(ERR_DB_NOT_UNIQUE);
    } else {
        $authenticator = $user->authenticator;
    }
} else {
    $user = make_user($email_addr, $user_name, $passwd_hash, 'International');
    if (!$user) {
        xml_error(ERR_DB_NOT_UNIQUE);
    }
    if (defined('INVITE_CODES')) {
        error_log("Account for '{$email_addr}' created using invitation code '{$invite_code}'");
    }
}
if ($team_name) {
    $team_name = BoincDb::escape_string($team_name);
    $team = BoincTeam::lookup("name='{$team_name}'");
    if ($team && $team->joinable) {
        user_join_team($team, $user);
    }
}
echo " <account_out>\n";
echo "   <authenticator>{$user->authenticator}</authenticator>\n";
echo "</account_out>\n";

    $project_prefs = str_ireplace("<project_preferences>", "<project_preferences>\n" . $orig_project_specific, $project_prefs);
}
$url = BoincDb::escape_string($url);
$send_email = BoincDb::escape_string($send_email);
$show_hosts = BoincDb::escape_string($show_hosts);
$venue = BoincDb::escape_string($venue);
if ($email_addr) {
    if (!is_valid_email_addr($email_addr)) {
        xml_error(-205, "Invalid email address");
    }
    if (is_banned_email_addr($email_addr)) {
        xml_error(-205, "Invalid email address");
    }
    $email_addr = strtolower(BoincDb::escape_string($email_addr));
}
$password_hash = BoincDb::escape_string($password_hash);
$query = "";
if ($name) {
    $query .= " name='{$name}', ";
}
if ($country) {
    $query .= " country='{$country}', ";
}
if ($postal_code) {
    $query .= " postal_code='{$postal_code}', ";
}
if ($global_prefs) {
    $global_prefs = str_replace("\\r\\n", "\n", $global_prefs);
    $x = bad_xml($global_prefs, "<global_preferences>", "</global_preferences>");
    if ($x) {
        error("Invalid global preferences: {$x}");

function search($params)
{
    $list = array();
    $tried = false;
    if (strlen($params->keywords)) {
        $kw = BoincDb::escape_string($params->keywords);
        $name_lc = strtolower($kw);
        $name_lc = escape_pattern($name_lc);
        $list2 = get_teams("name='{$name_lc}'", $params->active);
        merge_lists($list2, $list, 20);
        $list2 = get_teams("name like '" . $name_lc . "%'", $params->active);
        merge_lists($list2, $list, 5);
        $list2 = get_teams("match(name) against ('{$kw}')", $params->active);
        merge_lists($list2, $list, 5);
        $list2 = get_teams("match(name, description) against ('{$kw}')", $params->active);
        //echo "<br>keyword matches: ",sizeof($list2);
        merge_lists($list2, $list, 3);
        $tried = true;
    }
    if (strlen($params->country) && $params->country != 'None') {
        $list2 = get_teams("country = '{$params->country}'", $params->active);
        //echo "<br>country matches: ",sizeof($list2);
        merge_lists($list2, $list, 1);
        $tried = true;
    }
    if ($params->type and $params->type > 1) {
        $list2 = get_teams("type={$params->type}", $params->active);
        //echo "<br>type matches: ",sizeof($list2);
        merge_lists($list2, $list, 2);
        $tried = true;
    }
    if (!$tried) {
        $list = get_teams("id>0", $params->active);
    }
    if (sizeof($list) == 0) {
        echo 'No teams were found matching your criteria.
			Try another search.
			<p>Or you can <a href="team_create_form.php">create a new team</a>.</p>
			<p>';
        team_search_form($params);
    } else {
        echo "The following teams match one or more of your search criteria.\n\t\t\tTo join a team, click its name to go to the team page, then click <strong>Join this team</strong>.</p>\n\t\t\t<p>";
        sort_list($list);
        show_list($list);
        echo "<h2>Change your search</h2>";
        team_search_form($params);
    }
}

// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
// See the GNU Lesser General Public License for more details.
//
// You should have received a copy of the GNU Lesser General Public License
// along with BOINC.  If not, see <http://www.gnu.org/licenses/>.
require_once "../inc/boinc_db.inc";
require_once "../inc/xml.inc";
check_get_args(array("hostid", "account_key", "venue"));
xml_header();
$db = BoincDb::get();
if (!$db) {
    xml_error($retval);
}
$auth = BoincDb::escape_string(get_str("account_key"));
$user = BoincUser::lookup("authenticator='{$auth}'");
if (!$user) {
    xml_error(ERR_DB_NOT_FOUND);
}
$hostid = get_int("hostid");
$host = BoincHost::lookup_id($hostid);
if (!$host || $host->userid != $user->id) {
    xml_error(ERR_DB_NOT_FOUND);
}
$venue = BoincDb::escape_string(get_str("venue"));
$result = $host->update("venue='{$venue}'");
if ($result) {
    echo "<am_set_host_info_reply>\n    <success/>\n</am_set_host_info_reply>\n";
} else {
    xml_error(-1, "database error");
}