PHP PMA_Util::sqlAddSlashes方法代码示例

/**
 * Saves user preferences
 *
 * @param array $config_array configuration array
 *
 * @return true|PMA_Message
 */
function PMA_saveUserprefs(array $config_array)
{
    $cfgRelation = PMA_getRelationsParam();
    $server = isset($GLOBALS['server']) ? $GLOBALS['server'] : $GLOBALS['cfg']['ServerDefault'];
    $cache_key = 'server_' . $server;
    if (!$cfgRelation['userconfigwork']) {
        // no pmadb table, use session storage
        $_SESSION['userconfig'] = array('db' => $config_array, 'ts' => time());
        if (isset($_SESSION['cache'][$cache_key]['userprefs'])) {
            unset($_SESSION['cache'][$cache_key]['userprefs']);
        }
        return true;
    }
    // save configuration to pmadb
    $query_table = PMA_Util::backquote($cfgRelation['db']) . '.' . PMA_Util::backquote($cfgRelation['userconfig']);
    $query = 'SELECT `username` FROM ' . $query_table . ' WHERE `username` = \'' . PMA_Util::sqlAddSlashes($cfgRelation['user']) . '\'';
    $has_config = $GLOBALS['dbi']->fetchValue($query, 0, 0, $GLOBALS['controllink']);
    $config_data = json_encode($config_array);
    if ($has_config) {
        $query = 'UPDATE ' . $query_table . ' SET `timevalue` = NOW(), `config_data` = \'' . PMA_Util::sqlAddSlashes($config_data) . '\'' . ' WHERE `username` = \'' . PMA_Util::sqlAddSlashes($cfgRelation['user']) . '\'';
    } else {
        $query = 'INSERT INTO ' . $query_table . ' (`username`, `timevalue`,`config_data`) ' . 'VALUES (\'' . PMA_Util::sqlAddSlashes($cfgRelation['user']) . '\', NOW(), ' . '\'' . PMA_Util::sqlAddSlashes($config_data) . '\')';
    }
    if (isset($_SESSION['cache'][$cache_key]['userprefs'])) {
        unset($_SESSION['cache'][$cache_key]['userprefs']);
    }
    if (!$GLOBALS['dbi']->tryQuery($query, $GLOBALS['controllink'])) {
        $message = PMA_Message::error(__('Could not save configuration'));
        $message->addMessage('<br /><br />');
        $message->addMessage(PMA_Message::rawError($GLOBALS['dbi']->getError($GLOBALS['controllink'])));
        return $message;
    }
    return true;
}

/**
 * Get SQL query for store new transformation details of a VIEW
 *
 * @param mysqli_result $pma_transformation_data Result set of SQL execution
 * @param array         $column_map              Details of VIEW columns
 * @param string        $view_name               Name of the VIEW
 * @param string        $db                      Database name of the VIEW
 *
 * @return string $new_transformations_sql SQL query for new transformations
 */
function PMA_getNewTransformationDataSql($pma_transformation_data, $column_map, $view_name, $db)
{
    $cfgRelation = PMA_getRelationsParam();
    // Need to store new transformation details for VIEW
    $new_transformations_sql = 'INSERT INTO ' . PMA_Util::backquote($cfgRelation['db']) . '.' . PMA_Util::backquote($cfgRelation['column_info']) . ' (`db_name`, `table_name`, `column_name`, `comment`, ' . '`mimetype`, `transformation`, `transformation_options`)' . ' VALUES ';
    $column_count = 0;
    $add_comma = false;
    while ($data_row = $GLOBALS['dbi']->fetchAssoc($pma_transformation_data)) {
        foreach ($column_map as $column) {
            if ($data_row['table_name'] == $column['table_name'] && $data_row['column_name'] == $column['refering_column']) {
                $new_transformations_sql .= $add_comma ? ', ' : '';
                $new_transformations_sql .= '(' . '\'' . $db . '\', ' . '\'' . $view_name . '\', ' . '\'';
                $new_transformations_sql .= isset($column['real_column']) ? $column['real_column'] : $column['refering_column'];
                $new_transformations_sql .= '\', ' . '\'' . $data_row['comment'] . '\', ' . '\'' . $data_row['mimetype'] . '\', ' . '\'' . $data_row['transformation'] . '\', ' . '\'' . PMA_Util::sqlAddSlashes($data_row['transformation_options']) . '\')';
                $add_comma = true;
                $column_count++;
                break;
            }
        }
        if ($column_count == count($column_map)) {
            break;
        }
    }
    return $column_count > 0 ? $new_transformations_sql : '';
}

