PHP Misc::escapeString方法代码示例

 /**
  * Returns summary information about all time spent by a user in a specified time frame.
  *
  * @access  public
  * @param   string $usr_id The ID of the user this report is for.
  * @param   integer The timestamp of the beginning of the report.
  * @param   integer The timestamp of the end of this report.
  * @return  array An array of data containing information about time trackinge
  */
 function getSummaryByUser($usr_id, $start, $end)
 {
     $stmt = "SELECT\n                    ttc_title,\n                    COUNT(ttr_id) as total,\n                    SUM(ttr_time_spent) as total_time\n                 FROM\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "time_tracking,\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "time_tracking_category\n                 WHERE\n                    ttr_ttc_id = ttc_id AND\n                    ttr_usr_id = " . Misc::escapeInteger($usr_id) . " AND\n                    ttr_created_date BETWEEN '" . Misc::escapeString($start) . "' AND '" . Misc::escapeString($end) . "'\n                 GROUP BY\n                    ttc_title";
     $res = $GLOBALS["db_api"]->dbh->getAssoc($stmt, false, array(), DB_FETCHMODE_ASSOC);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return array();
     } else {
         if (count($res) > 0) {
             foreach ($res as $index => $row) {
                 $res[$index]["formatted_time"] = Misc::getFormattedTime($res[$index]["total_time"], true);
             }
         }
         return $res;
     }
 }

 /**
  * Method used to get the list of custom fields and custom field
  * values associated with a given issue ID. If usr_id is false method
  * defaults to current user.
  *
  * @param   integer $prj_id The project ID
  * @param   integer $iss_id The issue ID
  * @param   integer $usr_id The ID of the user who is going to be viewing this list.
  * @param   mixed   $form_type The name of the form this is for or if this is an array the ids of the fields to return
  * @return  array The list of custom fields
  */
 public static function getListByIssue($prj_id, $iss_id, $usr_id = null, $form_type = false)
 {
     if (!$usr_id) {
         $usr_id = Auth::getUserID();
     }
     $usr_role = User::getRoleByUser($usr_id, $prj_id);
     if (empty($usr_role)) {
         $usr_role = 0;
     }
     $stmt = 'SELECT
                 fld_id,
                 fld_title,
                 fld_type,
                 fld_report_form_required,
                 fld_anonymous_form_required,
                 fld_close_form_required,
                 ' . self::getDBValueFieldSQL() . ' as value,
                 icf_value,
                 icf_value_date,
                 icf_value_integer,
                 fld_min_role,
                 fld_description
              FROM
                 (
                 {{%custom_field}},
                 {{%project_custom_field}}
                 )
              LEFT JOIN
                 {{%issue_custom_field}}
              ON
                 pcf_fld_id=icf_fld_id AND
                 icf_iss_id=?
              WHERE
                 pcf_fld_id=fld_id AND
                 pcf_prj_id=? AND
                 fld_min_role <= ?';
     $params = array($iss_id, $prj_id, $usr_role);
     if ($form_type != false) {
         if (is_array($form_type)) {
             $stmt .= ' AND fld_id IN(' . DB_Helper::buildList($form_type) . ')';
             $params = array_merge($params, $form_type);
         } else {
             $fld_name = 'fld_' . Misc::escapeString($form_type);
             $stmt .= " AND {$fld_name}=1";
         }
     }
     $stmt .= '
              ORDER BY
                 fld_rank ASC';
     try {
         $res = DB_Helper::getInstance()->getAll($stmt, $params);
     } catch (DbException $e) {
         return array();
     }
     if (count($res) == 0) {
         return array();
     }
     $fields = array();
     foreach ($res as &$row) {
         if ($row['fld_type'] == 'combo') {
             $row['selected_cfo_id'] = $row['value'];
             $row['original_value'] = $row['value'];
             $row['value'] = self::getOptionValue($row['fld_id'], $row['value']);
             $row['field_options'] = self::getOptions($row['fld_id'], false, $iss_id);
             // add the select option to the list of values if it isn't on the list (useful for fields with active and non-active items)
             if (!empty($row['original_value']) && !isset($row['field_options'][$row['original_value']])) {
                 $row['field_options'][$row['original_value']] = self::getOptionValue($row['fld_id'], $row['original_value']);
             }
             $fields[] = $row;
         } elseif ($row['fld_type'] == 'multiple' || $row['fld_type'] == 'checkbox') {
             // check whether this field is already in the array
             $found = 0;
             foreach ($fields as $y => $field) {
                 if ($field['fld_id'] == $row['fld_id']) {
                     $found = 1;
                     $found_index = $y;
                 }
             }
             $original_value = $row['value'];
             if (!$found) {
                 $row['selected_cfo_id'] = array($row['value']);
                 $row['value'] = self::getOptionValue($row['fld_id'], $row['value']);
                 $row['field_options'] = self::getOptions($row['fld_id']);
                 $fields[] = $row;
                 $found_index = count($fields) - 1;
             } else {
                 $fields[$found_index]['value'] .= ', ' . self::getOptionValue($row['fld_id'], $row['value']);
                 $fields[$found_index]['selected_cfo_id'][] = $row['value'];
             }
//.........这里部分代码省略.........

