PHP Database::escape方法代码示例

 function translate()
 {
     $translate = array();
     if (!$this->saved_content['Text']) {
         $translate[] = 'Text';
     }
     $trFrom = $trSect = $trText = array();
     if (!empty($translate)) {
         $newest = $DB->asArray("SELECT t1.section, t1.* FROM content AS t1\n                LEFT JOIN content t2 ON t1.section = t2.section\n                AND t1.language = t2.language\n                AND t1.revision < t2.revision\n                WHERE t2.section IS NULL\n                AND t1.id='" . Database::escape($id) . "'\n                AND (t1.section='" . implode("' OR t1.section='", Database::escape($translate, true)) . "')\n                ORDER BY t1.revision DESC", true);
         foreach ($newest as $s => $translation) {
             $trFrom[] = $translation['language'];
             $trText[] = $translation['content'];
             $trSect[] = $s;
         }
     }
     if (!$obj->Name && !$_POST['etitle']) {
         if ($info = $DB->metadata->getRow(array('id' => $obj->ID, 'field' => 'Name'), 'value, metameta')) {
             $trFrom[] = $info['metameta'];
             $trText[] = $info['value'];
             $trSect[] = 'Name';
         }
     }
     $translation = array();
     if (!empty($trText)) {
         $translation = @array_combine($trSect, google::translate($trText, $trFrom, $language));
     }
     return $translation;
 }

 /**
  * View contents of folders to which the user has access
  * @param $url URL to send the rendered links to. "$" in the URL will be replaced with the ID of the link
  * @return HTML
  */
 function fullStructure($url = false)
 {
     global $DB, $USER, $Controller;
     $r = '';
     if ($Controller->{ADMIN_GROUP}(OVERRIDE)->isMember($USER)) {
         $objs = array($Controller->fileRoot);
     } else {
         $privilegeIDS = array_merge((array) $USER->ID, $USER->groupIds);
         $objs = $Controller->get($DB->asList("SELECT spine.id FROM spine RIGHT JOIN privileges ON spine.id = privileges.id WHERE spine.class = 'Folder' AND privileges.beneficiary IN ('" . join("','", Database::escape($privilegeIDS, true)) . "') AND privileges.privileges > 0"), ANYTHING, false, false);
     }
     $folders = array();
     foreach ($objs as $obj) {
         $p = $obj;
         while ($p = $p->Dir) {
             if (!$p->may($USER, READ)) {
                 break;
             } elseif (isset($objs[$p->ID])) {
                 continue 2;
             }
         }
         if (is_a($obj, 'Folder')) {
             if (!in_array($obj->filename, $this->ignore)) {
                 $folders[$obj->filename] = $obj;
             }
         }
     }
     ksort($folders);
     return listify(array_map(array($this, 'displayLink'), $folders, array_fill(0, count($folders), $url)));
 }

    function process()
    {
        global $current_user;
        /* @var $current_user CurrentUser */
        $current_user->can_throw('add_comments');
        /*
         [writemodule] => CommentsWriteModule
         [reply_to] => 1
         [doc_id] => 440
         [comment] => ghjkhjk
        */
        $document_id = max(0, (int) Request::post('doc_id'));
        $table = Request::post('table');
        $comment = Request::post('comment');
        $reply_to = max(0, (int) Request::post('reply_to'));
        Database::query('START TRANSACTION');
        $query = 'SELECT max(`id`) as `id` FROM `comments` WHERE `doc_id` = ' . $document_id . ' AND `table`=' . Database::escape($table) . '';
        $maxid = 1 + max(0, Database::sql2single($query));
        $query = 'INSERT INTO `comments` SET 
		`id`=' . $maxid . ',
		`table`=' . Database::escape($table) . ', 
		`comment`=' . Database::escape($comment) . ',
		`parent`=' . $reply_to . ',
		`doc_id`=' . $document_id . ',
		`id_author`=' . $current_user->id . ',
		`time`=' . time();
        Database::query($query);
        Database::query('COMMIT');
    }

