PHP driver_interface::sql_escape方法代码示例

    /**
     * Display the options a user can configure for this extension
     *
     * @return null
     * @access public
     */
    public function display_options()
    {
        add_form_key('acp_donation');
        // Is the form being submitted to us?
        if ($this->request->is_set_post('submit')) {
            if (!check_form_key('acp_donation')) {
                $error[] = 'FORM_INVALID';
            }
            $donation_row = array('donation_body' => $this->request->variable('donation_body', '', true), 'donation_cancel' => $this->request->variable('donation_cancel', '', true), 'donation_success' => $this->request->variable('donation_success', '', true));
            foreach ($donation_row as $this->config_name => $this->config_value) {
                $sql = 'UPDATE ' . $this->donation_table . "\n\t\t\t\t\tSET config_value = '" . $this->db->sql_escape($this->config_value) . "'\n\t\t\t\t\tWHERE config_name = '" . $this->db->sql_escape($this->config_name) . "'";
                $this->db->sql_query($sql);
            }
            // Set the options the user configured
            $this->set_options();
            // Add option settings change action to the admin log
            $this->phpbb_log->add('admin', $this->user->data['user_id'], $this->user->ip, 'DONATION_SAVED');
            trigger_error($this->user->lang['DONATION_SAVED'] . adm_back_link($this->u_action));
        }
        // let's get it on
        $sql = 'SELECT *
		FROM ' . $this->donation_table;
        $result = $this->db->sql_query($sql);
        $donation = array();
        while ($row = $this->db->sql_fetchrow($result)) {
            $donation[$row['config_name']] = $row['config_value'];
        }
        $this->db->sql_freeresult($result);
        $donation_body = isset($donation['donation_body']) ? $donation['donation_body'] : '';
        $donation_cancel = isset($donation['donation_cancel']) ? $donation['donation_cancel'] : '';
        $donation_success = isset($donation['donation_success']) ? $donation['donation_success'] : '';
        $donation_version = isset($this->config['donation_version']) ? $this->config['donation_version'] : '';
        $this->template->assign_vars(array('DONATION_VERSION' => $donation_version, 'DONATION_ENABLE' => $this->config['donation_enable'], 'DONATION_INDEX_ENABLE' => $this->config['donation_index_enable'], 'DONATION_INDEX_TOP' => $this->config['donation_index_top'], 'DONATION_INDEX_BOTTOM' => $this->config['donation_index_bottom'], 'DONATION_EMAIL' => $this->config['donation_email'], 'DONATION_ACHIEVEMENT_ENABLE' => $this->config['donation_achievement_enable'], 'DONATION_ACHIEVEMENT' => $this->config['donation_achievement'], 'DONATION_GOAL_ENABLE' => $this->config['donation_goal_enable'], 'DONATION_GOAL' => $this->config['donation_goal'], 'DONATION_GOAL_CURRENCY_ENABLE' => $this->config['donation_goal_currency_enable'], 'DONATION_GOAL_CURRENCY' => $this->config['donation_goal_currency'], 'DONATION_BODY' => $donation_body, 'DONATION_CANCEL' => $donation_cancel, 'DONATION_SUCCESS' => $donation_success, 'U_ACTION' => $this->u_action));
    }

 /**
  * {@inheritdoc}
  */
 public function get_group_rules($type = '')
 {
     $sql_array = array('SELECT' => 'agr.*, agt.autogroups_type_name', 'FROM' => array($this->autogroups_rules_table => 'agr', $this->autogroups_types_table => 'agt'), 'WHERE' => 'agr.autogroups_type_id = agt.autogroups_type_id' . ($type ? " AND agt.autogroups_type_name = '" . $this->db->sql_escape($type) . "'" : ''));
     $sql = $this->db->sql_build_query('SELECT', $sql_array);
     $result = $this->db->sql_query($sql, 7200);
     $rows = $this->db->sql_fetchrowset($result);
     $this->db->sql_freeresult($result);
     return $rows;
 }

