PHP DatabaseManager::sanitize方法代码示例

 public function setUsername($name)
 {
     if ($this->verified) {
         $database = new DatabaseManager();
         $database->query("UPDATE `users` SET `username`='" . $database->sanitize($name) . "' WHERE `email`='" . $database->sanitize($this->getEmail()) . "'");
         apc_store('userObject_' . $this->blid, $this, 600);
     }
 }

 function getEntry($time, $duration)
 {
     $database = new DatabaseManager();
     $res = $database->query("SELECT * FROM `cron_statistics` WHERE `duration`='" . $database->sanitize($duration) . "' AND `time`='" . $database->sanitize($time) . "'");
     if ($res->num_rows == 0) {
         return false;
     } else {
         $obj = json_decode($res->fetch_object()->data);
         return $obj;
     }
 }

 public static function getFromBoardId($id, $bargain = false, $limit = 0, $offset = 0)
 {
     $ret = array();
     $db = new DatabaseManager();
     if ($limit != 0) {
         $res = $db->query("SELECT `id` FROM `addon_addons` WHERE board='" . $db->sanitize($id) . "' AND bargain='" . $bargain . "' AND deleted=0 ORDER BY `name` asc LIMIT {$offset}, {$limit}");
     } else {
         $res = $db->query("SELECT `id` FROM `addon_addons` WHERE board='" . $db->sanitize($id) . "' AND bargain='" . $bargain . "' AND deleted=0 ORDER BY `name` asc");
     }
     while ($obj = $res->fetch_object()) {
         $ret[$obj->id] = AddonManager::getFromId($obj->id);
     }
     return $ret;
 }

 function getEntry($time, $duration)
 {
     $entry = apc_fetch('cronStat_' . $duration . '_' . $time, $success);
     if (!$success) {
         //$duration = hour, day, week, month
         $database = new DatabaseManager();
         $res = $database->query("SELECT * FROM `cron_statistics` WHERE `duration`='" . $database->sanitize($duration) . "' AND `time`='" . $database->sanitize($time) . "'");
         if ($res->num_rows == 0) {
             return false;
         } else {
             $obj = json_decode($res->fetch_object()->data);
             apc_store('cronStat_' . $duration . '_' . $time, $obj);
             return $obj;
         }
     } else {
         return $entry;
     }
 }

 function getCount()
 {
     if (!isset($numberOfAddons)) {
         $db = new DatabaseManager();
         $res = $db->query("SELECT COUNT(*) FROM `addon_addons` WHERE board='" . $db->sanitize($this->id) . "'  AND deleted=0");
         $this->numberOfAddons = $res->fetch_row()[0];
     }
     return $this->numberOfAddons;
 }

 public static function getHistory($blid)
 {
     $db = new DatabaseManager();
     $res = $db->query("SELECT * FROM `user_log` WHERE `blid`='" . $db->sanitize($blid) . "' ORDER BY `lastseen` DESC");
     $ret = array();
     while ($obj = $res->fetch_object()) {
         $ret[] = $obj;
     }
     return $ret;
 }

 public static function getDistribution($aid)
 {
     $db = new DatabaseManager();
     $res = $db->query("SELECT * FROM `stats_usage` WHERE `aid`='" . $db->sanitize($aid) . "' AND `reported` > now() - INTERVAL 30 DAY");
     $ret = array();
     while ($obj = $res->fetch_object()) {
         if (isset($ret[$obj->version])) {
             $ret[$obj->version]++;
         } else {
             $ret[$obj->version] = 1;
         }
     }
     return $ret;
 }

 public static function getAddonDownloads($id, $type)
 {
     if ($type == "ingame") {
         $sql = "ingameDownloads";
     } else {
         if ($type == "update" || $type == "updates") {
             $sql = "updateDownloads";
         } else {
             $sql = "webDownloads";
         }
     }
     $db = new DatabaseManager();
     $res = $db->query("SELECT `{$sql}` FROM `addon_stats` WHERE `aid`=" . $db->sanitize($id));
     $sum = $res->fetch_object()->{$sql};
     return $sum;
 }

