PHP Format::striptags方法代码示例

 function sendAccessLink()
 {
     global $ost;
     if (!($ticket = $this->getTicket()) || !($email = $ost->getConfig()->getDefaultEmail()) || !($content = Page::lookup(Page::getIdByType('access-link')))) {
         return;
     }
     $vars = array('url' => $ost->getConfig()->getBaseUrl(), 'ticket' => $this->getTicket(), 'user' => $this, 'recipient' => $this);
     $msg = $ost->replaceTemplateVariables(array('subj' => $content->getName(), 'body' => $content->getBody()), $vars);
     $email->send($this->getEmail(), Format::striptags($msg['subj']), $msg['body']);
 }

 function save($id, $vars, &$errors)
 {
     if ($id && !$vars['group_id']) {
         $errors['err'] = 'Missing or invalid group ID';
     }
     if (!$vars['group_name']) {
         $errors['group_name'] = 'Group name required';
     } elseif (strlen($vars['group_name']) < 5) {
         $errors['group_name'] = 'Group name must be at least 5 chars.';
     } else {
         $sql = 'SELECT group_id FROM ' . GROUP_TABLE . ' WHERE group_name=' . db_input($vars['group_name']);
         if ($id) {
             $sql .= ' AND group_id!=' . db_input($id);
         }
         if (db_num_rows(db_query($sql))) {
             $errors['group_name'] = 'Group name already exists';
         }
     }
     if (!$errors) {
         $sql = ' SET updated=NOW(), group_name=' . db_input(Format::striptags($vars['group_name'])) . ', group_enabled=' . db_input($vars['group_enabled']) . ', dept_access=' . db_input($vars['depts'] ? implode(',', $vars['depts']) : '') . ', can_create_tickets=' . db_input($vars['can_create_tickets']) . ', can_delete_tickets=' . db_input($vars['can_delete_tickets']) . ', can_edit_tickets=' . db_input($vars['can_edit_tickets']) . ', can_transfer_tickets=' . db_input($vars['can_transfer_tickets']) . ', can_close_tickets=' . db_input($vars['can_close_tickets']) . ', can_ban_emails=' . db_input($vars['can_ban_emails']) . ', can_manage_kb=' . db_input($vars['can_manage_kb']);
         //echo $sql;
         if ($id) {
             $res = db_query('UPDATE ' . GROUP_TABLE . ' ' . $sql . ' WHERE group_id=' . db_input($id));
             if (!$res || !db_affected_rows()) {
                 $errors['err'] = 'Internal error occured';
             }
         } else {
             $res = db_query('INSERT INTO ' . GROUP_TABLE . ' ' . $sql . ',created=NOW()');
             if ($res && ($gID = db_insert_id())) {
                 return $gID;
             }
             $errors['err'] = 'Unable to create the group. Internal error';
         }
     }
     return $errors ? false : true;
 }

 static function save($id, $vars, &$errors)
 {
     global $cfg;
     if ($id && $id != $_POST['dept_id']) {
         $errors['err'] = _('Missing or invalid Dept ID');
     }
     if (!$_POST['email_id'] || !is_numeric($_POST['email_id'])) {
         $errors['email_id'] = _('Dept email required');
     }
     if (!is_numeric($_POST['tpl_id'])) {
         $errors['tpl_id'] = _('Template required');
     }
     if (!$_POST['dept_name']) {
         $errors['dept_name'] = _('Dept name required');
     } elseif (strlen($_POST['dept_name']) < 4) {
         $errors['dept_name'] = _('Dept name must be at least 4 chars.');
     } else {
         $sql = 'SELECT dept_id FROM ' . DEPT_TABLE . ' WHERE dept_name=' . db_input($_POST['dept_name']);
         if ($id) {
             $sql .= ' AND dept_id!=' . db_input($id);
         }
         if (db_num_rows(db_query($sql))) {
             $errors['dept_name'] = _('Department already exists');
         }
     }
     if ($_POST['ispublic'] && !$_POST['dept_signature']) {
         $errors['dept_signature'] = _('Signature required');
     }
     if (!$_POST['ispublic'] && $_POST['dept_id'] == $cfg->getDefaultDeptId()) {
         $errors['ispublic'] = _('Default department can not be private');
     }
     if (!$errors) {
         $sql = ' SET updated=NOW() ' . ',ispublic=' . db_input($_POST['ispublic']) . ',email_id=' . db_input($_POST['email_id']) . ',tpl_id=' . db_input($_POST['tpl_id']) . ',autoresp_email_id=' . db_input($_POST['autoresp_email_id']) . ',manager_id=' . db_input($_POST['manager_id'] ? $_POST['manager_id'] : 0) . ',dept_name=' . db_input(Format::striptags($_POST['dept_name'])) . ',dept_signature=' . db_input(Format::striptags($_POST['dept_signature'])) . ',ticket_auto_response=' . db_input($_POST['ticket_auto_response']) . ',message_auto_response=' . db_input($_POST['message_auto_response']) . ',can_append_signature=' . db_input(isset($_POST['can_append_signature']) ? 1 : 0);
         if ($id) {
             $sql = 'UPDATE ' . DEPT_TABLE . ' ' . $sql . ' WHERE dept_id=' . db_input($id);
             if (!db_query($sql) || !db_affected_rows()) {
                 $errors['err'] = _('Unable to update ') . Format::input($_POST['dept_name']) . _(' Dept. Error occured');
             }
         } else {
             $sql = 'INSERT INTO ' . DEPT_TABLE . ' ' . $sql . ',created=NOW()';
             if (db_query($sql) && ($deptID = db_insert_id())) {
                 return $deptID;
             }
             $errors['err'] = _('Unable to create department. Internal error');
         }
     }
     return $errors ? false : true;
 }

