PHP POD::escapeString方法代码示例

/** ETC */
function getURLForFilter($value)
{
    $value = POD::escapeString($value);
    $value = str_replace('http://', '', $value);
    $lastSlashPos = lastIndexOf($value, '/');
    if ($lastSlashPos > -1) {
        $value = substr($value, 0, $lastSlashPos);
    }
    return $value;
}

function getTrashCommentsWithPagingForOwner($blogid, $category, $name, $ip, $search, $page, $count)
{
    global $database;
    $sql = "SELECT c.*, e.title, c2.name AS parentName \n\t\tFROM {$database['prefix']}Comments c \n\t\tLEFT JOIN {$database['prefix']}Entries e ON c.blogid = e.blogid AND c.entry = e.id AND e.draft = 0 \n\t\tLEFT JOIN {$database['prefix']}Comments c2 ON c.parent = c2.id AND c.blogid = c2.blogid \n\t\tWHERE c.blogid = {$blogid} AND c.isfiltered > 0";
    $postfix = '';
    if ($category > 0) {
        $categories = POD::queryColumn("SELECT id FROM {$database['prefix']}Categories WHERE parent = {$category}");
        array_push($categories, $category);
        $sql .= ' AND e.category IN (' . implode(', ', $categories) . ')';
        $postfix .= '&category=' . rawurlencode($category);
    } else {
        $sql .= ' AND (e.category >= 0 OR c.entry = 0)';
    }
    if (!empty($name)) {
        $sql .= ' AND c.name = \'' . POD::escapeString($name) . '\'';
        $postfix .= '&name=' . rawurlencode($name);
    }
    if (!empty($ip)) {
        $sql .= ' AND c.ip = \'' . POD::escapeString($ip) . '\'';
        $postfix .= '&ip=' . rawurlencode($ip);
    }
    if (!empty($search)) {
        $search = escapeSearchString($search);
        $sql .= " AND (c.name LIKE '%{$search}%' OR c.homepage LIKE '%{$search}%' OR c.comment LIKE '%{$search}%')";
        $postfix .= '&search=' . rawurlencode($search);
    }
    $sql .= ' ORDER BY c.written DESC';
    list($comments, $paging) = Paging::fetch($sql, $page, $count);
    if (strlen($postfix) > 0) {
        $paging['postfix'] .= $postfix . '&withSearch=on';
    }
    return array($comments, $paging);
}

function getEntriesByKeyword($blogid, $keyword)
{
    global $database;
    $keyword = POD::escapeString($keyword);
    $visibility = doesHaveOwnership() ? '' : 'AND visibility > 1';
    return POD::queryAll("SELECT id, userid, title, category, comments, published \n\t\t\tFROM {$database['prefix']}Entries \n\t\t\tWHERE blogid = {$blogid} \n\t\t\t\tAND draft = 0 {$visibility} \n\t\t\t\tAND category >= 0 \n\t\t\t\tAND (title LIKE '%{$keyword}%' OR content LIKE '%{$keyword}%')\n\t\t\tORDER BY published DESC");
}

 public static function write($id, $data)
 {
     if (is_null(self::$context)) {
         self::initialize();
     }
     if (strlen($id) < 32) {
         return false;
     }
     $userid = Acl::getIdentity('textcube');
     if (empty($userid)) {
         $userid = Acl::getIdentity('openid') ? SESSION_OPENID_USERID : '';
     }
     if (empty($userid)) {
         $userid = 'null';
     }
     $data = POD::escapeString($data);
     $server = POD::escapeString($_SERVER['HTTP_HOST']);
     $request = POD::escapeString(substr($_SERVER['REQUEST_URI'], 0, 255));
     $referer = isset($_SERVER['HTTP_REFERER']) ? POD::escapeString(substr($_SERVER['HTTP_REFERER'], 0, 255)) : '';
     $timer = Timer::getMicroTime() - self::$sessionMicrotime;
     $current = Timestamp::getUNIXtime();
     $result = self::query('count', "UPDATE " . self::$context->getProperty('database.prefix') . "Sessions\n\t\t\t\tSET userid = {$userid}, privilege = '{$data}', server = '{$server}', request = '{$request}', referer = '{$referer}', timer = {$timer}, updated = IF(updated,{$current},1)\n\t\t\t\tWHERE id = '{$id}' AND address = '{$_SERVER['REMOTE_ADDR']}'");
     if ($result && $result == 1) {
         @POD::commit();
         return true;
     }
     return false;
 }