<?php

//this page is designed to be requested by ajax or the in-game client
require_once realpath(dirname(__DIR__) . "/private/class/DatabaseManager.php");
require_once realpath(dirname(__DIR__) . "/private/lib/Parsedown.php");
if (!isset($_POST['query'])) {
    echo "Invalid search";
} else {
    $db = new DatabaseManager();
    $baseQuery = "SELECT * FROM `addon_addons` WHERE `name` LIKE '%" . $db->sanitize($_POST['query']) . "%'";
    //later on we can make it so administrators can search for deleted add-ons
    $extendedQuery = " AND `deleted` = 0";
    if (isset($_POST['blid'])) {
        try {
            require_once realpath(dirname(__DIR__) . "/private/class/UserManager.php");
            $user = UserManager::getFromBLID($_POST['blid']);
            $extendedQuery = $extendedQuery . " AND `author` = '" . $db->sanitize($_POST['blid']) . "'";
        } catch (Exception $e) {
            echo "<p>User " . htmlspecialchars($_POST['blid']) . " not found.</p>";
        }
    }
    //One of the few time's we'll use a direct SQL query on a page
    $result = $db->query($baseQuery . $extendedQuery);
    echo "<h2>Search Results for ";
    echo "\"<u>" . htmlspecialchars($_POST['query']) . "</u>\"";
    if (isset($user) && $user) {
        echo " by <a href=\"/user/view.php?id=" . $user->getID() . "\">" . htmlspecialchars($user->getUsername()) . "</a>";
    }
    echo "</h2><hr />";
    if ($result->num_rows) {
        while ($row = $result->fetch_object()) {

<?php

require_once dirname(dirname(__DIR__)) . '/private/class/AddonManager.php';
require_once dirname(dirname(__DIR__)) . '/private/class/DatabaseManager.php';
require_once dirname(dirname(__DIR__)) . '/private/class/SemVer.php';
header('Content-Type: text/json');
$db = new DatabaseManager();
if (!isset($_GET['mods'])) {
    $ret = new stdClass();
    $ret->status = "error";
    $ret->error = "mods field is blank";
    die(json_encode($ret, JSON_PRETTY_PRINT));
}
$addonIds = explode("-", $db->sanitize($_GET['mods']));
$repo = new stdClass();
$repo->name = "Blockland Glass Generated Repo";
$ao = 'add-ons';
$repo->{$ao} = array();
foreach ($addonIds as $id) {
    $obj = AddonManager::getFromId($id);
    $webUrl = "api.blocklandglass.com";
    $cdnUrl = "cdn.blocklandglass.com";
    $addon = new stdClass();
    $addon->name = $obj->getFilename();
    $addon->description = str_replace("\r\n", "<br>", $obj->getDescription());
    $channelId[1] = "stable";
    $channelId[2] = "unstable";
    $channelId[3] = "development";
    foreach ($channelId as $cid => $name) {
        $channel = new stdClass();
        $chanDat = $obj->getBranchInfo($cid);

 public function updateDescription($desc)
 {
     $db = new DatabaseManager();
     $db->query("UPDATE `addon_addons` SET `description`='" . $db->sanitize($desc) . "' WHERE id='" . $this->id . "';");
     $this->description = $desc;
 }

<?php

require_once dirname(__DIR__) . '/class/DatabaseManager.php';
$db = new DatabaseManager();
$mods = split("-", $_GET['mods']);
$sqlString = "";
foreach ($mods as $mod) {
    if ($sqlString != "") {
        $sqlString = $sqlString . " OR ";
    }
    $sqlString = $sqlString . "rtbId='" . $db->sanitize($mod) . "'";
}
$conversions = array();
$result = $db->query("SELECT * FROM `addon_rtb` WHERE glassId IS NOT NULL AND (" . $sqlString . ")");
while ($obj = $result->fetch_object()) {
    $addonRes = $db->query("SELECT `name`,`id`,`filename` FROM `addon_addons` WHERE id=" . $obj->glassId);
    $obj->addonData = $addonRes->fetch_object();
    $conversions[] = $obj;
}
echo json_encode($conversions);

 private static function getLoginDetailsFromBLID($blid)
 {
     $loginDetails = apc_fetch('loginDetailsFromBLID_' . $blid);
     if ($loginDetails === false) {
         $database = new DatabaseManager();
         $query = "SELECT password, salt, blid, username FROM users WHERE `blid` = '" . $database->sanitize($blid) . "' AND  `verified` = 1";
         $loginDetails = AccountManager::buildLoginDetailsFromQuery($database, $query);
         apc_store('loginDetailsFromBLID_' . $blid, $loginDetails, AccountManager::$cacheTime);
         //$loginDetails = apc_fetch('loginDetails_' . $blid); - causing error?
     }
     return $loginDetails;
 }

 public function updateEmail($email)
 {
     $database = new DatabaseManager();
     $database->query("UPDATE `users` SET `email`='" . $database->sanitize($email) . "' WHERE `blid`='" . $database->sanitize($this->getBlid()) . "'");
     $this->email = $email;
 }

 protected function onAccountRemoteVerified($blid)
 {
     //echo "remote success " . $blid;
     $this->remoteVerified = true;
     $this->blid = $blid;
     //officially start session
     $db = new DatabaseManager();
     $db->query("INSERT INTO  `blocklandGlass`.`ingame_sessions` (`blid`, `sessionid`, `start`, `lastactive`, `version`)\n\t\t\tVALUES ('" . $this->getBlid() . "', '" . session_id() . "', NOW( ) , CURRENT_TIMESTAMP, '" . $db->sanitize($this->getVersion()) . "');");
 }