 function save($id, $vars, &$errors)
 {
     global $cfg;
     //very basic checks
     $vars['name'] = Format::striptags(trim($vars['name']));
     if ($id && $id != $vars['id']) {
         $errors['err'] = 'Internal error. Get technical help.';
     }
     if (!$vars['email'] || !Validator::is_email($vars['email'])) {
         $errors['email'] = 'Valid email required';
     } elseif (($eid = Email::getIdByEmail($vars['email'])) && $eid != $id) {
         $errors['email'] = 'Email already exits';
     } elseif ($cfg && !strcasecmp($cfg->getAdminEmail(), $vars['email'])) {
         $errors['email'] = 'Email already used as admin email!';
     } elseif (Staff::getIdByEmail($vars['email'])) {
         //make sure the email doesn't belong to any of the staff
         $errors['email'] = 'Email in-use by a staff member';
     }
     if (!$vars['name']) {
         $errors['name'] = 'Email name required';
     }
     if ($vars['mail_active'] || $vars['smtp_active'] && $vars['smtp_auth']) {
         if (!$vars['userid']) {
             $errors['userid'] = 'Username missing';
         }
         if (!$id && !$vars['passwd']) {
             $errors['passwd'] = 'Password required';
         }
     }
     if ($vars['mail_active']) {
         //Check pop/imapinfo only when enabled.
         if (!function_exists('imap_open')) {
             $errors['mail_active'] = 'IMAP doesn\'t exist. PHP must be compiled with IMAP enabled.';
         }
         if (!$vars['mail_host']) {
             $errors['mail_host'] = 'Host name required';
         }
         if (!$vars['mail_port']) {
             $errors['mail_port'] = 'Port required';
         }
         if (!$vars['mail_protocol']) {
             $errors['mail_protocol'] = 'Select protocol';
         }
         if (!$vars['mail_fetchfreq'] || !is_numeric($vars['mail_fetchfreq'])) {
             $errors['mail_fetchfreq'] = 'Fetch interval required';
         }
         if (!$vars['mail_fetchmax'] || !is_numeric($vars['mail_fetchmax'])) {
             $errors['mail_fetchmax'] = 'Maximum emails required';
         }
         if (!$vars['dept_id'] || !is_numeric($vars['dept_id'])) {
             $errors['dept_id'] = 'You must select a Dept.';
         }
         if (!$vars['priority_id']) {
             $errors['priority_id'] = 'You must select a priority';
         }
         if (!isset($vars['postfetch'])) {
             $errors['postfetch'] = 'Indicate what to do with fetched emails';
         } elseif (!strcasecmp($vars['postfetch'], 'archive')) {
             if (!$vars['mail_archivefolder']) {
                 $errors['postfetch'] = 'Valid folder required';
             }
         }
     }
     if ($vars['smtp_active']) {
         if (!$vars['smtp_host']) {
             $errors['smtp_host'] = 'Host name required';
         }
         if (!$vars['smtp_port']) {
             $errors['smtp_port'] = 'Port required';
         }
     }
     //abort on errors
     if ($errors) {
         return false;
     }
     if (!$errors && ($vars['mail_host'] && $vars['userid'])) {
         $sql = 'SELECT email_id FROM ' . EMAIL_TABLE . ' WHERE mail_host=' . db_input($vars['mail_host']) . ' AND userid=' . db_input($vars['userid']);
         if ($id) {
             $sql .= ' AND email_id!=' . db_input($id);
         }
         if (db_num_rows(db_query($sql))) {
             $errors['userid'] = $errors['host'] = 'Host/userid combination already in-use.';
         }
     }
     $passwd = $vars['passwd'] ? $vars['passwd'] : $vars['cpasswd'];
     if (!$errors && $vars['mail_active']) {
         //note: password is unencrypted at this point...MailFetcher expect plain text.
         $fetcher = new MailFetcher($vars['userid'], $passwd, $vars['mail_host'], $vars['mail_port'], $vars['mail_protocol'], $vars['mail_encryption']);
         if (!$fetcher->connect()) {
             $errors['err'] = 'Invalid login. Check ' . Format::htmlchars($vars['mail_protocol']) . ' settings';
             $errors['mail'] = '<br>' . $fetcher->getLastError();
         } elseif ($vars['mail_archivefolder'] && !$fetcher->checkMailbox($vars['mail_archivefolder'], true)) {
             $errors['postfetch'] = 'Invalid or unknown mail folder! >> ' . $fetcher->getLastError() . '';
             if (!$errors['mail']) {
                 $errors['mail'] = 'Invalid or unknown archive folder!';
             }
         }
     }
     if (!$errors && $vars['smtp_active']) {
         //Check SMTP login only.
//.........这里部分代码省略.........