    /**
     * Update the users session in the table.
     */
    public function update_session()
    {
        if ($this->user->data['user_id'] != ANONYMOUS) {
            $wwh_data = array('user_id' => $this->user->data['user_id'], 'user_ip' => $this->user->ip, 'username' => $this->user->data['username'], 'username_clean' => $this->user->data['username_clean'], 'user_colour' => $this->user->data['user_colour'], 'user_type' => $this->user->data['user_type'], 'viewonline' => $this->user->data['session_viewonline'], 'wwh_lastpage' => time());
            $this->db->sql_return_on_error(true);
            $sql = 'UPDATE ' . WWH_TABLE . ' 
				SET ' . $this->db->sql_build_array('UPDATE', $wwh_data) . '
				WHERE user_id = ' . (int) $this->user->data['user_id'] . "\n\t\t\t\t\tOR (user_ip = '" . $this->db->sql_escape($this->user->ip) . "'\n\t\t\t\t\t\tAND user_id = " . ANONYMOUS . ')';
            $result = $this->db->sql_query($sql);
            $this->db->sql_return_on_error(false);
            if ((bool) $result === false) {
                // database does not exist yet...
                return;
            }
            $sql_affectedrows = (int) $this->db->sql_affectedrows();
            if ($sql_affectedrows != 1) {
                if ($sql_affectedrows > 1) {
                    // Found multiple matches, so we delete them and just add one
                    $sql = 'DELETE FROM ' . WWH_TABLE . '
						WHERE user_id = ' . (int) $this->user->data['user_id'] . "\n\t\t\t\t\t\t\tOR (user_ip = '" . $this->db->sql_escape($this->user->ip) . "'\n\t\t\t\t\t\t\t\tAND user_id = " . ANONYMOUS . ')';
                    $this->db->sql_query($sql);
                    $this->db->sql_query('INSERT INTO ' . WWH_TABLE . ' ' . $this->db->sql_build_array('INSERT', $wwh_data));
                }
                if ($sql_affectedrows == 0) {
                    // No entry updated. Either the user is not listed yet, or has opened two links in the same time
                    $sql = 'SELECT 1 as found
						FROM ' . WWH_TABLE . '
						WHERE user_id = ' . (int) $this->user->data['user_id'] . "\n\t\t\t\t\t\t\tOR (user_ip = '" . $this->db->sql_escape($this->user->ip) . "'\n\t\t\t\t\t\t\t\tAND user_id = " . ANONYMOUS . ')';
                    $result = $this->db->sql_query($sql);
                    $found = (int) $this->db->sql_fetchfield('found');
                    $this->db->sql_freeresult($result);
                    if (!$found) {
                        // He wasn't listed.
                        $this->db->sql_query('INSERT INTO ' . WWH_TABLE . ' ' . $this->db->sql_build_array('INSERT', $wwh_data));
                    }
                }
            }
        } else {
            $this->db->sql_return_on_error(true);
            $sql = 'SELECT user_id
				FROM ' . WWH_TABLE . "\n\t\t\t\tWHERE user_ip = '" . $this->db->sql_escape($this->user->ip) . "'";
            $result = $this->db->sql_query_limit($sql, 1);
            $this->db->sql_return_on_error(false);
            if ((bool) $result === false) {
                // database does not exist yet...
                return;
            }
            $user_logged = (int) $this->db->sql_fetchfield('user_id');
            $this->db->sql_freeresult($result);
            if (!$user_logged) {
                $wwh_data = array('user_id' => $this->user->data['user_id'], 'user_ip' => $this->user->ip, 'username' => $this->user->data['username'], 'username_clean' => $this->user->data['username_clean'], 'user_colour' => $this->user->data['user_colour'], 'user_type' => $this->user->data['user_type'], 'viewonline' => 1, 'wwh_lastpage' => time());
                $this->db->sql_query('INSERT INTO ' . WWH_TABLE . ' ' . $this->db->sql_build_array('INSERT', $wwh_data));
            }
        }
        $this->db->sql_return_on_error(false);
    }

