PHP Filter::cleanSqlFieldNames方法代碼示例

 /**
  * Constructor
  *
  * @param array $args
  * @return void
  */
 function GetMail($args = array())
 {
     global $domains;
     $this->mailer = null;
     foreach ($args as $k => $v) {
         $this->{$k} = $v;
     }
     $this->init_sql($args['Username']);
     $this->Account = "{$this->Username}@{$this->Pop3host}";
     // See if the user has defined another MailServer to connect and access the MailAuth type
     $UserSettings = Filter::cleanSqlFieldNames($this->sql->UserSettings);
     $query = "select MailServer, MailAuth, DateFormat, TimeFormat, Language, TimeZone, UseSSL from {$UserSettings} where Account=?";
     list($this->MailServer, $this->MailAuth, $this->DateFormat, $this->TimeFormat, $this->Language, $this->TimeZone, $this->UseSSL) = $this->sql->sqlarray($query, $this->Account);
     $this->MailDir = $this->sql->getvalue("select MailDir from Users where Account=?", $this->Account);
     $this->SessionID = session_id();
     $this->tree = array();
     $this->months = array('Jan' => '01', 'Feb' => '02', 'Mar' => '03', 'Apr' => '04', 'May' => '05', 'Jun' => '06', 'Jul' => '07', 'Aug' => '08', 'Sep' => '09', 'Oct' => '10', 'Nov' => '11', 'Dec' => '12');
 }

 function createuser($user = null)
 {
     global $pref, $atmail, $settings, $domains;
     // If we are using LDAP, grab the user details via the LDAP server
     if ($pref['ldap_auth']) {
         $ldapuser = $this->ldap_auth_populate($this->username);
         // LDAP mod ---  changed user[FirstName], & user[LastName] to user[Industry], & user[Occupation]
         $user['Industry'] = $ldapuser['FirstName'];
         $user['Occupation'] = $ldapuser['LastName'];
         $user['RealName'] = $ldapuser['RealName'];
         //echo $user['FirstName'] . ":" . $user['LastName'] . "\n";
     }
     if (!$pref['crypt'] || !$atmail->isset_chk($domains[$this->pop3host])) {
         // Plaintext password
         $pass = $this->password;
     } else {
         // Encrypt the password
         $pass = crypt($this->password);
     }
     $this->SessionID = session_id();
     // Load our table names
     $atmail->db->table_names($this->Account);
     // Log the time we created the account
     $time = time();
     // Specify the 'default' user group if none exists
     if (!$user['UGroup']) {
         $user['UGroup'] = 'Default';
     }
     // Purge any invalid entries in the DB
     $atmail->db->sqldo("delete from UserSession where Account=?", $this->Account);
     // Create a new SessionID for the user
     $query = "INSERT INTO UserSession (Account, Password, SessionID, LastLogin, PasswordMD5, SessionData) VALUES(?, ?, ?, ?, ?, ?)";
     $data = array($this->Account, $pass, $this->SessionID, $time, md5($pass), '');
     $res = $atmail->db->sqldo($query, $data);
     if ($res != 1) {
         return -1;
     }
     $settings['UseSSL'] = 0;
     // Select the MailType - SQL or Flatfile
     // All functions are based on what type of account the user has
     if (!$domains[$this->pop3host]) {
         $settings['MailType'] = $_REQUEST['MailType'];
         if (strpos($settings['MailType'], 's')) {
             $settings['UseSSL'] = 1;
             $settings['MailType'] = str_replace('s', '', $settings['MailType']);
         }
     } elseif ($pref['sql_type'] && $domains[$this->pop3host]) {
         $settings['MailType'] = 'sql';
     } elseif (!$pref['sql_type'] && $domains[$this->pop3host]) {
         $settings['MailType'] = 'file';
     }
     if ($pref['sql_type']) {
         $settings['Mode'] = 'sql';
     } else {
         $settings['Mode'] = 'file';
     }
     if (!$user['UserQuota']) {
         $user['UserQuota'] = $settings['UserQuota'];
     }
     // Build an SQL query for the new User
     $query = "INSERT INTO Users (UGroup, Address, BirthDay, BirthMonth, BirthYear, City, Country, TelHome,\r\n\t\t\t\t  FaxHome, TelWork, FaxWork, TelMobile, TelPager, FirstName, Gender, Industry, LastName,\r\n\t\t\t\t  Occupation, OtherEmail, PasswordQuestion, PostCode, State, DateCreate, UserStatus,\r\n\t\t\t\t  Account, MailDir, UserQuota) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, {$atmail->db->NOW},\r\n\t\t\t\t  ?, ?, ?, ?)";
     if (empty($user['BirthYear'])) {
         $user['BirthYear'] = 0;
     }
     $data = array($user['UGroup'], $user['Address'], $user['BirthDay'], $user['BirthMonth'], $user['BirthYear'], $user['City'], $user['Country'], $user['TelHome'], $user['FaxHome'], $user['TelWork'], $user['FaxWork'], $user['TelMobile'], $user['TelPager'], $user['FirstName'], $user['Gender'], $user['Industry'], $user['LastName'], $user['Occupation'], $user['OtherEmail'], $user['PasswordQuestion'], $user['PostCode'], $user['State'], $pref['UserStatus'], $this->Account, $user['MailDir'], $user['UserQuota']);
     if ($atmail->db->sqldo($query, $data) != 1) {
         return -1;
     }
     // Build the query
     $insert = '';
     $values = '';
     $data = array();
     // Insert the users settings
     foreach ($settings as $key => $value) {
         if ($key == 'UserQuota') {
             continue;
         }
         $insert .= Filter::cleanSqlFieldNames($key) . ',';
         $values .= '?,';
         // Insert custom preferences for account, depending on the
         // new user form
         if ($key == "RealName") {
             $data[] = $user['FirstName'] . ' ' . $user['LastName'];
         } elseif ($key == "LoginType") {
             $data[] = $user['LoginType'];
         } elseif ($key == "Service") {
             $data[] = $user['Service'];
         } elseif ($key == "ReplyTo" && $atmail->isset_chk($_REQUEST['email'])) {
             $data[] = $_REQUEST['email'];
         } elseif ($key == "ReplyTo" && !$atmail->isset_chk($_REQUEST['email'])) {
             $data[] = $this->Account;
         } elseif ($key == "Language" && $atmail->isset_chk($_REQUEST['Language'])) {
             $data[] = $_REQUEST['Language'];
         } else {
             $data[] = $value;
         }
     }
     $user_settings = $atmail->db->get('UserSettings');
     $query = "INSERT INTO {$user_settings} ({$insert} Account) values ({$values} ?)";
     $data[] = $this->Account;
//.........這裏部分代碼省略.........