 /**
  * Method used to update a support email account details.
  *
  * @access  public
  * @return  integer 1 if the update worked, -1 otherwise
  */
 function update()
 {
     global $HTTP_POST_VARS;
     if (empty($HTTP_POST_VARS["get_only_new"])) {
         $HTTP_POST_VARS["get_only_new"] = 0;
     }
     if (empty($HTTP_POST_VARS["leave_copy"])) {
         $HTTP_POST_VARS["leave_copy"] = 0;
     }
     if (empty($HTTP_POST_VARS["use_routing"])) {
         $HTTP_POST_VARS["use_routing"] = 0;
     } elseif ($HTTP_POST_VARS['use_routing'] == 1) {
         // if an account will be used for routing, you can't leave the message on the server
         $HTTP_POST_VARS['leave_copy'] = 0;
     }
     $stmt = "UPDATE\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "email_account\n                 SET\n                    ema_prj_id=" . Misc::escapeInteger($HTTP_POST_VARS["project"]) . ",\n                    ema_type='" . Misc::escapeString($HTTP_POST_VARS["type"]) . "',\n                    ema_hostname='" . Misc::escapeString($HTTP_POST_VARS["hostname"]) . "',\n                    ema_port='" . Misc::escapeString($HTTP_POST_VARS["port"]) . "',\n                    ema_folder='" . Misc::escapeString(@$HTTP_POST_VARS["folder"]) . "',\n                    ema_username='" . Misc::escapeString($HTTP_POST_VARS["username"]) . "',\n                    ema_password='" . Misc::escapeString($HTTP_POST_VARS["password"]) . "',\n                    ema_get_only_new=" . Misc::escapeInteger($HTTP_POST_VARS["get_only_new"]) . ",\n                    ema_leave_copy=" . Misc::escapeInteger($HTTP_POST_VARS["leave_copy"]) . ",\n                    ema_use_routing=" . Misc::escapeInteger($HTTP_POST_VARS["use_routing"]) . "\n                 WHERE\n                    ema_id=" . $HTTP_POST_VARS["id"];
     $res = $GLOBALS["db_api"]->dbh->query($stmt);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return -1;
     } else {
         return 1;
     }
 }

function getUser($name)
{
    $sql = "SELECT\n                usr_id\n            FROM\n                " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "user\n            WHERE\n                usr_full_name = '" . trim(Misc::escapeString($name)) . "'";
    return $GLOBALS["db_api"]->dbh->getOne($sql);
}

 /**
  * Method used to prepare a set of fields and values for a boolean search
  *
  * @access  public
  * @param   string $field The field name
  * @param   string $value The value for that field
  * @return  string The prepared boolean search string
  */
 function prepareBooleanSearch($field, $value)
 {
     $boolean = array();
     $pieces = explode(" ", $value);
     for ($i = 0; $i < count($pieces); $i++) {
         $boolean[] = "{$field} LIKE '%" . Misc::escapeString($pieces[$i]) . "%'";
     }
     return "(" . implode(" OR ", $boolean) . ")";
 }