    /**
     * Check if the provided user has a specific key in the table provided
     *
     * @param string $table   Table to check in
     * @param int    $user_id The specific user
     * @param string $where	  Extra where clause. Be sure to include AND
     *
     * @return bool
     */
    protected function check_table_for_user($table, $user_id, $where = '')
    {
        $sql = 'SELECT COUNT(registration_id) as reg_id 
			FROM ' . $this->db->sql_escape($table) . '
			WHERE user_id = ' . (int) $user_id . ' ' . $where;
        $result = $this->db->sql_query($sql);
        $row = $this->db->sql_fetchrow($result);
        $this->db->sql_freeresult($result);
        return $row && $row['reg_id'] > 0;
    }

    public function edit_user_ranks()
    {
        $this->template->assign_vars(array('U_ACTION' => $this->u_action, 'S_FIND_USER' => true, 'U_FIND_USERNAME' => append_sid("{$this->root_path}memberlist.{$this->php_ext}", 'mode=searchuser&form=select_user&field=username&select_single=true')));
        $submit = isset($_POST['submit-user']) ? true : false;
        if ($submit) {
            $username = utf8_normalize_nfc(request_var('username', '', true));
            $user_sql = 'SELECT *
				FROM ' . USERS_TABLE . "\n\t\t\t\tWHERE username_clean = '" . $this->db->sql_escape(utf8_clean_string($username)) . "'";
            $user_result = $this->db->sql_query($user_sql);
            $user_row = $this->db->sql_fetchrow($user_result);
            $user_id = (int) $user_row['user_id'];
            $this->db->sql_freeresult($user_result);
            if (!$user_id) {
                trigger_error($this->user->lang['NO_USER'] . adm_back_link($this->u_action), E_USER_WARNING);
            }
            $rank_sql = 'SELECT *
					FROM ' . RANKS_TABLE . '
					WHERE rank_special = 1
					ORDER BY rank_title';
            $rank_result = $this->db->sql_query($rank_sql);
            $s_rank_one_options = '<option value="0"' . (!$user_row['user_rank'] ? ' selected="selected"' : '') . '>' . $this->user->lang['ACP_NO_SPEC_RANK'] . '</option>';
            $s_rank_two_options = '<option value="0"' . (!$user_row['user_rank_two'] ? ' selected="selected"' : '') . '>' . $this->user->lang['ACP_NO_SPEC_RANK'] . '</option>';
            $s_rank_three_options = '<option value="0"' . (!$user_row['user_rank_three'] ? ' selected="selected"' : '') . '>' . $this->user->lang['ACP_NO_SPEC_RANK'] . '</option>';
            while ($row = $this->db->sql_fetchrow($rank_result)) {
                $selected1 = $user_row['user_rank'] && $row['rank_id'] == $user_row['user_rank'] ? ' selected="selected"' : '';
                $s_rank_one_options .= '<option value="' . $row['rank_id'] . '"' . $selected1 . '>' . $row['rank_title'] . '</option>';
                $selected2 = $user_row['user_rank_two'] && $row['rank_id'] == $user_row['user_rank_two'] ? ' selected="selected"' : '';
                $s_rank_two_options .= '<option value="' . $row['rank_id'] . '"' . $selected2 . '>' . $row['rank_title'] . '</option>';
                $selected3 = $user_row['user_rank_three'] && $row['rank_id'] == $user_row['user_rank_three'] ? ' selected="selected"' : '';
                $s_rank_three_options .= '<option value="' . $row['rank_id'] . '"' . $selected3 . '>' . $row['rank_title'] . '</option>';
            }
            $this->db->sql_freeresult($result);
            $this->template->assign_vars(array('ACP_MR_USER' => sprintf($this->user->lang['ACP_EDIT_USER_RANK'], $user_row['username']), 'S_EDIT_RANKS' => true, 'S_FIND_USER' => false, 'S_RANK_ONE_OPTIONS' => $s_rank_one_options, 'S_RANK_TWO_OPTIONS' => $s_rank_two_options, 'S_RANK_THREE_OPTIONS' => $s_rank_three_options, 'HIDDEN_RANK_USER_ID' => $user_id));
        }
        add_form_key('submit-rank-key');
        $upd_rank = isset($_POST['submit-rank']) ? true : false;
        if ($upd_rank) {
            if (check_form_key('submit-rank-key')) {
                $rank_one = request_var('user_rank_one', 0);
                $rank_two = request_var('user_rank_two', 0);
                $rank_thr = request_var('user_rank_three', 0);
                $upd_user_id = request_var('hidden_user_id', 0);
                $upd_sql = 'UPDATE ' . USERS_TABLE . '
							SET user_rank = ' . $rank_one . ',
								user_rank_two = ' . $rank_two . ',
								user_rank_three = ' . $rank_thr . '
							WHERE user_id = ' . $upd_user_id;
                $this->db->sql_query($upd_sql);
                trigger_error($this->user->lang('ACP_MR_SAVED') . adm_back_link($this->u_action));
            }
        }
    }