 function write()
 {
     global $current_user;
     /*@var $current_user CurrentUser*/
     $current_user->can_throw('books_edit');
     $id = isset(Request::$post['id']) ? Request::$post['id'] : 0;
     $id = max(0, (int) $id);
     $row = Database::sql2row('SELECT * FROM genre WHERE `id`=' . $id);
     if (!$row) {
         return;
     }
     if (!$id) {
         throw new Exception('Illegal id');
     }
     $description = prepare_review(isset(Request::$post['description']) ? Request::$post['description'] : '');
     if (!$description) {
         throw new Exception('Empty description');
     }
     $description = prepare_review($description);
     $query = 'UPDATE `genre` SET `description`=' . Database::escape($description) . ' WHERE `id`=' . $id;
     Database::query($query);
     ob_end_clean();
     header('Location:' . Config::need('www_path') . '/genres/' . $row['name']);
     $current_user->gainActionPoints('genres_edit', $id, BiberLog::TargetType_genre);
     exit;
 }

	function sendMessage($id_author, $to_users, $subject, $body, $time, $thread_id = false) {
		if (!is_array($to_users))
			throw new Exception('$to_users must be an array');
		Database::query('START TRANSACTION');
		$query = 'INSERT INTO `users_messages` SET
			`id_author`=' . $id_author . ',
			`time`=' . $time . ',
			`subject`=' . Database::escape($subject) . ',
			`html`=' .  Database::escape($body);
		Database::query($query);
		// если есть тред - пишем в тот же тред
		$lastId = Database::lastInsertId();
		$thread_id = $thread_id ? $thread_id : $lastId;
		if ($thread_id) {
			$q = array();
			foreach ($to_users as $receiver_id) {
				$is_new = ($receiver_id == $id_author) ? 0 : 1;
				$q[] = '(' . $lastId . ',' . $thread_id . ',' . $receiver_id . ',' . $is_new . ',0)';
			}
			if (count($q)) {
				$query = 'INSERT INTO `users_messages_index`(message_id,thread_id,id_recipient,is_new,is_deleted) VALUES ' . implode(',', $q);
				Database::query($query);
			}
		}
		Database::query('COMMIT');
	}

 function edit_event()
 {
     $id = $_POST['id'] ? $_POST['id'] : 'NULL';
     $_POST['template_id'] = max(1, (int) $_POST['template_id']);
     Database::query('INSERT INTO `lib_events` SET
         `id` = ' . $id . ',
         `title`=' . Database::escape($_POST['title']) . ',
         `male`=' . Database::escape($_POST['male']) . ',
         `age_start_days`=' . Database::escape($_POST['age_start_days']) . ',
         `age_end_days`=' . Database::escape($_POST['age_end_days']) . ',
         `description`=' . Database::escape($_POST['description']) . ',
         
         `template_id`=' . Database::escape($_POST['template_id']) . '
             ON DUPLICATE KEY UPDATE
         `title`=' . Database::escape($_POST['title']) . ',
         `male`=' . Database::escape($_POST['male']) . ',
         `age_start_days`=' . Database::escape($_POST['age_start_days']) . ',
         `age_end_days`=' . Database::escape($_POST['age_end_days']) . ',
         `description`=' . Database::escape($_POST['description']) . ',
         
         `template_id`=' . Database::escape($_POST['template_id']) . '
             ');
     $id = $id == 'NULL' ? Database::lastInsertId() : $id;
     header('Location: /admin/event/' . $id . '/edit');
 }

	function write() {
		global $current_user;
		/* @var $current_user CurrentUser */
		if (!$current_user->authorized)
			throw new Exception('Access denied');

		$id = isset(Request::$post['id']) ? Request::$post['id'] : 0;
		$id = max(0, (int) $id);
		$parent_id = isset(Request::$post['parent_id']) ? Request::$post['parent_id'] : false;
		$parent_id = max(0, (int) $parent_id);
		if (!$id)
			throw new Exception('Illegal id');