function removeServiceSetting($name, $pruneSimilarEntries = false)
{
    global $database;
    clearServiceSettingCache();
    if ($pruneSimilarEntries) {
        return POD::execute("DELETE FROM {$database['prefix']}ServiceSettings WHERE name like '" . POD::escapeString($name) . "'");
    } else {
        return POD::execute("DELETE FROM {$database['prefix']}ServiceSettings WHERE name = '" . POD::escapeString($name) . "'");
    }
}

function suggestLocatives($blogid, $filter)
{
    global $database;
    $locatives = array();
    $result = POD::queryAll('SELECT DISTINCT location, COUNT(*) cnt FROM ' . $database['prefix'] . 'Entries WHERE blogid = ' . $blogid . ' AND location LIKE "' . POD::escapeString($filter) . '%" GROUP BY location ORDER BY cnt DESC LIMIT 10');
    if ($result) {
        foreach ($result as $locative) {
            $locatives[] = $locative[0];
        }
    }
    return $locatives;
}

function getKeywordsWithPaging($blogid, $search, $page, $count)
{
    $ctx = Model_Context::getInstance();
    $aux = '';
    if ($search !== true && $search) {
        $search = POD::escapeString($search);
        $aux = "AND (title LIKE '%{$search}%' OR content LIKE '%{$search}%')";
    }
    $visibility = doesHaveOwnership() ? '' : 'AND visibility > 0';
    $sql = "SELECT * \n\t\tFROM " . $ctx->getProperty('database.prefix') . "Entries \n\t\tWHERE blogid = {$blogid} \n\t\t\tAND draft = 0 {$visibility} \n\t\t\tAND category = -1 {$aux} \n\t\tORDER BY published DESC";
    return Paging::fetch($sql, $page, $count, $ctx->getProperty('uri.folder') . "/" . $ctx->getProperty('suri.value'));
}

function EAS_Call($type, $name, $title, $url, $content)
{
    global $hostURL, $blogURL, $database;
    $blogstr = $hostURL . $blogURL;
    $rpc = new XMLRPC();
    $rpc->url = 'http://antispam.eolin.com/RPC/index.php';
    if ($rpc->call('checkSpam', $blogstr, $type, $name, $title, $url, $content, $_SERVER['REMOTE_ADDR']) == false) {
        // call fail
        // Do Local spam check with "Thief-cat algorithm"
        $count = 0;
        $tableName = $database['prefix'] . 'RemoteResponses';
        if ($type == 2) {
            $sql = 'SELECT COUNT(id) as cc FROM ' . $database['prefix'] . 'RemoteResponses WHERE';
            $sql .= ' url = \'' . POD::escapeString($url) . '\'';
            $sql .= ' AND isfiltered > 0';
            if ($row = POD::queryRow($sql)) {
                $count += @$row[0];
            }
        } else {
            // Comment Case
            $tableName = $database['prefix'] . 'Comments';
            $sql = 'SELECT COUNT(id) as cc FROM ' . $database['prefix'] . 'Comments WHERE';
            $sql .= ' comment = \'' . POD::escapeString($content) . '\'';
            $sql .= ' AND homepage = \'' . POD::escapeString($url) . '\'';
            $sql .= ' AND name = \'' . POD::escapeString($name) . '\'';
            $sql .= ' AND isfiltered > 0';
            if ($row = POD::queryRow($sql)) {
                $count += @$row[0];
            }
        }
        // Check IP
        $sql = 'SELECT COUNT(id) as cc FROM ' . $tableName . ' WHERE';
        $sql .= ' ip = \'' . POD::escapeString($_SERVER['REMOTE_ADDR']) . '\'';
        $sql .= ' AND isfiltered > 0';
        if ($row = POD::queryRow($sql)) {
            $count += @$row[0];
        }
        if ($count >= 10) {
            return false;
        }
        return true;
    }
    if (!is_null($rpc->fault)) {
        // EAS has some problem
        return true;
    }
    if ($rpc->result['result'] == true) {
        return false;
        // it's spam
    }
    return true;
}