 function checkgroup($group)
 {
     global $atmail;
     $abookGroup = Filter::cleanSqlFieldNames($this->db->AbookGroup);
     $group = $this->db->sqlgetfield("select GroupName from {$abookGroup} where GroupName={$this->Ugroup}\n\t\tand Account={$this->Account_Escape}");
     return $group;
 }

 function optimize_table($table)
 {
     $table = Filter::cleanSqlFieldNames($table);
     if ($this->type == 'mysql') {
         $this->dbh->query("optimize table {$table}");
     }
 }

 function generatepermissions($user, $db, $field, $accounts)
 {
     global $pref;
     $user = str_replace("'", '', $user);
     $user = $this->db->quote($user);
     $db = Filter::cleanSqlFieldNames($db);
     $field = Filter::cleanSqlFieldNames($field);
     // Create a string containing the list of permissions for Javascript to use
     if (is_array($accounts)) {
         foreach ($accounts as $account) {
             $account = $this->db->quote($account);
             // If the element is an email-address
             if (strpos($account, '@') != false) {
                 $value = $this->db->getvalue("select CONCAT({$db}.Account, ':', Users.id, ':', {$db}.Permissions) from {$db}, Users where {$db}.Account={$account} and Users.Account={$account} and {$db}.{$field}={$user} ");
                 if (!$value) {
                     $value = $this->db->getvalue("select CONCAT(Account, ':', id, ':', Permissions) from {$db} where Account={$account}");
                 }
                 $permissions .= $value . ",";
             } else {
                 $account = str_replace("'", '', $account);
                 // Otherwise the reference points to a group, load the group-name
                 $users = $this->findgroups($account);
                 if ($account == "All Users" && $pref['GlobalAbook'] && $this->param('frames') != "To,Cc,Bcc") {
                     $users[0] = "All Users";
                 }
                 // If users exist in the group, append the action
                 if (!$users[0]) {
                     $users[0] = "{$account}";
                 }
                 $grouppermissions .= "GroupNames[\"{$account}\"] = \"{$account}\";";
                 $permission = $this->db->sqlgetfield("select {$db}.Permissions from {$db} where {$db}.Account=? and {$field}={$user}", array($account));
                 if ($permission) {
                     $grouppermissions .= "AddedGroups[\"{$account}\"] = 'Write';";
                 } else {
                     $grouppermissions .= "AddedGroups[\"{$account}\"] = 'Read';";
                 }
                 $grouppermissions .= "Groups[\"{$account}\"] = \"";
                 $grouppermissions .= implode(',', $users);
                 $grouppermissions .= "\";\n";
             }
         }
     }
     if ($grouppermissions && !$permissions) {
         $permissions = " ";
     }
     return array($permissions, $grouppermissions);
 }