 /**
  * Method used to get the list of issues to be displayed in the grid layout.
  *
  * @param   array $options The search parameters
  * @return  string The where clause
  */
 public static function buildWhereClause($options)
 {
     $usr_id = Auth::getUserID();
     $prj_id = Auth::getCurrentProject();
     $role_id = User::getRoleByUser($usr_id, $prj_id);
     $usr_details = User::getDetails($usr_id);
     $stmt = ' AND iss_usr_id = usr_id';
     if ($role_id == User::getRoleID('Customer')) {
         $crm = CRM::getInstance($prj_id);
         $contact = $crm->getContact($usr_details['usr_customer_contact_id']);
         $stmt .= " AND iss_customer_contract_id IN('" . implode("','", $contact->getContractIDS()) . "')";
         $stmt .= " AND iss_customer_id ='" . Auth::getCurrentCustomerID() . "'";
     } elseif ($role_id == User::getRoleID('Reporter') && Project::getSegregateReporters($prj_id)) {
         $stmt .= " AND (\n                        iss_usr_id = {$usr_id} OR\n                        iur_usr_id = {$usr_id}\n                        )";
     }
     if (!empty($usr_details['usr_par_code'])) {
         // restrict partners
         $stmt .= " AND ipa_par_code = '" . Misc::escapeString($usr_details['usr_par_code']) . "'";
     }
     if (!empty($options['users'])) {
         $stmt .= " AND (\n";
         if (stristr($options['users'], 'grp') !== false) {
             $chunks = explode(':', $options['users']);
             $stmt .= 'iss_grp_id = ' . Misc::escapeInteger($chunks[1]);
         } else {
             if ($options['users'] == '-1') {
                 $stmt .= 'isu_usr_id IS NULL';
             } elseif ($options['users'] == '-2') {
                 $stmt .= 'isu_usr_id IS NULL OR isu_usr_id=' . $usr_id;
             } elseif ($options['users'] == '-3') {
                 $stmt .= 'isu_usr_id = ' . $usr_id . ' OR iss_grp_id = ' . User::getGroupID($usr_id);
             } elseif ($options['users'] == '-4') {
                 $stmt .= 'isu_usr_id IS NULL OR isu_usr_id = ' . $usr_id . ' OR iss_grp_id = ' . User::getGroupID($usr_id);
             } else {
                 $stmt .= 'isu_usr_id =' . Misc::escapeInteger($options['users']);
             }
         }
         $stmt .= ')';
     }
     if (!empty($options['reporter'])) {
         $stmt .= ' AND iss_usr_id = ' . Misc::escapeInteger($options['reporter']);
     }
     if (!empty($options['show_authorized_issues'])) {
         $stmt .= " AND (iur_usr_id={$usr_id})";
     }
     if (!empty($options['show_notification_list_issues'])) {
         $stmt .= " AND (sub_usr_id={$usr_id})";
     }
     if (!empty($options['keywords'])) {
         $stmt .= " AND (\n";
         if ($options['search_type'] == 'all_text' && APP_ENABLE_FULLTEXT) {
             $stmt .= 'iss_id IN(' . implode(', ', self::getFullTextIssues($options)) . ')';
         } elseif ($options['search_type'] == 'customer' && CRM::hasCustomerIntegration($prj_id)) {
             // check if the user is trying to search by customer name / email
             $crm = CRM::getInstance($prj_id);
             $customer_ids = $crm->getCustomerIDsByString($options['keywords'], true);
             if (count($customer_ids) > 0) {
                 $stmt .= ' iss_customer_id IN (' . implode(', ', $customer_ids) . ')';
             } else {
                 // no results, kill query
                 $stmt .= ' iss_customer_id = -1';
             }
         } else {
             $stmt .= '(' . Misc::prepareBooleanSearch('iss_summary', $options['keywords']);
             $stmt .= ' OR ' . Misc::prepareBooleanSearch('iss_description', $options['keywords']) . ')';
         }
         $stmt .= "\n) ";
     }
     if (!empty($options['customer_id'])) {
         $stmt .= " AND iss_customer_id='" . Misc::escapeString($options['customer_id']) . "'";
     }
     if (!empty($options['priority'])) {
         $stmt .= ' AND iss_pri_id=' . Misc::escapeInteger($options['priority']);
     }
     if (!empty($options['status'])) {
         $stmt .= ' AND iss_sta_id=' . Misc::escapeInteger($options['status']);
     }
     if (!empty($options['category'])) {
         if (!is_array($options['category'])) {
             $options['category'] = array($options['category']);
         }
         $stmt .= ' AND iss_prc_id IN(' . implode(', ', Misc::escapeInteger($options['category'])) . ')';
     }
     if (!empty($options['hide_closed'])) {
         $stmt .= ' AND sta_is_closed=0';
     }
     if (!empty($options['release'])) {
         $stmt .= ' AND iss_pre_id = ' . Misc::escapeInteger($options['release']);
     }
     if (!empty($options['product'])) {
         $stmt .= ' AND ipv_pro_id = ' . Misc::escapeInteger($options['product']);
     }
     // now for the date fields
     $date_fields = array('created_date', 'updated_date', 'last_response_date', 'first_response_date', 'closed_date');
//.........这里部分代码省略.........