function setSkinSettingForMigration($blogid, $name, $value, $mig = null)
{
    $pool = DBModel::getInstance();
    $name = POD::escapeString($name);
    $value = POD::escapeString($value);
    if ($mig === null) {
        $pool->reset("SkinSettingsMig");
    } else {
        $pool->reset("SkinSettings");
    }
    $pool->setAttribute("blogid", $blogid);
    $pool->setAttribute("name", $name, true);
    $pool->setAttribute("value", $value, true);
    return $pool->replace();
}

function login($loginid, $password, $expires = null)
{
    $ctx = Model_Context::getInstance();
    $loginid = POD::escapeString($loginid);
    $blogid = getBlogId();
    $userid = Auth::authenticate($blogid, $loginid, $password);
    if ($userid === false) {
        return false;
    }
    if (empty($_POST['save'])) {
        setcookie('TSSESSION_LOGINID', '', time() - 31536000, $ctx->getProperty('service.path') . '/', $ctx->getProperty('service.domain'));
    } else {
        setcookie('TSSESSION_LOGINID', $loginid, time() + 31536000, $ctx->getProperty('service.path') . '/', $ctx->getProperty('service.domain'));
    }
    if (in_array("group.writers", Acl::getCurrentPrivilege())) {
        Session::authorize($blogid, $userid, $expires);
    }
    return true;
}

 function __commit()
 {
     global $database;
     if (false == $this->usable) {
         return $this->usable;
     }
     if (false == is_array($this->configVal)) {
         return false;
     }
     $element = '';
     foreach ($this->configVal as $key => $value) {
         $element .= "<field name=\"{$key}\" type=\"text\" ><![CDATA[{$value}]]></field>";
     }
     $xml = '<?xml version="1.0" encoding="utf-8"?><config>' . $element . '</config>';
     $xml = POD::escapeString($xml);
     if (defined('__TISTORY__')) {
         expireGlobalDressing($this->blogid);
         DataCache::expireData('SkinCache', $this->blogid);
         globalCacheExpire($this->blogid);
     }
     return POD::query("REPLACE INTO {$database['prefix']}Plugins (blogid, name, settings) VALUES({$this->blogid},'{$this->pluginName}', '{$xml}')");
 }