 function save($id, $vars, &$errors)
 {
     global $cfg;
     $tpl = null;
     $vars['name'] = Format::striptags(trim($vars['name']));
     if ($id && $id != $vars['id']) {
         $errors['err'] = 'Internal error. Try again';
     }
     if (!$vars['name']) {
         $errors['name'] = 'Name required';
     } elseif (($tid = Template::getIdByName($vars['name'])) && $tid != $id) {
         $errors['name'] = 'Template name already exists';
     }
     if (!$id && (!$vars['tpl_id'] || !($tpl = Template::lookup($vars['tpl_id'])))) {
         $errors['tpl_id'] = 'Selection required';
     }
     if ($errors) {
         return false;
     }
     $sql = ' updated=NOW() ' . ' ,name=' . db_input($vars['name']) . ' ,isactive=' . db_input($vars['isactive']) . ' ,notes=' . db_input($vars['notes']);
     if ($id) {
         $sql = 'UPDATE ' . EMAIL_TEMPLATE_TABLE . ' SET ' . $sql . ' WHERE tpl_id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = 'Unable to update the template. Internal error occurred';
     } elseif ($tpl && ($info = $tpl->getInfo())) {
         $sql = 'INSERT INTO ' . EMAIL_TEMPLATE_TABLE . ' SET ' . $sql . ' ,created=NOW() ' . ' ,cfg_id=' . db_input($cfg->getId()) . ' ,ticket_autoresp_subj=' . db_input($info['ticket_autoresp_subj']) . ' ,ticket_autoresp_body=' . db_input($info['ticket_autoresp_body']) . ' ,ticket_notice_subj=' . db_input($info['ticket_notice_subj']) . ' ,ticket_notice_body=' . db_input($info['ticket_notice_body']) . ' ,ticket_alert_subj=' . db_input($info['ticket_alert_subj']) . ' ,ticket_alert_body=' . db_input($info['ticket_alert_body']) . ' ,message_autoresp_subj=' . db_input($info['message_autoresp_subj']) . ' ,message_autoresp_body=' . db_input($info['message_autoresp_body']) . ' ,message_alert_subj=' . db_input($info['message_alert_subj']) . ' ,message_alert_body=' . db_input($info['message_alert_body']) . ' ,note_alert_subj=' . db_input($info['note_alert_subj']) . ' ,note_alert_body=' . db_input($info['note_alert_body']) . ' ,assigned_alert_subj=' . db_input($info['assigned_alert_subj']) . ' ,assigned_alert_body=' . db_input($info['assigned_alert_body']) . ' ,ticket_overdue_subj=' . db_input($info['ticket_overdue_subj']) . ' ,ticket_overdue_body=' . db_input($info['ticket_overdue_body']) . ' ,ticket_overlimit_subj=' . db_input($info['ticket_overlimit_subj']) . ' ,ticket_overlimit_body=' . db_input($info['ticket_overlimit_body']) . ' ,ticket_reply_subj=' . db_input($info['ticket_reply_subj']) . ' ,ticket_reply_body=' . db_input($info['ticket_reply_body']);
         if (db_query($sql) && ($id = db_insert_id())) {
             return $id;
         }
         $errors['err'] = 'Unable to create template. Internal error';
     }
     return false;
 }