 /**
  * returns array of partition names for a specific db/table
  *
  * @param string $db    database name
  * @param string $table table name
  *
  * @access  public
  * @return array   of partition names
  */
 public static function getPartitionNames($db, $table)
 {
     if (PMA_Partition::havePartitioning()) {
         return $GLOBALS['dbi']->fetchResult("SELECT `PARTITION_NAME` FROM `information_schema`.`PARTITIONS`" . " WHERE `TABLE_SCHEMA` = '" . PMA_Util::sqlAddSlashes($db) . "' AND `TABLE_NAME` = '" . PMA_Util::sqlAddSlashes($table) . "'");
     } else {
         return array();
     }
 }

 /**
  * Returns the comment associated with node
  * This method should be overridden by specific type of nodes
  *
  * @return string
  */
 public function getComment()
 {
     $db = PMA_Util::sqlAddSlashes($this->realParent()->real_name);
     $event = PMA_Util::sqlAddSlashes($this->real_name);
     $query = "SELECT `EVENT_COMMENT` ";
     $query .= "FROM `INFORMATION_SCHEMA`.`EVENTS` ";
     $query .= "WHERE `EVENT_SCHEMA`='{$db}' ";
     $query .= "AND `EVENT_NAME`='{$event}' ";
     return PMA_DBI_fetch_value($query);
 }

 /**
  * returns the partition method used by the table.
  *
  * @param string $db    database name
  * @param string $table table name
  *
  * @return string partition method
  */
 public static function getPartitionMethod($db, $table)
 {
     if (PMA_Partition::havePartitioning()) {
         $partition_method = $GLOBALS['dbi']->fetchResult("SELECT `PARTITION_METHOD` FROM `information_schema`.`PARTITIONS`" . " WHERE `TABLE_SCHEMA` = '" . PMA_Util::sqlAddSlashes($db) . "'" . " AND `TABLE_NAME` = '" . PMA_Util::sqlAddSlashes($table) . "'");
         if (!empty($partition_method)) {
             return $partition_method[0];
         }
     }
     return null;
 }

/**
 * returns collation of given db
 *
 * @param string $db name of db
 *
 * @return string  collation of $db
 */
function PMA_getDbCollation($db)
{
    if ($GLOBALS['dbi']->isSystemSchema($db)) {
        // We don't have to check the collation of the virtual
        // information_schema database: We know it!
        return 'utf8_general_ci';
    }
    $sql = PMA_DRIZZLE ? 'SELECT DEFAULT_COLLATION_NAME FROM data_dictionary.SCHEMAS' . ' WHERE SCHEMA_NAME = \'' . PMA_Util::sqlAddSlashes($db) . '\' LIMIT 1' : 'SELECT DEFAULT_COLLATION_NAME FROM information_schema.SCHEMATA' . ' WHERE SCHEMA_NAME = \'' . PMA_Util::sqlAddSlashes($db) . '\' LIMIT 1';
    return $GLOBALS['dbi']->fetchValue($sql);
}

/**
 * Retrieve IDs and names of schema pages
 *
 * @param string $db database name
 *
 * @return array array of schema page id and names
 */
function PMA_getPageIdsAndNames($db)
{
    $cfgRelation = PMA_getRelationsParam();
    $page_query = "SELECT `page_nr`, `page_descr` FROM " . PMA_Util::backquote($cfgRelation['db']) . "." . PMA_Util::backquote($cfgRelation['pdf_pages']) . " WHERE db_name = '" . PMA_Util::sqlAddSlashes($db) . "'" . " ORDER BY `page_descr`";
    $page_rs = PMA_queryAsControlUser($page_query, false, PMA_DatabaseInterface::QUERY_STORE);
    $result = array();
    while ($curr_page = $GLOBALS['dbi']->fetchAssoc($page_rs)) {
        $result[$curr_page['page_nr']] = $curr_page['page_descr'];
    }
    return $result;
}

 /**
  * Returns the comment associated with node
  * This method should be overridden by specific type of nodes
  *
  * @return string
  */
 public function getComment()
 {
     $db = PMA_Util::sqlAddSlashes($this->realParent()->real_name);
     $routine = PMA_Util::sqlAddSlashes($this->real_name);
     $query = "SELECT `ROUTINE_COMMENT` ";
     $query .= "FROM `INFORMATION_SCHEMA`.`ROUTINES` ";
     $query .= "WHERE `ROUTINE_SCHEMA`='{$db}' ";
     $query .= "AND `ROUTINE_NAME`='{$routine}' ";
     $query .= "AND `ROUTINE_TYPE`='FUNCTION' ";
     return PMA_DBI_fetch_value($query);
 }