 /**
  * {@inheritdoc}
  */
 public function set_user_categories($forum_id)
 {
     // Set the collapsed category data array
     $this->set_collapsed_categories($forum_id);
     // Update the db with json encoded array of collapsed category data
     if ($this->user->data['is_registered']) {
         $sql = 'UPDATE ' . USERS_TABLE . "\n\t\t\t\tSET collapsible_categories = '" . $this->db->sql_escape(json_encode($this->collapsed_categories)) . "'\n\t\t\t\tWHERE user_id = " . (int) $this->user->data['user_id'];
         $this->db->sql_query($sql);
         // There was an error updating the user's data
         if (!$this->db->sql_affectedrows()) {
             return false;
         }
     }
     // Set a cookie with the collapsed category data and return true
     return $this->set_cookie_categories($forum_id);
 }

    /**
     * Set anchor
     *
     * @param string $anchor Anchor text
     * @return rule_interface $this object for chaining calls; load()->set()->save()
     * @access public
     * @throws \phpbb\boardrules\exception\unexpected_value
     */
    public function set_anchor($anchor)
    {
        // Enforce a string
        $anchor = (string) $anchor;
        // Anchor should not contain any special characters
        if ($anchor != '' && !preg_match('/^[^!"#$%&*\'()+,.\\/\\\\:;<=>?@\\[\\]^`{|}~ ]*$/i', $anchor)) {
            throw new \phpbb\boardrules\exception\unexpected_value(array('anchor', 'ILLEGAL_CHARACTERS'));
        }
        // We limit the anchor length to 255 characters
        if (truncate_string($anchor, 255) != $anchor) {
            throw new \phpbb\boardrules\exception\unexpected_value(array('anchor', 'TOO_LONG'));
        }
        // Make sure rule anchors are unique
        // Test if new page and anchor field has data or...
        //    if existing page and anchor field has new data not equal to existing anchor data
        if (!$this->get_id() && $anchor !== '' || $this->get_id() && $anchor !== '' && $this->get_anchor() !== $anchor) {
            $sql = 'SELECT 1
				FROM ' . $this->boardrules_table . "\n\t\t\t\tWHERE rule_anchor = '" . $this->db->sql_escape($anchor) . "'\n\t\t\t\t\tAND rule_id <> " . $this->get_id();
            $result = $this->db->sql_query_limit($sql, 1);
            $row = $this->db->sql_fetchrow($result);
            $this->db->sql_freeresult($result);
            if ($row) {
                throw new \phpbb\boardrules\exception\unexpected_value(array('anchor', 'NOT_UNIQUE'));
            }
        }
        // Set the anchor on our data array
        $this->data['rule_anchor'] = $anchor;
        return $this;
    }

 /**
  * Perform table SQL query and return any messages
  *
  * @param string $query	should either be OPTIMIZE TABLE, REPAIR TABLE, or CHECK TABLE
  * @param string $tables comma delineated string of all tables to be processed
  * @param int $disable_board the users option to disable the board during run time
  * @return string $message any errors or status information
  * @access protected
  */
 protected function table_maintenance($query, $tables, $disable_board = 0)
 {
     // Disable the board if admin selected this option
     if ($disable_board) {
         $this->config->set('board_disable', 1);
     }
     $message = '';
     $result = $this->db->sql_query($query . ' ' . $this->db->sql_escape($tables));
     while ($row = $this->db->sql_fetchrow($result)) {
         // Build a message only for optimize/repair errors, or if check table is run
         if (in_array(strtolower($row['Msg_type']), array('error', 'info', 'note', 'warning')) || $query == 'CHECK TABLE') {
             $message .= '<br />' . substr($row['Table'], strpos($row['Table'], '.') + 1) . ' ... ' . $row['Msg_type'] . ': ' . $row['Msg_text'];
         }
     }
     $this->db->sql_freeresult($result);
     // Enable the board again if admin selected this option
     if ($disable_board) {
         $this->config->set('board_disable', 0);
     }
     // Clear cache to ensure board is re-enabled for all users
     $this->cache->purge();
     // Let's add an extra line break if there are messages, it looks better
     $message = !empty($message) ? '<br />' . $message : '';
     return $message;
 }