 function save($id, $vars, &$errors, $validation = false)
 {
     //Cleanup.
     $vars['question'] = Format::striptags(trim($vars['question']));
     //validate
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal error. Try again');
     }
     if (!$vars['question']) {
         $errors['question'] = __('Question required');
     } elseif (($qid = self::findIdByQuestion($vars['question'])) && $qid != $id) {
         $errors['question'] = __('Question already exists');
     }
     if (!$vars['category_id'] || !($category = Category::lookup($vars['category_id']))) {
         $errors['category_id'] = __('Category is required');
     }
     if (!$vars['answer']) {
         $errors['answer'] = __('FAQ answer is required');
     }
     if ($errors || $validation) {
         return !$errors;
     }
     //save
     $sql = ' updated=NOW() ' . ', question=' . db_input($vars['question']) . ', answer=' . db_input(Format::sanitize($vars['answer'], false)) . ', category_id=' . db_input($vars['category_id']) . ', ispublished=' . db_input(isset($vars['ispublished']) ? $vars['ispublished'] : 0) . ', notes=' . db_input(Format::sanitize($vars['notes']));
     if ($id) {
         $sql = 'UPDATE ' . FAQ_TABLE . ' SET ' . $sql . ' WHERE faq_id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this FAQ article'));
     } else {
         $sql = 'INSERT INTO ' . FAQ_TABLE . ' SET ' . $sql . ',created=NOW()';
         if (db_query($sql) && ($id = db_insert_id())) {
             Signal::send('model.created', FAQ::lookup($id));
             return $id;
         }
         $errors['err'] = sprintf(__('Unable to create %s.'), __('this FAQ article')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

 function save($id, $vars, &$errors)
 {
     global $ost;
     $tpl = null;
     $vars['name'] = Format::striptags(trim($vars['name']));
     if ($id && $id != $vars['tpl_id']) {
         $errors['err'] = __('Internal error occurred');
     }
     if (!$vars['name']) {
         $errors['name'] = __('Name is required');
     } elseif (($tid = EmailTemplateGroup::getIdByName($vars['name'])) && $tid != $id) {
         $errors['name'] = __('Template name already exists');
     }
     if (!$id && ($vars['tpl_id'] && !($tpl = EmailTemplateGroup::lookup($vars['tpl_id'])))) {
         $errors['tpl_id'] = __('Invalid template set specified');
     }
     if ($errors) {
         return false;
     }
     $sql = ' updated=NOW() ' . ' ,name=' . db_input($vars['name']) . ' ,isactive=' . db_input($vars['isactive']) . ' ,notes=' . db_input(Format::sanitize($vars['notes']));
     if ($vars['lang_id']) {
         // TODO: Validation of lang_id
         $sql .= ',lang=' . db_input($vars['lang_id']);
     }
     if ($id) {
         $sql = 'UPDATE ' . EMAIL_TEMPLATE_GRP_TABLE . ' SET ' . $sql . ' WHERE tpl_id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this template set')) . ' ' . __('Internal error occurred');
     } else {
         if (isset($vars['id'])) {
             $sql .= ', tpl_id=' . db_input($vars['id']);
         }
         $sql = 'INSERT INTO ' . EMAIL_TEMPLATE_GRP_TABLE . ' SET created=NOW(), ' . $sql;
         if (!db_query($sql) || !($new_id = db_insert_id())) {
             $errors['err'] = sprintf(__('Unable to create %s.'), __('this template set')) . ' ' . __('Internal error occurred');
             return false;
         }
         if ($tpl && ($info = $tpl->getInfo())) {
             $sql = 'INSERT INTO ' . EMAIL_TEMPLATE_TABLE . '
                 (created, updated, tpl_id, code_name, subject, body)
                 SELECT NOW() as created, NOW() as updated, ' . db_input($new_id) . ' as tpl_id, code_name, subject, body
                 FROM ' . EMAIL_TEMPLATE_TABLE . ' WHERE tpl_id=' . db_input($tpl->getId());
             if (!db_query($sql) || !db_insert_id()) {
                 return false;
             }
         }
         return $new_id;
     }
     return false;
 }

 function sanitize($text, $striptags = false)
 {
     //balance and neutralize unsafe tags.
     $text = Format::safe_html($text);
     $text = self::localizeInlineImages($text);
     //If requested - strip tags with decoding disabled.
     return $striptags ? Format::striptags($text, false) : $text;
 }