 function modifyTagsWithEntryId($blogid, $entry, $taglist)
 {
     global $database;
     if (empty($taglist)) {
         $taglist = array();
     }
     $tmptaglist = array_filter($taglist, 'Tag_removeEmptyTagHelper');
     $taglist = array();
     foreach ($tmptaglist as $tag) {
         $tag = POD::escapeString(trim($tag));
         array_push($taglist, $tag);
     }
     // step 1. Get deleted Tag
     $tmpoldtaglist = POD::queryColumn("SELECT name FROM {$database['prefix']}Tags\n\t\t\tLEFT JOIN {$database['prefix']}TagRelations ON tag = id \n\t\t\tWHERE blogid = {$blogid} AND entry = {$entry}");
     if ($tmpoldtaglist === null) {
         $tmpoldtaglist = array();
     }
     $oldtaglist = array();
     foreach ($tmpoldtaglist as $tag) {
         $tag = POD::escapeString(Utils_Unicode::lessenAsEncoding(trim($tag), 255));
         array_push($oldtaglist, $tag);
     }
     $deletedTagList = array_diff($oldtaglist, $taglist);
     $insertedTagList = array_diff($taglist, $oldtaglist);
     // step 2. Insert Tag
     if (count($insertedTagList) > 0) {
         foreach ($insertedTagList as $tg) {
             if (!Tag::doesExist($tg)) {
                 @POD::execute("INSERT INTO {$database['prefix']}Tags (id, name) VALUES (" . (Tag::_getMaxId() + 1) . ",'" . $tg . "')");
             }
         }
         //			$tagliststr = '(\'' . implode('\') , (\'', $insertedTagList) . '\')';
         //			POD::execute("INSERT IGNORE INTO {$database['prefix']}Tags (name) VALUES $tagliststr ");
         // step 3. Insert Relation
         $tagliststr = '\'' . implode('\' , \'', $insertedTagList) . '\'';
         /*
         POD::execute("INSERT INTO {$database['prefix']}TagRelations
             (SELECT $blogid, t.id, $entry FROM {$database['prefix']}Tags as t
                 WHERE
                 name in ( $tagliststr ) AND
                 t.id NOT IN
                     ( SELECT tag FROM {$database['prefix']}TagRelations WHERE
                         (tag = t.id) AND (entry = $entry) AND (blogid = $blogid)
                     )
                 )");
         */
         // For MySQL 3, Simple Query Version
         $tagIDs = POD::queryColumn("SELECT id FROM {$database['prefix']}Tags WHERE name in ( {$tagliststr} )");
         $tagrelations = array();
         foreach ($tagIDs as $tagid) {
             array_push($tagrelations, " ({$blogid}, {$tagid}, {$entry}) ");
         }
         foreach ($tagrelations as $tr) {
             @POD::execute("INSERT INTO {$database['prefix']}TagRelations VALUES {$tr}");
         }
         //$tagRelationStr = implode(', ', $tagrelations);
         //POD::execute("INSERT IGNORE INTO {$database['prefix']}TagRelations VALUES $tagRelationStr");
     }
     // step 4. Delete Tag
     if (count($deletedTagList) > 0) {
         // small step, get tag id list
         $tagliststr = '\'' . implode('\' , \'', $deletedTagList) . '\'';
         $t1list = POD::queryColumn("SELECT id FROM {$database['prefix']}Tags WHERE name in ( {$tagliststr} )");
         if (is_null($t1list)) {
             return;
         }
         // What?
         // Flushing pageCache
         foreach ($t1list as $tagids) {
             CacheControl::flushTag($tagids);
         }
         // Make string
         $t1liststr = implode(', ', $t1list);
         $taglist = POD::queryColumn("SELECT tag FROM {$database['prefix']}TagRelations\n\t\t\t\t\t\tWHERE blogid = {$blogid} AND entry = {$entry} AND tag in ( {$t1liststr} )");
         if (is_null($taglist)) {
             return;
         }
         // What?
         // now delete tag
         $tagliststr = implode(', ', $taglist);
         // step 5. Delete Relation
         POD::execute("DELETE FROM {$database['prefix']}TagRelations WHERE blogid = {$blogid} AND entry = {$entry} AND tag in ( {$tagliststr} )");
         // step 6. Delete Tag
         $nottargets = POD::queryColumn("SELECT DISTINCT tag FROM {$database['prefix']}TagRelations WHERE tag in ( {$tagliststr} )");
         if (count($nottargets) > 0) {
             $nottargetstr = implode(', ', $nottargets);
             POD::execute("DELETE FROM {$database['prefix']}Tags WHERE id IN ( {$tagliststr} ) AND id NOT IN ( {$nottargetstr} )");
         } else {
             POD::execute("DELETE FROM {$database['prefix']}Tags WHERE id IN ( {$tagliststr} )");
         }
     }
 }