    /**
     * Checks to see if we can use this username for a merge, based on a few factors.
     *
     * @param string $username - The username to check
     * @param array &$errors - Errors array to work with
     * @return mixed - Return the user's ID (integer) if valid, return void if there was an error
     */
    private function check_user($username, &$errors, $old_user)
    {
        // Grabbeth the old user's ID
        if (!empty($username)) {
            $sql = 'SELECT user_id, user_type
				FROM ' . USERS_TABLE . "\n\t\t\t\tWHERE username_clean = '" . $this->db->sql_escape(utf8_clean_string($username)) . "'";
            $result = $this->db->sql_query($sql);
            $user_id = (int) $this->db->sql_fetchfield('user_id');
            $user_type = (int) $this->db->sql_fetchfield('user_type');
            $this->db->sql_freeresult($result);
            // No such user.  o_0
            if (!$user_id) {
                $errors[] = $this->user->lang['NO_USER'];
                return;
            }
        } else {
            $errors[] = $this->user->lang['NO_USER_SPECIFIED'];
            return;
        }
        // Check to see if it is ourselves here
        if ($user_id === (int) $this->user->data['user_id'] && $old_user) {
            $errors[] = $this->user->lang['CANNOT_MERGE_SELF'];
            return;
        }
        // Make sure we aren't messing with a founder
        if ($user_type === USER_FOUNDER && $old_user && $this->user->data['user_type'] !== USER_FOUNDER) {
            $errors[] = $this->user->lang['CANNOT_MERGE_FOUNDER'];
            return;
        }
        return $user_id;
    }

    /**
     * {@inheritdoc}
     */
    protected function save_record(array $record)
    {
        $columns = $this->get_columns();
        $sql = 'UPDATE ' . $this->get_table_name() . '
			SET ' . $columns['text'] . " = '" . $this->db->sql_escape($record['text']) . "'\n\t\t\tWHERE " . $columns['id'] . ' = ' . $record['id'];
        $this->db->sql_query($sql);
    }

    /**
     * Get a list of all users on the board that can be mentioned. Keys are the usernames utf8_cleaned.
     * Data is cached after the first call.
     * 
     * @param string|bool $query_string False, if all users should be retrieved. Otherwise a string wich should be searched for.
     * @return array Array containing data of all users
     */
    public function get_userlist($query_string = false)
    {
        // If we need the complete list and it is cached, we can return it.
        if ($query_string == false && self::$user_list) {
            return self::$user_list;
        }
        $cache_time = 300;
        $sql_ary = array('SELECT' => '*', 'FROM' => array(USERS_TABLE => 'u'), 'WHERE' => 'user_posts >= ' . $this->config['wolfsblvt.mentions.min_posts_suggest'] . '
											AND user_type <> ' . USER_IGNORE, 'ORDER_BY' => 'username');
        if ($query_string) {
            $escaped_query_string_clean = $this->db->sql_escape(utf8_clean_string($query_string));
            $query_string['WHERE'] .= ' username_clean ' . $this->db->sql_like_expression($escaped_query_string_clean . $this->db->get_any_char());
        }
        $sql = $this->db->sql_build_query('SELECT', $sql_ary);
        $result = $this->db->sql_query($sql, $cache_time);
        $user_list = array();
        while ($row = $this->db->sql_fetchrow($result)) {
            $user_data = array('name' => $row['username'], 'user_id' => $row['user_id'], 'posts' => $row['user_posts'], 'colour' => $row['user_colour'], 'avatar' => phpbb_get_user_avatar($row), 'username_full' => get_username_string('full', $row['user_id'], $row['username'], $row['user_colour']), 'username_no_profile' => get_username_string('no_profile', $row['user_id'], $row['username'], $row['user_colour']));
            if ($user_data['avatar'] == '') {
                $default_avatar_url = $this->path_helper->get_web_root_path() . $this->ext_root_path . '/styles/' . $this->user->style['style_path'] . '/theme' . '/images/no_avatar.gif';
                // Check if file exists, otherwise take from "/all" folder. The administrator hasn't chosen a specific no_avatar avatar for this style then
                if (!file_exists($default_avatar_url)) {
                    $default_avatar_url = $this->path_helper->get_web_root_path() . $this->ext_root_path . '/styles/all/theme' . '/images/no_avatar.gif';
                }
                $user_data['avatar'] = '<img src="' . $default_avatar_url . '" width="100" height="100" alt="' . $this->user->lang['USER_AVATAR'] . '">';
            }
            $user_list[$row['username_clean']] = $user_data;
        }
        $this->db->sql_freeresult($result);
        // If we have the complete list, we can cache it.
        if ($query_string == false) {
            self::$user_list = $user_list;
        }
        return $user_list;
    }