 function save($id, $vars, &$errors)
 {
     if ($id && $vars['id'] != $id) {
         $errors['err'] = __('Missing or invalid group ID');
     }
     if (!$vars['name']) {
         $errors['name'] = __('Group name required');
     } elseif (strlen($vars['name']) < 3) {
         $errors['name'] = __('Group name must be at least 3 chars.');
     } elseif (($gid = Group::getIdByName($vars['name'])) && $gid != $id) {
         $errors['name'] = __('Group name already exists');
     }
     if ($errors) {
         return false;
     }
     $sql = ' SET updated=NOW() ' . ', group_name=' . db_input(Format::striptags($vars['name'])) . ', group_enabled=' . db_input($vars['isactive']) . ', can_create_tickets=' . db_input($vars['can_create_tickets']) . ', can_delete_tickets=' . db_input($vars['can_delete_tickets']) . ', can_edit_tickets=' . db_input($vars['can_edit_tickets']) . ', can_assign_tickets=' . db_input($vars['can_assign_tickets']) . ', can_transfer_tickets=' . db_input($vars['can_transfer_tickets']) . ', can_close_tickets=' . db_input($vars['can_close_tickets']) . ', can_ban_emails=' . db_input($vars['can_ban_emails']) . ', can_manage_premade=' . db_input($vars['can_manage_premade']) . ', can_manage_faq=' . db_input($vars['can_manage_faq']) . ', can_post_ticket_reply=' . db_input($vars['can_post_ticket_reply']) . ', can_view_staff_stats=' . db_input($vars['can_view_staff_stats']) . ', notes=' . db_input(Format::sanitize($vars['notes']));
     if ($id) {
         $sql = 'UPDATE ' . GROUP_TABLE . ' ' . $sql . ' WHERE group_id=' . db_input($id);
         if ($res = db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this group')) . ' ' . __('Internal error occurred');
     } else {
         $sql = 'INSERT INTO ' . GROUP_TABLE . ' ' . $sql . ',created=NOW()';
         if (($res = db_query($sql)) && ($id = db_insert_id())) {
             return $id;
         }
         $errors['err'] = sprintf(__('Unable to create %s.'), __('this group')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

 function searchable($value)
 {
     $value = preg_replace(array('`<br(\\s*)?/?>`i', '`</div>`i'), "\n", $value);
     $value = Format::htmldecode(Format::striptags($value));
     return Format::searchable($value);
 }

             $errors['lastname'] = 'Last name required';
         }
         if (!$_POST['email'] || !Validator::is_email($_POST['email'])) {
             $errors['email'] = 'Valid email required';
         }
         if ($_POST['phone'] && !Validator::is_phone($_POST['phone'])) {
             $errors['phone'] = 'Enter a valid number';
         }
         if ($_POST['mobile'] && !Validator::is_phone($_POST['mobile'])) {
             $errors['mobile'] = 'Enter a valid number';
         }
         if ($_POST['phone_ext'] && !is_numeric($_POST['phone_ext'])) {
             $errors['phone_ext'] = 'Invalid ext.';
         }
         if (!$errors) {
             $sql = 'UPDATE ' . STAFF_TABLE . ' SET updated=NOW() ' . ',firstname=' . db_input(Format::striptags($_POST['firstname'])) . ',lastname=' . db_input(Format::striptags($_POST['lastname'])) . ',email=' . db_input($_POST['email']) . ',phone="' . db_input($_POST['phone'], false) . '"' . ',phone_ext=' . db_input($_POST['phone_ext']) . ',mobile="' . db_input($_POST['mobile'], false) . '"' . ',signature=' . db_input(Format::striptags($_POST['signature'])) . ' WHERE staff_id=' . db_input($thisuser->getId());
             if (db_query($sql) && db_affected_rows()) {
                 $msg = 'Profile Updated Successfully';
             } else {
                 $errors['err'] = 'Error(s) occured. Profile NOT updated';
             }
         } else {
             $errors['err'] = 'Error(s) below occured. Try again';
         }
         break;
     default:
         $errors['err'] = 'Uknown action';
 }
 //Reload user info if no errors.
 if (!$errors) {
     $thisuser->reload();