// | Free Software Foundation, Inc.                                       |
// | 51 Franklin Street, Suite 330                                          |
// | Boston, MA 02110-1301, USA.                                          |
// +----------------------------------------------------------------------+
// | Authors: Bryan Alsdorf <bryan@mysql.com>                             |
// | Authors: Elan Ruusamäe <glen@delfi.ee>                               |
// +----------------------------------------------------------------------+
require_once dirname(__FILE__) . '/../init.php';
Auth::checkAuthentication(APP_COOKIE);
$usr_id = Auth::getUserID();
/*
 * This page is used to return a single content to the expandable table using
 * httpClient library or jQuery.
 */
$valid_functions = array('email' => 'getEmail', 'note' => 'getNote', 'draft' => 'getDraft', 'phone' => 'getPhoneSupport', 'mailqueue' => 'getMailQueue', 'description' => 'getIssueDescription');
$action = Misc::escapeString($_REQUEST['action']);
if (in_array($action, array_keys($valid_functions))) {
    $method = $valid_functions[$action];
    $res = $method($_REQUEST['list_id']);
} else {
    $res = 'ERROR: Unable to call function ' . htmlspecialchars($action);
}
$callback = !empty($_GET['callback']) ? $_GET['callback'] : null;
// convert to wanted format
$res = array('ec_id' => $_REQUEST['ec_id'], 'list_id' => $_REQUEST['list_id'], 'message' => $res);
if ($callback) {
    echo $callback, '(', json_encode($res), ')';
} else {
    echo $res['message'];
}
exit;