    /**
     * Uninstall style
     *
     * @param array $style Style data
     * @return bool|string True on success, error message on error
     */
    protected function uninstall_style($style)
    {
        $id = $style['style_id'];
        $path = $style['style_path'];
        // Check if style has child styles
        $sql = 'SELECT style_id
			FROM ' . STYLES_TABLE . '
			WHERE style_parent_id = ' . (int) $id . " OR style_parent_tree = '" . $this->db->sql_escape($path) . "'";
        $result = $this->db->sql_query($sql);
        $conflict = $this->db->sql_fetchrow($result);
        $this->db->sql_freeresult($result);
        if ($conflict !== false) {
            return sprintf($this->user->lang['STYLE_UNINSTALL_DEPENDENT'], $style['style_name']);
        }
        // Change default style for users
        $sql = 'UPDATE ' . USERS_TABLE . '
			SET user_style = 0
			WHERE user_style = ' . $id;
        $this->db->sql_query($sql);
        // Uninstall style
        $sql = 'DELETE FROM ' . STYLES_TABLE . '
			WHERE style_id = ' . $id;
        $this->db->sql_query($sql);
        return true;
    }

	/**
	* Enable all notifications of a certain type
	*
	* This should be called when an extension which has notification types
	* that was disabled is re-enabled so that all those notifications that
	* were hidden are shown again
	*
	* @param string $notification_type_name Type identifier of the subscription
	*/
	public function enable_notifications($notification_type_name)
	{
		$sql = 'UPDATE ' . $this->notification_types_table . "
			SET notification_type_enabled = 1
			WHERE notification_type_name = '" . $this->db->sql_escape($notification_type_name) . "'";
		$this->db->sql_query($sql);
	}

 /**
  * Callback function for language replacing
  *
  * @param array	$matches
  * @return string
  */
 public function lang_replace_callback($matches)
 {
     if (!empty($matches[1])) {
         return $this->db->sql_escape($this->language->lang($matches[1]));
     }
     return '';
 }

    /**
     * Get basic data of all parent items
     *
     * Basic data is defined in the $item_basic_data property.
     * Data is cached in the item_parents column in the item table
     *
     * @param array	$item		The item to get the path from
     * @return array			Array of items (containing basic columns from the item table)
     *							ID => Item data
     */
    public function get_path_basic_data(array $item)
    {
        $parents = array();
        if ($item[$this->column_parent_id]) {
            if (!$item[$this->column_item_parents]) {
                $sql = 'SELECT ' . implode(', ', $this->item_basic_data) . '
					FROM ' . $this->table_name . '
					WHERE ' . $this->column_left_id . ' < ' . (int) $item[$this->column_left_id] . '
						AND ' . $this->column_right_id . ' > ' . (int) $item[$this->column_right_id] . '
						' . $this->get_sql_where('AND') . '
					ORDER BY ' . $this->column_left_id . ' ASC';
                $result = $this->db->sql_query($sql);
                while ($row = $this->db->sql_fetchrow($result)) {
                    $parents[$row[$this->column_item_id]] = $row;
                }
                $this->db->sql_freeresult($result);
                $item_parents = serialize($parents);
                $sql = 'UPDATE ' . $this->table_name . '
					SET ' . $this->column_item_parents . " = '" . $this->db->sql_escape($item_parents) . "'\n\t\t\t\t\tWHERE " . $this->column_parent_id . ' = ' . (int) $item[$this->column_parent_id];
                $this->db->sql_query($sql);
            } else {
                $parents = unserialize($item[$this->column_item_parents]);
            }
        }
        return $parents;
    }