//.........这里部分代码省略.........
                 Sys::log(LOG_CRIT, 'Overlimit Notice', $msg);
             }
         }
     }
     //Any error above is fatal.
     if ($errors) {
         return 0;
     }
     // OK...just do it.
     $deptId = $vars['deptId'];
     //pre-selected Dept if any.
     $priorityId = $vars['pri'];
     $source = ucfirst($vars['source']);
     $topic = NULL;
     // Intenal mapping magic...see if we need to overwrite anything
     if (isset($vars['topicId']) && ($topic = Topic::lookup($vars['topicId']))) {
         //Ticket created via web by user/or staff
         $deptId = $deptId ? $deptId : $topic->getDeptId();
         $priorityId = $priorityId ? $priorityId : $topic->getPriorityId();
         if ($autorespond) {
             $autorespond = $topic->autoRespond();
         }
         $source = $vars['source'] ? $vars['source'] : 'Web';
     } elseif ($vars['emailId'] && !$vars['deptId'] && ($email = Email::lookup($vars['emailId']))) {
         //Emailed Tickets
         $deptId = $email->getDeptId();
         $priorityId = $priorityId ? $priorityId : $email->getPriorityId();
         if ($autorespond) {
             $autorespond = $email->autoRespond();
         }
         $email = null;
         $source = 'Email';
     } elseif ($vars['deptId']) {
         //Opened by staff.
         $deptId = $vars['deptId'];
         $source = ucfirst($vars['source']);
     }
     //Last minute checks
     $priorityId = $priorityId ? $priorityId : $cfg->getDefaultPriorityId();
     $deptId = $deptId ? $deptId : $cfg->getDefaultDeptId();
     $topicId = $vars['topicId'] ? $vars['topicId'] : 0;
     $ipaddress = $vars['ip'] ? $vars['ip'] : $_SERVER['REMOTE_ADDR'];
     //We are ready son...hold on to the rails.
     $extId = Ticket::genExtRandID();
     $sql = 'INSERT INTO ' . TICKET_TABLE . ' SET created=NOW() ' . ' ,lastmessage= NOW()' . ' ,ticketID=' . db_input($extId) . ' ,dept_id=' . db_input($deptId) . ' ,topic_id=' . db_input($topicId) . ' ,priority_id=' . db_input($priorityId) . ' ,email=' . db_input($vars['email']) . ' ,name=' . db_input(Format::striptags($vars['name'])) . ' ,subject=' . db_input(Format::striptags($vars['subject'])) . ' ,phone="' . db_input($vars['phone'], false) . '"' . ' ,phone_ext=' . db_input($vars['phone_ext'] ? $vars['phone_ext'] : '') . ' ,ip_address=' . db_input($ipaddress) . ' ,source=' . db_input($source);
     //Make sure the origin is staff - avoid firebug hack!
     if ($vars['duedate'] && !strcasecmp($origin, 'staff')) {
         $sql .= ' ,duedate=' . db_input(date('Y-m-d G:i', Misc::dbtime($vars['duedate'] . ' ' . $vars['time'])));
     }
     if (!db_query($sql) || !($id = db_insert_id()) || !($ticket = Ticket::lookup($id))) {
         return null;
     }
     /* -------------------- POST CREATE ------------------------ */
     $dept = $ticket->getDept();
     if (!$cfg->useRandomIds()) {
         //Sequential ticketIDs support really..really suck arse.
         $extId = $id;
         //To make things really easy we are going to use autoincrement ticket_id.
         db_query('UPDATE ' . TICKET_TABLE . ' SET ticketID=' . db_input($extId) . ' WHERE ticket_id=' . $id . ' LIMIT 1');
         //TODO: RETHING what happens if this fails?? [At the moment on failure random ID is used...making stuff usable]
     }
     //post the message.
     $msgid = $ticket->postMessage($vars['message'], $source, $vars['mid'], $vars['header'], true);
     //TODO: recover from postMessage error??
     //Upload attachments...web based. - XXX: Assumes user uploaded attachments!! XXX: move it to client interface.
     if ($_FILES['attachment']['name'] && $cfg->allowOnlineAttachments() && $msgid) {
         if (!$cfg->allowAttachmentsOnlogin() || $cfg->allowAttachmentsOnlogin() && ($thisuser && $thisuser->isValid())) {
             $ticket->uploadAttachment($_FILES['attachment'], $msgid, 'M');
         }
     }
     // Configure service-level-agreement for this ticket
     $ticket->selectSLAId($vars['slaId']);
     //Auto assign staff or team - auto assignment based on filter rules.
     if ($vars['staffId'] && !$vars['assignId']) {
         $ticket->assignToStaff($vars['staffId'], 'auto-assignment');
     }
     if ($vars['teamId'] && !$vars['assignId']) {
         $ticket->assignToTeam($vars['teamId'], 'auto-assignment');
     }
     /**********   double check auto-response  ************/
     //Overwrite auto responder if the FROM email is one of the internal emails...loop control.
     if ($autorespond && Email::getIdByEmail($ticket->getEmail())) {
         $autorespond = false;
     }
     if ($autorespond && $dept && !$dept->autoRespONNewTicket()) {
         $autorespond = false;
     }
     # Messages that are clearly auto-responses from email systems should
     # not have a return 'ping' message
     if ($autorespond && $vars['header'] && EmailFilter::isAutoResponse(Mail_Parse::splitHeaders($vars['header']))) {
         $autorespond = false;
     }
     //Don't auto respond to mailer daemons.
     if ($autorespond && (strpos(strtolower($vars['email']), 'mailer-daemon@') !== false || strpos(strtolower($vars['email']), 'postmaster@') !== false)) {
         $autorespond = false;
     }
     /***** See if we need to send some alerts ****/
     $ticket->onNewTicket($vars['message'], $autorespond, $alertstaff);
     return $ticket;
 }

 function clean(&$what)
 {
     if (isset($what['topic'])) {
         $what['topic'] = Format::striptags(trim($what['topic']));
     }
 }

