PHP S::sqlEscape方法代码示例

 /**
  * 根据公司名称获取公司ID
  * @param string $companyName
  * @return array
  */
 function getCompanyIdByName($companyName)
 {
     if (!$companyName) {
         return array();
     }
     return $this->_db->get_value("SELECT companyid FROM  {$this->_tableName} WHERE companyname = " . S::sqlEscape($companyName) . "");
 }

function vote($readvote)
{
    global $db, $votetype, $ifview, $votedb, $votesum, $action, $viewvoter, $tid, $admincheck, $vote_close;
    $votearray = unserialize($readvote['voteopts']);
    $votetype = $readvote['mostvotes'] > 1 ? 'checkbox' : 'radio';
    $votesum = 0;
    $votedb = $voter = array();
    $ifview = $viewvoter == 'yes' ? 'no' : 'yes';
    foreach ($votearray as $option) {
        $votesum += $option[1];
    }
    if ($viewvoter == 'yes') {
        $query = $db->query("SELECT username,vote FROM pw_voter WHERE tid=" . S::sqlEscape($tid) . " LIMIT 500");
        while ($rt = $db->fetch_array($query)) {
            $voter[$rt['vote']][] = $rt[username];
        }
    }
    foreach ($votearray as $key => $value) {
        $vote = array();
        $vote['percent'] = $votesum ? round(100 * $value[1] / $votesum, 2) : 0;
        if ($readvote['previewable'] == 0 || $readvote['havevote'] || $vote_close) {
            $vote['width'] = floor(500 * $value[1] / ($votesum + 1));
            $vote['num'] = $value[1];
        } else {
            $vote['width'] = 0;
            $vote['num'] = '*';
        }
        $vote['name'] = $value[0];
        $vote['voter'] = $voter[$key];
        $votedb[$key] = $vote;
    }
}

 /**
  * 获得最新公告
  * @param int $num
  */
 function getNewData($num)
 {
     global $timestamp;
     $num = (int) $num;
     $query = $this->_db->query("SELECT * FROM {$this->_tableName} WHERE ifopen = '1' AND \n\t\t\tstartdate <= " . S::sqlEscape($timestamp) . " AND enddate=0 OR enddate>" . S::sqlEscape($timestamp) . " ORDER BY aid DESC LIMIT 0,{$num}");
     return $this->_getAllResultFromQuery($query);
 }

 function _getSearchSQL($array)
 {
     if ($array['username']) {
         return ' AND username=' . S::sqlEscape($array['username']);
     }
     return ' ';
 }

 function update($uploaddb)
 {
     $fieldService = L::loadClass('ActivityField', 'activity');
     if ($this->tid) {
         $defaultAttach = $userAttach = array();
         foreach ($uploaddb as $key => $value) {
             if ($value['id']) {
                 $attach = array();
                 $attach = $fieldService->getField($value['id']);
                 $this->attachs[$attach['fieldname']] = $value['fileuploadurl'];
                 if ($attach['fieldname'] && $attach['ifdel'] == 1) {
                     $userAttach[$attach['fieldname']] = $value['fileuploadurl'];
                 } elseif ($attach['fieldname'] && !$attach['ifdel']) {
                     $defaultAttach[$attach['fieldname']] = $value['fileuploadurl'];
                 }
             }
         }
         $defaultValueTableName = getActivityValueTableNameByActmid();
         $userDefinedValueTableName = getActivityValueTableNameByActmid($this->actmid, 1, 1);
         if ($defaultAttach) {
             $this->db->update("UPDATE {$defaultValueTableName} SET " . S::sqlSingle($defaultAttach) . " WHERE tid=" . S::sqlEscape($this->tid));
         }
         if ($userAttach) {
             $this->db->update("UPDATE {$userDefinedValueTableName} SET " . S::sqlSingle($userAttach) . " WHERE tid=" . S::sqlEscape($this->tid));
         }
     } else {
         foreach ($uploaddb as $key => $value) {
             $this->attachs['fileuploadurl'] = $value['fileuploadurl'];
         }
     }
     return true;
 }

 function syncredit($arr)
 {
     if (is_array($arr)) {
         foreach ($arr as $uid => $setv) {
             $updateMemberData = array();
             foreach ($setv as $cid => $value) {
                 if (is_numeric($cid)) {
                     $value = intval($value);
                     /**
                     						$this->db->pw_update(
                     							"SELECT uid FROM pw_membercredit WHERE uid=" . S::sqlEscape($uid) . ' AND cid=' . S::sqlEscape($cid),
                     							"UPDATE pw_membercredit SET value=" . S::sqlEscape($value) .  ' WHERE uid=' . S::sqlEscape($uid) . ' AND cid=' . S::sqlEscape($cid),
                     							"INSERT INTO pw_membercredit SET " . S::sqlSingle(array('uid' => $uid, 'cid' => $cid, 'value' => $value))
                     						);
                     						**/
                     $this->db->pw_update("SELECT uid FROM pw_membercredit WHERE uid=" . S::sqlEscape($uid) . ' AND cid=' . S::sqlEscape($cid), pwQuery::updateClause('pw_membercredit', 'uid=:uid AND cid=:cid', array($uid, $cid), array('value' => $value)), pwQuery::insertClause('pw_membercredit', array('uid' => $uid, 'cid' => $cid, 'value' => $value)));
                 } elseif (in_array($cid, array('money', 'rvrc', 'credit', 'currency'))) {
                     $cid == 'rvrc' && ($value *= 10);
                     $updateMemberData[$cid] = intval($value);
                 }
             }
             if ($updateMemberData) {
                 $userService = L::loadClass('UserService', 'user');
                 /* @var $userService PW_UserService */
                 $userService->update($uid, array(), $updateMemberData);
             }
         }
     }
     return new ApiResponse(1);
 }