 /**
  * sqlAddslashes test
  *
  * @return void
  */
 public function testAddSlashes()
 {
     $string = "\\'test''\\''\\'\r\t\n";
     $this->assertEquals("\\\\\\\\\\'test\\'\\'\\\\\\\\\\'\\'\\\\\\\\\\'\\r\\t\\n", PMA_Util::sqlAddSlashes($string, true, true, true));
     $this->assertEquals("\\\\\\\\''test''''\\\\\\\\''''\\\\\\\\''\\r\\t\\n", PMA_Util::sqlAddSlashes($string, true, true, false));
     $this->assertEquals("\\\\\\\\\\'test\\'\\'\\\\\\\\\\'\\'\\\\\\\\\\'\r\t\n", PMA_Util::sqlAddSlashes($string, true, false, true));
     $this->assertEquals("\\\\\\\\''test''''\\\\\\\\''''\\\\\\\\''\r\t\n", PMA_Util::sqlAddSlashes($string, true, false, false));
     $this->assertEquals("\\\\\\'test\\'\\'\\\\\\'\\'\\\\\\'\\r\\t\\n", PMA_Util::sqlAddSlashes($string, false, true, true));
     $this->assertEquals("\\\\''test''''\\\\''''\\\\''\\r\\t\\n", PMA_Util::sqlAddSlashes($string, false, true, false));
     $this->assertEquals("\\\\\\'test\\'\\'\\\\\\'\\'\\\\\\'\r\t\n", PMA_Util::sqlAddSlashes($string, false, false, true));
     $this->assertEquals("\\\\''test''''\\\\''''\\\\''\r\t\n", PMA_Util::sqlAddSlashes($string, false, false, false));
 }

 /**
  * Returns the comment associated with node
  * This method should be overridden by specific type of nodes
  *
  * @return string
  */
 public function getComment()
 {
     $db = PMA_Util::sqlAddSlashes($this->realParent()->realParent()->real_name);
     $table = PMA_Util::sqlAddSlashes($this->realParent()->real_name);
     $column = PMA_Util::sqlAddSlashes($this->real_name);
     $query = "SELECT `COLUMN_COMMENT` ";
     $query .= "FROM `INFORMATION_SCHEMA`.`COLUMNS` ";
     $query .= "WHERE `TABLE_SCHEMA`='{$db}' ";
     $query .= "AND `TABLE_NAME`='{$table}' ";
     $query .= "AND `COLUMN_NAME`='{$column}' ";
     return PMA_DBI_fetch_value($query);
 }

 /**
  * Get SQL query for store new transformation details of a VIEW
  *
  * @param object $pma_transformation_data Result set of SQL execution
  * @param array  $column_map              Details of VIEW columns
  * @param string $view_name               Name of the VIEW
  * @param string $db                      Database name of the VIEW
  *
  * @return string $new_transformations_sql SQL query for new transformations
  */
 function getNewTransformationDataSql($pma_transformation_data, $column_map, $view_name, $db)
 {
     $cfgRelation = \PMA_getRelationsParam();
     // Need to store new transformation details for VIEW
     $new_transformations_sql = sprintf("INSERT INTO %s.%s (" . "`db_name`, `table_name`, `column_name`, " . "`comment`, `mimetype`, `transformation`, " . "`transformation_options`) VALUES", \PMA_Util::backquote($cfgRelation['db']), \PMA_Util::backquote($cfgRelation['column_info']));
     $column_count = 0;
     $add_comma = false;
     while ($data_row = $this->dbi->fetchAssoc($pma_transformation_data)) {
         foreach ($column_map as $column) {
             if ($data_row['table_name'] != $column['table_name'] || $data_row['column_name'] != $column['refering_column']) {
                 continue;
             }
             $new_transformations_sql .= sprintf("%s ('%s', '%s', '%s', '%s', '%s', '%s', '%s')", $add_comma ? ', ' : '', $db, $view_name, isset($column['real_column']) ? $column['real_column'] : $column['refering_column'], $data_row['comment'], $data_row['mimetype'], $data_row['transformation'], \PMA_Util::sqlAddSlashes($data_row['transformation_options']));
             $add_comma = true;
             $column_count++;
             break;
         }
         if ($column_count == count($column_map)) {
             break;
         }
     }
     return $column_count > 0 ? $new_transformations_sql : '';
 }