 function save($id, $vars, &$errors)
 {
     $vars['username'] = Format::striptags($vars['username']);
     $vars['firstname'] = Format::striptags($vars['firstname']);
     $vars['lastname'] = Format::striptags($vars['lastname']);
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal Error');
     }
     if (!$vars['firstname']) {
         $errors['firstname'] = __('First name required');
     }
     if (!$vars['lastname']) {
         $errors['lastname'] = __('Last name required');
     }
     $error = '';
     if (!$vars['username'] || !Validator::is_username($vars['username'], $error)) {
         $errors['username'] = $error ? $error : __('Username is required');
     } elseif (($uid = Staff::getIdByUsername($vars['username'])) && $uid != $id) {
         $errors['username'] = __('Username already in use');
     }
     if (!$vars['email'] || !Validator::is_valid_email($vars['email'])) {
         $errors['email'] = __('Valid email is required');
     } elseif (Email::getIdByEmail($vars['email'])) {
         $errors['email'] = __('Already in use system email');
     } elseif (($uid = Staff::getIdByEmail($vars['email'])) && $uid != $id) {
         $errors['email'] = __('Email already in use by another agent');
     }
     if ($vars['phone'] && !Validator::is_phone($vars['phone'])) {
         $errors['phone'] = __('Valid phone number is required');
     }
     if ($vars['mobile'] && !Validator::is_phone($vars['mobile'])) {
         $errors['mobile'] = __('Valid phone number is required');
     }
     if ($vars['passwd1'] || $vars['passwd2'] || !$id) {
         if ($vars['passwd1'] && strcmp($vars['passwd1'], $vars['passwd2'])) {
             $errors['passwd2'] = __('Passwords do not match');
         } elseif ($vars['backend'] != 'local' || $vars['welcome_email']) {
             // Password can be omitted
         } elseif (!$vars['passwd1'] && !$id) {
             $errors['passwd1'] = __('Temporary password is required');
             $errors['temppasswd'] = __('Required');
         } elseif ($vars['passwd1'] && strlen($vars['passwd1']) < 6) {
             $errors['passwd1'] = __('Password must be at least 6 characters');
         }
     }
     if (!$vars['dept_id']) {
         $errors['dept_id'] = __('Department is required');
     }
     if (!$vars['group_id']) {
         $errors['group_id'] = __('Group is required');
     }
     if (!$vars['timezone_id']) {
         $errors['timezone_id'] = __('Time zone selection is required');
     }
     // Ensure we will still have an administrator with access
     if ($vars['isadmin'] !== '1' || $vars['isactive'] !== '1') {
         $sql = 'select count(*), max(staff_id) from ' . STAFF_TABLE . ' WHERE isadmin=1 and isactive=1';
         if (($res = db_query($sql)) && (list($count, $sid) = db_fetch_row($res))) {
             if ($count == 1 && $sid == $id) {
                 $errors['isadmin'] = __('Cowardly refusing to remove or lock out the only active administrator');
             }
         }
     }
     if ($errors) {
         return false;
     }
     $sql = 'SET updated=NOW() ' . ' ,isadmin=' . db_input($vars['isadmin']) . ' ,isactive=' . db_input($vars['isactive']) . ' ,isvisible=' . db_input(isset($vars['isvisible']) ? 1 : 0) . ' ,onvacation=' . db_input(isset($vars['onvacation']) ? 1 : 0) . ' ,assigned_only=' . db_input(isset($vars['assigned_only']) ? 1 : 0) . ' ,dept_id=' . db_input($vars['dept_id']) . ' ,group_id=' . db_input($vars['group_id']) . ' ,timezone_id=' . db_input($vars['timezone_id']) . ' ,daylight_saving=' . db_input(isset($vars['daylight_saving']) ? 1 : 0) . ' ,username=' . db_input($vars['username']) . ' ,firstname=' . db_input($vars['firstname']) . ' ,lastname=' . db_input($vars['lastname']) . ' ,email=' . db_input($vars['email']) . ' ,backend=' . db_input($vars['backend']) . ' ,phone="' . db_input(Format::phone($vars['phone']), false) . '"' . ' ,phone_ext=' . db_input($vars['phone_ext']) . ' ,mobile="' . db_input(Format::phone($vars['mobile']), false) . '"' . ' ,signature=' . db_input(Format::sanitize($vars['signature'])) . ' ,notes=' . db_input(Format::sanitize($vars['notes']));
     if ($vars['passwd1']) {
         $sql .= ' ,passwd=' . db_input(Passwd::hash($vars['passwd1']));
         if (isset($vars['change_passwd'])) {
             $sql .= ' ,change_passwd=1';
         }
     } elseif (!isset($vars['change_passwd'])) {
         $sql .= ' ,change_passwd=0';
     }
     if ($id) {
         $sql = 'UPDATE ' . STAFF_TABLE . ' ' . $sql . ' WHERE staff_id=' . db_input($id);
         if (db_query($sql) && db_affected_rows()) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this agent')) . ' ' . __('Internal error occurred');
     } else {
         $sql = 'INSERT INTO ' . STAFF_TABLE . ' ' . $sql . ', created=NOW()';
         if (db_query($sql) && ($uid = db_insert_id())) {
             return $uid;
         }
         $errors['err'] = sprintf(__('Unable to create %s.'), __('this agent')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