 /**
  * Method used to update the details of a specific reminder.
  *
  * @access  public
  * @return  integer 1 if the update worked, -1 or -2 otherwise
  */
 function update()
 {
     global $HTTP_POST_VARS;
     $stmt = "UPDATE\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "reminder_level\n                 SET\n                    rem_last_updated_date='" . Date_API::getCurrentDateGMT() . "',\n                    rem_rank=" . Misc::escapeInteger($HTTP_POST_VARS['rank']) . ",\n                    rem_title='" . Misc::escapeString($HTTP_POST_VARS['title']) . "',\n                    rem_prj_id=" . Misc::escapeInteger($HTTP_POST_VARS['project']) . ",\n                    rem_skip_weekend=" . Misc::escapeInteger($HTTP_POST_VARS['skip_weekend']) . "\n                 WHERE\n                    rem_id=" . Misc::escapeInteger($HTTP_POST_VARS['id']);
     $res = $GLOBALS["db_api"]->dbh->query($stmt);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return -1;
     } else {
         Reminder::removeAllAssociations($HTTP_POST_VARS['id']);
         // map the reminder requirements now
         if (@$HTTP_POST_VARS['reminder_type'] == 'support_level' && count($HTTP_POST_VARS['support_levels']) > 0) {
             for ($i = 0; $i < count($HTTP_POST_VARS['support_levels']); $i++) {
                 Reminder::addSupportLevelAssociation($HTTP_POST_VARS['id'], $HTTP_POST_VARS['support_levels'][$i]);
             }
         } elseif (@$HTTP_POST_VARS['reminder_type'] == 'issue' && count($HTTP_POST_VARS['issues']) > 0) {
             for ($i = 0; $i < count($HTTP_POST_VARS['issues']); $i++) {
                 Reminder::addIssueAssociation($HTTP_POST_VARS['id'], $HTTP_POST_VARS['issues'][$i]);
             }
         } elseif (@$HTTP_POST_VARS['reminder_type'] == 'customer' && count($HTTP_POST_VARS['customers']) > 0) {
             for ($i = 0; $i < count($HTTP_POST_VARS['customers']); $i++) {
                 Reminder::addCustomerAssociation($HTTP_POST_VARS['id'], $HTTP_POST_VARS['customers'][$i]);
             }
         } elseif (@$HTTP_POST_VARS['reminder_type'] == 'all_issues') {
             Reminder::associateAllIssues($HTTP_POST_VARS['id']);
         }
         if (@$HTTP_POST_VARS['check_priority'] == 'yes' && count($HTTP_POST_VARS['priorities']) > 0) {
             for ($i = 0; $i < count($HTTP_POST_VARS['priorities']); $i++) {
                 Reminder::addPriorityAssociation($HTTP_POST_VARS['id'], $HTTP_POST_VARS['priorities'][$i]);
             }
         }
         return 1;
     }
 }

 /**
  * Method used to update the details of a specific reminder action.
  *
  * @access  public
  * @return  integer 1 if the update worked, -1 or -2 otherwise
  */
 function update()
 {
     global $HTTP_POST_VARS;
     $stmt = "UPDATE\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "reminder_action\n                 SET\n                    rma_last_updated_date='" . Date_API::getCurrentDateGMT() . "',\n                    rma_rank='" . Misc::escapeInteger($HTTP_POST_VARS['rank']) . "',\n                    rma_title='" . Misc::escapeString($HTTP_POST_VARS['title']) . "',\n                    rma_rmt_id=" . Misc::escapeInteger($HTTP_POST_VARS['type']) . ",\n                    rma_alert_irc=" . Misc::escapeInteger($HTTP_POST_VARS['alert_irc']) . ",\n                    rma_alert_group_leader=" . Misc::escapeInteger($HTTP_POST_VARS['alert_group_leader']) . ",\n                    rma_boilerplate='" . Misc::escapeString($HTTP_POST_VARS['boilerplate']) . "'\n                 WHERE\n                    rma_id=" . Misc::escapeInteger($HTTP_POST_VARS['id']);
     $res = $GLOBALS["db_api"]->dbh->query($stmt);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return -1;
     } else {
         // remove any user list associated with this reminder action
         Reminder_Action::clearActionUserList($HTTP_POST_VARS['id']);
         // add the user list back in, if appropriate
         if (Reminder_Action::isUserList($HTTP_POST_VARS['type'])) {
             Reminder_Action::associateUserList($HTTP_POST_VARS['id'], $HTTP_POST_VARS['user_list']);
         }
         return 1;
     }
 }

 /**
  * Method used to update the details of a specific reminder condition.
  *
  * @access  public
  * @return  integer 1 if the update worked, -1 or -2 otherwise
  */
 function update()
 {
     global $HTTP_POST_VARS;
     $stmt = "UPDATE\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "reminder_level_condition\n                 SET\n                    rlc_last_updated_date='" . Date_API::getCurrentDateGMT() . "',\n                    rlc_rmf_id=" . Misc::escapeInteger($HTTP_POST_VARS['field']) . ",\n                    rlc_rmo_id=" . Misc::escapeInteger($HTTP_POST_VARS['operator']) . ",\n                    rlc_value='" . Misc::escapeString(@$HTTP_POST_VARS['value']) . "',\n                    rlc_comparison_rmf_id = '" . Misc::escapeInteger(@$HTTP_POST_VARS['comparison_field']) . "'\n                 WHERE\n                    rlc_id=" . Misc::escapeInteger($HTTP_POST_VARS['id']);
     $res = $GLOBALS["db_api"]->dbh->query($stmt);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return -1;
     } else {
         return 1;
     }
 }