 function update($uploaddb)
 {
     global $windid, $winduid, $timestamp, $pintro;
     foreach ($uploaddb as $key => $value) {
         $this->attachs[] = array('aid' => $this->aid, 'pintro' => $pintro[$value['id']] ? $pintro[$value['id']] : substr($value['name'], 0, strrpos($value['name'], '.')), 'path' => $value['fileuploadurl'], 'uploader' => $windid, 'uptime' => $timestamp, 'ifthumb' => $value['ifthumb']);
     }
     if ($this->attachs) {
         $this->db->update("INSERT INTO pw_cnphoto (aid,pintro,path,uploader,uptime,ifthumb) VALUES " . S::sqlMulti($this->attachs));
         $this->pid = $this->db->insert_id();
         $cnalbum = $this->db->get_one("SELECT * FROM pw_cnalbum WHERE aid=" . S::sqlEscape($this->aid));
         if ($this->atype) {
             if (!$cnalbum['private']) {
                 updateDatanalyse($this->pid, 'groupPicNew', $timestamp);
             }
         } else {
             $statistics = L::loadClass('Statistics', 'datanalyse');
             $statistics->photouser($winduid, count($this->attachs));
         }
         if (isset($cnalbum['lastphoto']) && !$cnalbum['lastphoto']) {
             $lastphoto = $this->getLastPhotoThumb();
             $lastphotosqlAdd = ",lastphoto= " . S::sqlEscape($lastphoto);
         }
         $this->db->update("UPDATE pw_cnalbum SET photonum=photonum+" . S::sqlEscape(count($this->attachs)) . ",lasttime=" . S::sqlEscape($timestamp) . $lastphotosqlAdd . " WHERE aid=" . S::sqlEscape($this->aid));
     }
     return true;
 }

function isFriend($uid, $friend)
{
    global $db;
    if ($db->get_value("SELECT uid FROM pw_friends WHERE uid=" . S::sqlEscape($uid) . ' AND friendid=' . S::sqlEscape($friend) . " AND status='0'")) {
        return true;
    }
    return false;
}

 function update($uploaddb)
 {
     $attaches = array();
     foreach ($uploaddb as $v) {
         $attaches['attach' . $v['id']] = $v['fileuploadurl'];
     }
     $attaches && $this->db->pw_update("SELECT * FROM pw_auth_certificate WHERE uid=" . S::sqlEscape($this->uid), "UPDATE pw_auth_certificate SET " . S::sqlSingle($attaches) . ' WHERE uid=' . $this->uid, "INSERT INTO pw_auth_certificate SET " . S::sqlSingle($attaches) . ',state=0,uid=' . $this->uid);
 }

 function getUserGroups($type)
 {
     if (!$type) {
         return false;
     }
     $query = $this->_db->query("SELECT gid FROM {$this->_tableName} WHERE gptype=" . S::sqlEscape($type));
     return array_keys($this->_getAllResultFromQuery($query, 'gid'));
 }

 function updataById($tplid, $array)
 {
     $array = $this->_checkData($array);
     if (!$array) {
         return null;
     }
     $this->_db->update("UPDATE " . $this->_tableName . " SET " . S::sqlSingle($array, false) . " WHERE tplid=" . S::sqlEscape($tplid));
 }

 function getByIdentify($identify)
 {
     $temp = $this->_db->get_one("SELECT * FROM " . $this->_tableName . " WHERE identify=" . S::sqlEscape($identify));
     if (!$temp) {
         return array();
     }
     return $this->_unserializeData($temp);
 }

 /**
  * 根据公司ID获取用户id
  * @param int companyId
  * @return array
  */
 function getUserIdsByCompanyId($companyId)
 {
     if (!$companyId) {
         return array();
     }
     $query = $this->_db->query("SELECT uid FROM  {$this->_tableName} WHERE companyid = " . S::sqlEscape($companyId) . "");
     return $this->_getAllResultFromQuery($query, 'uid');
 }

 /**
  * 根据分类stid查name
  * 
  * @param stid 分类id
  * @return array 查询结果数组
  */
 function getTypesByStid($stid)
 {
     $stid = intval($stid);
     if (!$stid) {
         return null;
     }
     return $this->_db->get_one('SELECT name FROM ' . $this->_tableName . ' WHERE ifable <> 0 AND stid= ' . S::sqlEscape($stid));
 }

 function getGroupcateCreditset($type)
 {
     $creditset = $this->db->get_value("SELECT creditset FROM pw_cnclass WHERE fid=" . S::sqlEscape($this->classid));
     $creditset = unserialize($creditset);
     $creditset = array_filter($creditset[$type], "group_filter");
     $creditset = is_array($creditset) ? $creditset : array();
     return $creditset;
 }