 function save($id, $vars, &$errors)
 {
     global $cfg;
     $vars['topic'] = Format::striptags(trim($vars['topic']));
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal error occurred');
     }
     if (!$vars['topic']) {
         $errors['topic'] = __('Help topic name is required');
     } elseif (strlen($vars['topic']) < 5) {
         $errors['topic'] = __('Topic is too short. Five characters minimum');
     } elseif (($tid = self::getIdByName($vars['topic'], $vars['topic_pid'])) && $tid != $id) {
         $errors['topic'] = __('Topic already exists');
     }
     if (!is_numeric($vars['dept_id'])) {
         $errors['dept_id'] = __('Department selection is required');
     }
     if ($vars['custom-numbers'] && !preg_match('`(?!<\\\\)#`', $vars['number_format'])) {
         $errors['number_format'] = 'Ticket number format requires at least one hash character (#)';
     }
     if ($errors) {
         return false;
     }
     foreach (array('sla_id', 'form_id', 'page_id', 'topic_pid') as $f) {
         if (!isset($vars[$f])) {
             $vars[$f] = 0;
         }
     }
     $sql = ' updated=NOW() ' . ',topic=' . db_input($vars['topic']) . ',topic_pid=' . db_input($vars['topic_pid']) . ',dept_id=' . db_input($vars['dept_id']) . ',priority_id=' . db_input($vars['priority_id']) . ',status_id=' . db_input($vars['status_id']) . ',sla_id=' . db_input($vars['sla_id']) . ',form_id=' . db_input($vars['form_id']) . ',page_id=' . db_input($vars['page_id']) . ',isactive=' . db_input($vars['isactive']) . ',ispublic=' . db_input($vars['ispublic']) . ',sequence_id=' . db_input($vars['custom-numbers'] ? $vars['sequence_id'] : 0) . ',number_format=' . db_input($vars['custom-numbers'] ? $vars['number_format'] : '') . ',flags=' . db_input($vars['custom-numbers'] ? self::FLAG_CUSTOM_NUMBERS : 0) . ',noautoresp=' . db_input(isset($vars['noautoresp']) && $vars['noautoresp'] ? 1 : 0) . ',notes=' . db_input(Format::sanitize($vars['notes']));
     //Auto assign ID is overloaded...
     if ($vars['assign'] && $vars['assign'][0] == 's') {
         $sql .= ',team_id=0, staff_id=' . db_input(preg_replace("/[^0-9]/", "", $vars['assign']));
     } elseif ($vars['assign'] && $vars['assign'][0] == 't') {
         $sql .= ',staff_id=0, team_id=' . db_input(preg_replace("/[^0-9]/", "", $vars['assign']));
     } else {
         $sql .= ',staff_id=0, team_id=0 ';
     }
     //no auto-assignment!
     $rv = false;
     if ($id) {
         $sql = 'UPDATE ' . TOPIC_TABLE . ' SET ' . $sql . ' WHERE topic_id=' . db_input($id);
         if (!($rv = db_query($sql))) {
             $errors['err'] = sprintf(__('Unable to update %s.'), __('this help topic')) . ' ' . __('Internal error occurred');
         }
     } else {
         if (isset($vars['topic_id'])) {
             $sql .= ', topic_id=' . db_input($vars['topic_id']);
         }
         // If in manual sort mode, place the new item directly below the
         // parent item
         if ($vars['topic_pid'] && $cfg && $cfg->getTopicSortMode() != 'a') {
             $sql .= ', `sort`=' . db_input(db_result(db_query('SELECT COALESCE(`sort`,0)+1 FROM ' . TOPIC_TABLE . ' WHERE `topic_id`=' . db_input($vars['topic_pid']))));
         }
         $sql = 'INSERT INTO ' . TOPIC_TABLE . ' SET ' . $sql . ',created=NOW()';
         if (db_query($sql) && ($id = db_insert_id())) {
             $rv = $id;
         } else {
             $errors['err'] = sprintf(__('Unable to create %s.'), __('this help topic')) . ' ' . __('Internal error occurred');
         }
     }
     if (!$cfg || $cfg->getTopicSortMode() == 'a') {
         static::updateSortOrder();
     }
     return $rv;
 }