 /**
  * Searches a specified custom field for a string and returns any issues that match
  *
  * @access  public
  * @param   integer $fld_id The ID of the custom field
  * @param   string  $search The string to search for
  * @return  array An array of issue IDs
  */
 function getIssuesByString($fld_id, $search)
 {
     $sql = "SELECT\n                    icf_iss_id\n                FROM\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_custom_field\n                WHERE\n                    icf_fld_id = " . Misc::escapeInteger($fld_id) . " AND\n                    icf_value LIKE '%" . Misc::escapeString($search) . "%'";
     $res = $GLOBALS["db_api"]->dbh->getCol($sql);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return array();
     }
     return $res;
 }

 /**
  * Returns the number of issues for the specified user that are currently set to the specified status(es).
  *
  * @access  public
  * @param   integer $usr_id The id of the user.
  * @param   date $start The start date
  * @param   date $end The end date
  * @param   array $statuses An array of status abreviations to return counts for.
  * @return  array An array containing the number of issues for the user set tothe specified statuses.
  */
 function getTouchedIssueCountByStatus($usr_id, $start, $end, $statuses = false)
 {
     $stmt = "SELECT\n                    sta_title,\n                    count(DISTINCT iss_id) as total\n                 FROM\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue,\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "status,\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "issue_history\n                 WHERE\n                    his_iss_id = iss_id AND\n                    iss_sta_id = sta_id AND\n                    his_usr_id = " . Misc::escapeInteger($usr_id) . " AND\n                    his_created_date BETWEEN '" . Misc::escapeString($start) . "' AND '" . Misc::escapeString($end) . "'";
     if ($statuses != false) {
         $stmt .= " AND\n                    (\n                        sta_abbreviation IN('" . join("','", $statuses) . "') OR\n                        sta_is_closed = 1\n                    )";
     }
     $stmt .= "\n                 GROUP BY\n                    sta_title\n                 ORDER BY\n                    sta_rank";
     $res = $GLOBALS["db_api"]->dbh->getAll($stmt, DB_FETCHMODE_ASSOC);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return array();
     } else {
         return $res;
     }
 }

 /**
  * Checks if a message already is downloaded..
  *
  * @access  public
  * @param   string $message_id The Message-ID header
  * @return  boolean
  */
 function exists($message_id)
 {
     $sql = "SELECT\n                    count(*)\n                FROM\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "note\n                WHERE\n                    not_message_id ='" . Misc::escapeString($message_id) . "'";
     $res = $GLOBALS['db_api']->dbh->getOne($sql);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return false;
     }
     if ($res > 0) {
         return true;
     } else {
         return false;
     }
 }

 /**
  * Method used to associate a recipient with a given email
  * draft response.
  *
  * @access  public
  * @param   integer $emd_id The email draft ID
  * @param   string $email The recipient's email address
  * @param   boolean $is_cc Whether this recipient is in the Cc list for the given draft
  * @return  boolean
  */
 function addEmailRecipient($emd_id, $email, $is_cc)
 {
     $emd_id = Misc::escapeInteger($emd_id);
     if (!$is_cc) {
         $is_cc = 0;
     } else {
         $is_cc = 1;
     }
     $email = trim($email);
     $stmt = "INSERT INTO\n                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "email_draft_recipient\n                 (\n                    edr_emd_id,\n                    edr_is_cc,\n                    edr_email\n                 ) VALUES (\n                    {$emd_id},\n                    {$is_cc},\n                    '" . Misc::escapeString($email) . "'\n                 )";
     $res = $GLOBALS["db_api"]->dbh->query($stmt);
     if (PEAR::isError($res)) {
         Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
         return false;
     } else {
         return true;
     }
 }