/**
 * Get Ajax return when $_REQUEST['type'] === 'setval'
 *
 * @param Array $variable_doc_links documentation links
 *
 * @return null
 */
function PMA_getAjaxReturnForSetVal($variable_doc_links)
{
    $response = PMA_Response::getInstance();
    $value = $_REQUEST['varValue'];
    $matches = array();
    if (isset($variable_doc_links[$_REQUEST['varName']][3]) && $variable_doc_links[$_REQUEST['varName']][3] == 'byte' && preg_match('/^\\s*(\\d+(\\.\\d+)?)\\s*(mb|kb|mib|kib|gb|gib)\\s*$/i', $value, $matches)) {
        $exp = array('kb' => 1, 'kib' => 1, 'mb' => 2, 'mib' => 2, 'gb' => 3, 'gib' => 3);
        $value = floatval($matches[1]) * PMA_Util::pow(1024, $exp[mb_strtolower($matches[3])]);
    } else {
        $value = PMA_Util::sqlAddSlashes($value);
    }
    if (!is_numeric($value)) {
        $value = "'" . $value . "'";
    }
    if (!preg_match("/[^a-zA-Z0-9_]+/", $_REQUEST['varName']) && $GLOBALS['dbi']->query('SET GLOBAL ' . $_REQUEST['varName'] . ' = ' . $value)) {
        // Some values are rounded down etc.
        $varValue = $GLOBALS['dbi']->fetchSingleRow('SHOW GLOBAL VARIABLES WHERE Variable_name="' . PMA_Util::sqlAddSlashes($_REQUEST['varName']) . '";', 'NUM');
        $response->addJSON('variable', PMA_formatVariable($_REQUEST['varName'], $varValue[1], $variable_doc_links));
    } else {
        $response->isSuccess(false);
        $response->addJSON('error', __('Setting variable failed'));
    }
}

 /**
  * Returns HTML for show hidden button displayed infront of database node
  *
  * @return String HTML for show hidden button
  */
 public function getHtmlForControlButtons()
 {
     $ret = '';
     $db = $this->real_name;
     $cfgRelation = PMA_getRelationsParam();
     if ($cfgRelation['navwork']) {
         $navTable = PMA_Util::backquote($cfgRelation['db']) . "." . PMA_Util::backquote($cfgRelation['navigationhiding']);
         $sqlQuery = "SELECT COUNT(*) FROM " . $navTable . " WHERE `username`='" . PMA_Util::sqlAddSlashes($GLOBALS['cfg']['Server']['user']) . "'" . " AND `db_name`='" . PMA_Util::sqlAddSlashes($db) . "'";
         $count = $GLOBALS['dbi']->fetchValue($sqlQuery, 0, 0, $GLOBALS['controllink']);
         if ($count > 0) {
             $ret = '<span class="dbItemControls">' . '<a href="navigation.php?' . PMA_URL_getCommon() . '&showUnhideDialog=true' . '&dbName=' . urldecode($db) . '"' . ' class="showUnhide ajax">' . PMA_Util::getImage('lightbulb.png', __('Show hidden items')) . '</a></span>';
         }
     }
     return $ret;
 }