		$title = isset(Request::$post['title']) ? Request::$post['title'] : false;
		$description = isset(Request::$post['description']) ? Request::$post['description'] : false;


		if ($parent_id == $id)
			throw new Exception('Illegal parent');

		if ($parent_id) {
			$query = 'SELECT `id` FROM `series` WHERE `id`=' . $parent_id;
			if (!Database::sql2single($query))
				throw new Exception('No such parent');
		}

		if (!$title)
			throw new Exception('Empty title');

		$description = prepare_review($description);
		$title = prepare_review($title, '');

		$query = 'UPDATE `series` SET `id_parent`=' . $parent_id . ',`title`=' . Database::escape($title) . ', `description`=' . Database::escape($description) . ' WHERE `id`=' . $id;
		Database::query($query);
	}

	function getOne() {
		$query = 'SELECT * FROM `genre` WHERE `name`=' . Database::escape($this->genre_name);
		$data = Database::sql2row($query);
		if (!isset($data['name']))
			return;
		$this->data['genres'][$data['id']] = array(
		    'name' => $data['name'],
		    'id' => $data['id'],
		    'id_parent' => $data['id_parent'],
		    'title' => $data['title'],
		    'books_count' => $data['books_count']
		);

		if (!$data['id_parent']) {
			$this->data['genres'][$data['id']]['subgenres'] = $this->getAll($data['id']);
			return;
		}

		$query = 'SELECT `id_book` FROM `book_genre` BG JOIN `book` B ON B.id = BG.id_book WHERE BG.id_genre = ' . $data['id'] . ' ORDER BY B.mark DESC LIMIT 20';
		$bids = Database::sql2array($query, 'id_book');
		$books = Books::getByIdsLoaded(array_keys($bids));
		Books::LoadBookPersons(array_keys($bids));

		foreach ($books as $book) {
			$book = Books::getById($book->id);
			list($aid, $aname) = $book->getAuthor(1, 1, 1); // именно наш автор, если их там много
			$this->data['genres'][$data['id']]['books'][] = array('id' => $book->id,
			    'cover' => $book->getCover(),
			    'title' => $book->getTitle(true),
			    'author' => $aname,
			    'author_id' => $aid,
			    'lastSave' => $book->data['modify_time']);
		}
	}

	function getLikes() {
		if (!$this->genre_id)
			return;
		$query = 'SELECT * FROM `genre` WHERE `name`=' . Database::escape($this->genre_id);
		$data = Database::sql2row($query);
		if($data['id']){
			
		}
	}

	function setStatus($status_code, $message) {
		$query = 'UPDATE `features` SET
			`status`=' . (int) $status_code . ',
			`last_run`=' . time() . ',
			`last_message`=' . Database::escape($message) . '
				WHERE
			`id`=' . $this->id;
		Database::query($query);
	}

 public function getPostByUrl($url)
 {
     $where = "Blog ='" . Database::escape($this->getId()) . "' AND Url = '" . Database::escape($url) . "'";
     $lista = BlogPost::SELECT($where);
     if (count($lista)) {
         return $lista[0];
     }
     return null;
 }

 public static function getByName($name)
 {
     $name = Database::escape($name);
     $items = self::SELECT("`Name` = '{$name}'");
     if (1 != count($items)) {
         return null;
     }
     return $items[0];
 }

 private final function set_filter($array)
 {
     if (isset($array['comparison'])) {
         $clause = "`{$array['column']}` {$array['comparison']} '" . Database::escape($array['value']) . "'";
     } else {
         $clause = "`{$array['column']}` = '" . Database::escape($array['value']) . "'";
     }
     $this->where_clause[] = $clause;
 }

	function write() {
		global $current_user;
		/* @var $current_user CurrentUser */
		if (!$current_user->authorized)
			throw new Exception('Access denied');

		$data = array(
		    'target_id' => max(0, (int) Request::$post['target_id']),
		    'target_type' => max(0, (int) Request::$post['target_type']),
		    'comment' => prepare_review(Request::$post['annotation']),
		    'rate' => min(6, max(0, (int) Request::$post['rate'])) + 1,
		);