 static function add($email, $name)
 {
     global $database, $service, $user, $blog;
     if (empty($email)) {
         return 1;
     }
     if (!preg_match('/^[^@]+@([-a-zA-Z0-9]+\\.)+[-a-zA-Z0-9]+$/', $email)) {
         return 2;
     }
     if (strcmp($email, Utils_Unicode::lessenAsEncoding($email, 64)) != 0) {
         return 11;
     }
     $loginid = POD::escapeString(Utils_Unicode::lessenAsEncoding($email, 64));
     $name = POD::escapeString(Utils_Unicode::lessenAsEncoding($name, 32));
     $password = User::__generatePassword();
     $authtoken = md5(User::__generatePassword());
     if (POD::queryExistence("SELECT * FROM {$database['prefix']}Users WHERE loginid = '{$loginid}'")) {
         return 9;
         // User already exists.
     }
     if (POD::queryCell("SELECT COUNT(*) FROM {$database['prefix']}Users WHERE name = '{$name}'")) {
         $name = $name . '.' . time();
     }
     $result = POD::query("INSERT INTO {$database['prefix']}Users (userid, loginid, password, name, created, lastlogin, host) VALUES (" . (User::__getMaxUserId() + 1) . ", '{$loginid}', '" . md5($password) . "', '{$name}', UNIX_TIMESTAMP(), 0, " . getUserId() . ")");
     if (empty($result)) {
         return 11;
     }
     $result = POD::query("INSERT INTO {$database['prefix']}UserSettings (userid, name, value) VALUES ('" . User::getUserIdByEmail($loginid) . "', 'AuthToken', '{$authtoken}')");
     if (empty($result)) {
         return 11;
     }
     return true;
 }

function sendInvitationMail($blogid, $userid, $name, $comment, $senderName, $senderEmail)
{
    $ctx = Model_Context::getInstance();
    $pool = DBModel::getInstance();
    if (empty($blogid)) {
        $pool->reset('BlogSettings');
        $blogid = $pool->getCell('max(blogid)');
        // If no blogid, get the latest created blogid.
    }
    $email = User::getEmail($userid);
    $pool->reset('Users');
    $pool->setQualifier('userid', 'eq', $userid);
    $password = getCell('password');
    $authtoken = getAuthToken($userid);
    $blogName = getBlogName($blogid);
    if (empty($email)) {
        return 1;
    }
    if (!preg_match('/^[^@]+@([-a-zA-Z0-9]+\\.)+[-a-zA-Z0-9]+$/', $email)) {
        return 2;
    }
    if (empty($name)) {
        $name = User::getName($userid);
    }
    if (strcmp($email, Utils_Unicode::lessenAsEncoding($email, 64)) != 0) {
        return 11;
    }
    //$loginid = POD::escapeString(Utils_Unicode::lessenAsEncoding($email, 64));
    $name = POD::escapeString(Utils_Unicode::lessenAsEncoding($name, 32));
    //$headers = 'From: ' . encodeMail($senderName) . '<' . $senderEmail . ">\n" . 'X-Mailer: ' . TEXTCUBE_NAME . "\n" . "MIME-Version: 1.0\nContent-Type: text/html; charset=utf-8\n";
    if (empty($name)) {
        $subject = _textf('귀하를 %1님이 초대합니다', $senderName);
    } else {
        $subject = _textf('%1님을 %2님이 초대합니다', $name, $senderName);
    }
    $message = file_get_contents(ROOT . "/resources/style/letter/letter.html");
    $message = str_replace('[##_title_##]', _text('초대장'), $message);
    $message = str_replace('[##_content_##]', $comment, $message);
    $message = str_replace('[##_images_##]', $ctx->getProperty('uri.service') . "/resources/style/letter", $message);
    $message = str_replace('[##_link_##]', getInvitationLink(getBlogURL($blogName), $email, $password, $authtoken), $message);
    $message = str_replace('[##_go_blog_##]', getBlogURL($blogName), $message);
    $message = str_replace('[##_link_title_##]', _text('블로그 바로가기'), $message);
    if (empty($name)) {
        $message = str_replace('[##_to_##]', '', $message);
    } else {
        $message = str_replace('[##_to_##]', _text('받는 사람') . ': ' . $name, $message);
    }
    $message = str_replace('[##_sender_##]', _text('보내는 사람') . ': ' . $senderName, $message);
    $ret = sendEmail($senderName, $senderEmail, $name, $email, $subject, $message);
    if ($ret !== true) {
        return array(14, $ret[1]);
    }
    return true;
}

 function getId($name)
 {
     global $database;
     if (empty($name)) {
         return null;
     }
     return POD::queryCell("SELECT id FROM {$database['prefix']}LinkCategories WHERE blogid = " . getBlogId() . " AND name = '" . POD::escapeString($name) . "'");
 }