 /**
  * Get data cell for non numeric type fields
  *
  * @param string        $column                the relevant column in data row
  * @param string        $class                 the html class for column
  * @param object        $meta                  the meta-information about
  *                                             the field
  * @param array         $map                   the list of relations
  * @param array         $_url_params           the parameters for generate
  *                                             url
  * @param boolean       $condition_field       the column should highlighted
  *                                             or not
  * @param object|string $transformation_plugin the name of transformation
  *                                             function
  * @param string        $default_function      the default transformation
  *                                             function
  * @param string        $transform_options     the transformation parameters
  * @param boolean       $is_field_truncated    is data truncated due to
  *                                             LimitChars
  * @param array         $analyzed_sql          the analyzed query
  * @param integer       &$dt_result            the link id associated to
  *                                             the query which results
  *                                             have to be displayed
  * @param integer       $col_index             the column index
  *
  * @return  string  $cell the prepared data cell, html content
  *
  * @access  private
  *
  * @see     _getTableBody()
  */
 private function _getDataCellForNonNumericColumns($column, $class, $meta, $map, $_url_params, $condition_field, $transformation_plugin, $default_function, $transform_options, $is_field_truncated, $analyzed_sql, &$dt_result, $col_index)
 {
     $is_analyse = $this->__get('is_analyse');
     $field_flags = $GLOBALS['dbi']->fieldFlags($dt_result, $col_index);
     $bIsText = gettype($transformation_plugin) === 'object' && strpos($transformation_plugin->getMIMEtype(), 'Text') === false;
     // disable inline grid editing
     // if binary fields are protected
     // or transformation plugin is of non text type
     // such as image
     if (stristr($field_flags, self::BINARY_FIELD) && ($GLOBALS['cfg']['ProtectBinary'] === 'all' || $GLOBALS['cfg']['ProtectBinary'] === 'noblob' && !stristr($meta->type, self::BLOB_FIELD) || $GLOBALS['cfg']['ProtectBinary'] === 'blob' && stristr($meta->type, self::BLOB_FIELD)) || $bIsText) {
         $class = str_replace('grid_edit', '', $class);
     }
     if (!isset($column) || is_null($column)) {
         $cell = $this->_buildNullDisplay($class, $condition_field, $meta);
         return $cell;
     }
     if ($column == '') {
         $cell = $this->_buildEmptyDisplay($class, $condition_field, $meta);
         return $cell;
     }
     // Cut all fields to $GLOBALS['cfg']['LimitChars']
     // (unless it's a link-type transformation or binary)
     if (!(gettype($transformation_plugin) === "object" && strpos($transformation_plugin->getName(), 'Link') !== false) && !stristr($field_flags, self::BINARY_FIELD)) {
         $is_field_truncated = $this->_getPartialText($column);
     }
     $formatted = false;
     if (isset($meta->_type) && $meta->_type === MYSQLI_TYPE_BIT) {
         $column = PMA_Util::printableBitValue($column, $meta->length);
         // some results of PROCEDURE ANALYSE() are reported as
         // being BINARY but they are quite readable,
         // so don't treat them as BINARY
     } elseif (stristr($field_flags, self::BINARY_FIELD) && !(isset($is_analyse) && $is_analyse)) {
         // we show the BINARY or BLOB message and field's size
         // (or maybe use a transformation)
         $binary_or_blob = self::BLOB_FIELD;
         if ($meta->type === self::STRING_FIELD) {
             $binary_or_blob = self::BINARY_FIELD;
         }
         $column = $this->_handleNonPrintableContents($binary_or_blob, $column, $transformation_plugin, $transform_options, $default_function, $meta, $_url_params, $is_field_truncated);
         $class = $this->_addClass($class, $condition_field, $meta, '', $is_field_truncated, $transformation_plugin, $default_function);
         $result = strip_tags($column);
         // disable inline grid editing
         // if binary or blob data is not shown
         if (stristr($result, $binary_or_blob)) {
             $class = str_replace('grid_edit', '', $class);
         }
         $formatted = true;
     }
     if ($formatted) {
         $cell = $this->_buildValueDisplay($class, $condition_field, $column);
         return $cell;
     }
     // transform functions may enable no-wrapping:
     $function_nowrap = 'applyTransformationNoWrap';
     $bool_nowrap = $default_function != $transformation_plugin && function_exists($transformation_plugin->{$function_nowrap}()) ? $transformation_plugin->{$function_nowrap}($transform_options) : false;
     // do not wrap if date field type
     $nowrap = preg_match('@DATE|TIME@i', $meta->type) || $bool_nowrap ? ' nowrap' : '';
     $where_comparison = ' = \'' . PMA_Util::sqlAddSlashes($column) . '\'';
     $cell = $this->_getRowData($class, $condition_field, $analyzed_sql, $meta, $map, $column, $transformation_plugin, $default_function, $nowrap, $where_comparison, $transform_options, $is_field_truncated);
     return $cell;
 }

                if (isset($show_as_php)) {
                    $url_params['show_as_php'] = $show_as_php;
                }
                PMA_sendHeaderLocation($cfg['PmaAbsoluteUri'] . 'index.php' . PMA_URL_getCommon($url_params, 'text'));
            }
            exit;
        }
    }
}
// end if (ensures db exists)
if (empty($is_table) && !defined('PMA_SUBMIT_MULT') && !defined('TABLE_MAY_BE_ABSENT')) {
    // Not a valid table name -> back to the db_sql.php
    if (mb_strlen($table)) {
        $is_table = $GLOBALS['dbi']->getCachedTableContent("{$db}.{$table}", false);
        if (!$is_table) {
            $_result = $GLOBALS['dbi']->tryQuery('SHOW TABLES LIKE \'' . PMA_Util::sqlAddSlashes($table, true) . '\';', null, PMA_DatabaseInterface::QUERY_STORE);
            $is_table = @$GLOBALS['dbi']->numRows($_result);
            $GLOBALS['dbi']->freeResult($_result);
        }
    } else {
        $is_table = false;
    }
    if (!$is_table) {
        if (!defined('IS_TRANSFORMATION_WRAPPER')) {
            if (mb_strlen($table)) {
                // SHOW TABLES doesn't show temporary tables, so try select
                // (as it can happen just in case temporary table, it should be
                // fast):
                /**
                 * @todo should this check really
                 * only happen if IS_TRANSFORMATION_WRAPPER?