 /**
  * Method used to save the changes made to an existing custom
  * filter, or to create a new custom filter.
  *
  * @return  integer 1 if the update worked properly, any other value otherwise
  */
 public static function save()
 {
     $cst_id = self::getFilterID($_POST['title']);
     // loop through all available date fields and prepare the values for the sql query
     $date_fields = array('created_date', 'updated_date', 'last_response_date', 'first_response_date', 'closed_date');
     /**
      * @var $created_date
      * @var $created_date_filter_type
      * @var $created_date_end
      * @var $updated_date
      * @var $updated_date_filter_type
      * @var $updated_date_end
      * @var $last_response_date
      * @var $last_response_date_filter_type
      * @var $last_response_date_end
      * @var $first_response_date
      * @var $first_response_date_filter_type
      * @var $first_response_date_end
      * @var $closed_date
      * @var $closed_date_filter_type
      * @var $closed_date_end
      */
     foreach ($date_fields as $field_name) {
         $date_var = $field_name;
         $filter_type_var = $field_name . '_filter_type';
         $date_end_var = $field_name . '_end';
         if (@$_POST['filter'][$field_name] == 'yes') {
             ${$date_var} = "'" . Misc::escapeString($_POST[$field_name]['Year'] . '-' . $_POST[$field_name]['Month'] . '-' . $_POST[$field_name]['Day']) . "'";
             ${$filter_type_var} = "'" . $_POST[$field_name]['filter_type'] . "'";
             if (${$filter_type_var} == "'between'") {
                 ${$date_end_var} = "'" . Misc::escapeString($_POST[$date_end_var]['Year'] . '-' . $_POST[$date_end_var]['Month'] . '-' . $_POST[$date_end_var]['Day']) . "'";
             } elseif (${$filter_type_var} == "'null'" || ${$filter_type_var} == "'in_past'") {
                 ${$date_var} = null;
                 ${$date_end_var} = null;
             } else {
                 ${$date_end_var} = null;
             }
         } else {
             ${$date_var} = null;
             ${$filter_type_var} = null;
             ${$date_end_var} = null;
         }
     }
     // save custom fields to search
     if (is_array($_POST['custom_field']) && count($_POST['custom_field']) > 0) {
         foreach ($_POST['custom_field'] as $fld_id => $search_value) {
             if (empty($search_value)) {
                 unset($_POST[$fld_id]);
             }
         }
         $custom_field_string = serialize($_POST['custom_field']);
     } else {
         $custom_field_string = '';
     }
     if (empty($_POST['is_global'])) {
         $is_global_filter = 0;
     } else {
         $is_global_filter = $_POST['is_global'];
     }
     if ($cst_id != 0) {
         $stmt = 'UPDATE
                     {{%custom_filter}}
                  SET
                     cst_iss_pri_id=?,
                     cst_iss_sev_id=?,
                     cst_keywords=?,
                     cst_users=?,
                     cst_reporter=?,
                     cst_iss_sta_id=?,
                     cst_iss_pre_id=?,
                     cst_iss_prc_id=?,
                     cst_pro_id=?,
                     cst_rows=?,
                     cst_sort_by=?,
                     cst_sort_order=?,
                     cst_hide_closed=?,
                     cst_show_authorized=?,
                     cst_show_notification_list=?,
                     cst_created_date=?,
                     cst_created_date_filter_type=?,
                     cst_created_date_time_period=?,
                     cst_created_date_end=?,
                     cst_updated_date=?,
                     cst_updated_date_filter_type=?,
                     cst_updated_date_time_period=?,
                     cst_updated_date_end=?,
                     cst_last_response_date=?,
                     cst_last_response_date_filter_type=?,
                     cst_last_response_date_time_period=?,
                     cst_last_response_date_end=?,
                     cst_first_response_date=?,
                     cst_first_response_date_filter_type=?,
                     cst_first_response_date_time_period=?,
                     cst_first_response_date_end=?,
//.........这里部分代码省略.........