		$event = new Event();


		if (!$data['comment']) {
			// inserting rate
			if ($data['rate'] && ($data['target_type'] == 0)) {
				$time = time();
				if ($data['rate'] > 1) {
					$query = 'INSERT INTO `book_rate` SET `id_book`=' . $data['target_id'] . ',`id_user`=' . $current_user->id . ',`rate`=' . ($data['rate'] - 1) . ',`time`=' . $time . ' ON DUPLICATE KEY UPDATE
				`rate`=' . ($data['rate'] - 1) . ',`time`=' . $time . '';
					Database::query($query);
				}
				//recalculating rate
				$query = 'SELECT COUNT(1) as cnt, SUM(`rate`) as rate FROM `book_rate` WHERE `id_book`=' . $data['target_id'];
				$res = Database::sql2row($query);
				$book_mark = round($res['rate'] / $res['cnt'] * 10);
				$query = 'UPDATE `book` SET `mark`=' . $book_mark . ' WHERE `id`=' . $data['target_id'];
				Database::query($query);
				$event->event_BookRateAdd($current_user->id, $data['target_id'], $data['rate'] - 1);
			}
		} else {
			if (!$data['target_id'])
				return;
			$query = 'INSERT INTO `reviews` SET
				`id_target`=' . $data['target_id'] . ',
				`target_type`=' . $data['target_type'] . ',
				`id_user`=' . $current_user->id . ',
				`time`=' . time() . ',
				`comment`=' . Database::escape($data['comment']) . ',
				`rate`=' . ($data['rate'] - 1) . '
					ON DUPLICATE KEY UPDATE
				`time`=' . time() . ',
				`comment`=' . Database::escape($data['comment']) . ',
				`rate`=' . ($data['rate'] - 1) . '';
			Database::query($query);
			//event
			$event->event_BookReviewAdd($current_user->id, $data['target_id'],$data['target_type'], $data['rate'] - 1 , $data['comment']);
		}


		$event->push();
	}

 /**
  *  Para insertar un nuevo registro, debo pasar la ruta de
  *  una imagen válida (puede ser de un archivo local o uno remoto con http://...)
  */
 public static function INSERT($image_path)
 {
     // Compruebo si el archivo es en realidad una imagen:
     //$finfo = finfo_open(FILEINFO_MIME_TYPE);
     //$mime = finfo_file($finfo, $image_path);
     $temp_hash = md5(microtime());
     Rack::Write('temp', $temp_hash, $image_path);
     $temp_path = Rack::Path('temp', $temp_hash);
     $is = getimagesize($temp_path);
     $mime = $is['mime'];
     switch ($mime) {
         case 'image/jpeg':
             $gd = @imagecreatefromjpeg($temp_path);
             break;
         case 'image/png':
             $gd = @imagecreatefrompng($temp_path);
             break;
         case 'image/gif':
             $gd = @imagecreatefromgif($temp_path);
             break;
         case 'image/bmp':
             $gd = @imagecreatefrombmp($temp_path);
             break;
         default:
             return null;
     }
     if (is_resource($gd)) {
         $width = imagesx($gd);
         $height = imagesy($gd);
         $hash = md5_file($temp_path);
         $list = Image::SELECT("Hash='" . Database::escape($hash) . "'");
         if (count($list)) {
             // La imagen ya existe :S
             $image = $list[0];
             $image->_setCounter($image->getCounter() + 1);
         } else {
             // Creo un nuevo registro de imagen :)
             $image = parent::INSERT();
             $image->_setWidth($width);
             $image->_setHeight($height);
             $image->_setMime($mime);
             $image->_setHash($hash);
             $image->_setSize(@filesize($temp_path));
             $image->_setCounter(1);
             // Copiar imagen a la carpeta de imágenes con el id de $image->getId(); (o con el hash)
             Rack::Write('img', md5($image->ID()), $temp_path);
         }
         Rack::Remove('temp', $temp_hash);
         return $image;
     } else {
         // Error al abrir la imagen
         Rack::Remove('temp', $temp_hash);
         return null;
     }
 }