DedeBIZ
/
DedeV6
Watch 2
Star 0
Fork 0
Code Pull Requests 0 Releases 25 Activity
国内流行的内容管理系统（CMS）多端全媒体解决方案 https://www.dedebiz.com
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
212 Commits
3 Branches
110MB
Tree: 61d31a2434
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '61d31a2434'
${ noResults }
DedeV6/src/include/dedesql.class.php

731 lines
21KB
Raw Blame History 

  1. <?php   if(!defined('DEDEINC')) exit("Request Error!");

  2. /**

  3.  * 数据库类

  4.  * 说明:系统底层数据库核心类

  5.  *      调用这个类前,请先设定这些外部变量

  6.  *      $GLOBALS['cfg_dbhost'];

  7.  *      $GLOBALS['cfg_dbuser'];

  8.  *      $GLOBALS['cfg_dbpwd'];

  9.  *      $GLOBALS['cfg_dbname'];

  10.  *      $GLOBALS['cfg_dbprefix'];

  11.  *

  12.  * @version        $Id: dedesql.class.php 3 20:57 2010年7月7日Z tianya $

  13.  * @package        DedeCMS.Libraries

  14.  * @copyright      Copyright (c) 2020, DedeBIZ.COM

  15.  * @license        https://www.dedebiz.com/license

  16.  * @link           https://www.dedebiz.com

  17.  */

  18. 

  19. // 在工程所有文件中均不需要单独初始化这个类，可直接用 $dsql 或 $db 进行操作

  20. // 为了防止错误，操作完后不必关闭数据库

  21. $dsql = $db = new DedeSql(FALSE);

  22. /**

  23.  * Dede数据库类

  24.  *

  25.  * @package        DedeSql

  26.  * @subpackage     DedeCMS.Libraries

  27.  * @link           http://www.dedecms.com

  28.  */

  29. class DedeSql

  30. {

  31.     var $linkID;

  32.     var $dbHost;

  33.     var $dbUser;

  34.     var $dbPwd;

  35.     var $dbName;

  36.     var $dbPrefix;

  37.     var $result;

  38.     var $queryString;

  39.     var $parameters;

  40.     var $isClose;

  41.     var $safeCheck;

  42.     var $recordLog=false; // 记录日志到data/mysqli_record_log.inc便于进行调试

  43. 	var $isInit=false;

  44. 	var $pconnect=false;

  45. 

  46.     //用外部定义的变量初始类，并连接数据库

  47.     function __construct($pconnect=FALSE,$nconnect=FALSE)

  48.     {

  49.         $this->isClose = FALSE;

  50.         $this->safeCheck = TRUE;

  51. 		$this->pconnect = $pconnect;

  52.         if($nconnect)

  53.         {

  54.             $this->Init($pconnect);

  55.         }

  56.     }

  57. 

  58.     function DedeSql($pconnect=FALSE,$nconnect=TRUE)

  59.     {

  60.         $this->__construct($pconnect,$nconnect);

  61.     }

  62. 

  63.     function Init($pconnect=FALSE)

  64.     {

  65.         $this->linkID = 0;

  66.         //$this->queryString = '';

  67.         //$this->parameters = Array();

  68.         $this->dbHost   =  $GLOBALS['cfg_dbhost'];

  69.         $this->dbUser   =  $GLOBALS['cfg_dbuser'];

  70.         $this->dbPwd    =  $GLOBALS['cfg_dbpwd'];

  71.         $this->dbName   =  $GLOBALS['cfg_dbname'];

  72.         $this->dbPrefix =  $GLOBALS['cfg_dbprefix'];

  73.         $this->result["me"] = 0;

  74.         $this->Open($pconnect);

  75.     }

  76. 

  77.     //用指定参数初始数据库信息

  78.     function SetSource($host,$username,$pwd,$dbname,$dbprefix="dede_")

  79.     {

  80.         $this->dbHost = $host;

  81.         $this->dbUser = $username;

  82.         $this->dbPwd = $pwd;

  83.         $this->dbName = $dbname;

  84.         $this->dbPrefix = $dbprefix;

  85.         $this->result["me"] = 0;

  86.     }

  87.     function SelectDB($dbname)

  88.     {

  89.         mysql_select_db($dbname, $this->linkID);

  90.     }

  91. 

  92.     //设置SQL里的参数

  93.     function SetParameter($key,$value)

  94.     {

  95.         $this->parameters[$key]=$value;

  96.     }

  97. 

  98.     //连接数据库

  99.     function Open($pconnect=FALSE)

  100.     {

  101.         global $dsql;

  102.         //连接数据库

  103.         if($dsql && !$dsql->isClose && $dsql->isInit)

  104.         {

  105.             $this->linkID = $dsql->linkID;

  106.         }

  107.         else

  108.         {

  109.             $i = 0;

  110. 			

  111.             while (!$this->linkID) 

  112.             {

  113.                 if ($i > 100) break;

  114.                 

  115.                 if(!$pconnect)

  116.                 {

  117.                     $this->linkID  = @mysql_connect($this->dbHost,$this->dbUser,$this->dbPwd);

  118.                 }

  119.                 else

  120.                 {

  121.                     $this->linkID = @mysql_pconnect($this->dbHost,$this->dbUser,$this->dbPwd);

  122.                 }

  123.                 $i++;

  124.             }

  125. 			

  126.             //复制一个对象副本

  127.             CopySQLPoint($this);

  128.         }

  129. 		

  130.         //处理错误，成功连接则选择数据库

  131.         if(!$this->linkID)

  132.         {

  133.             $this->DisplayError("DedeCMS错误警告：<font color='red'>连接数据库失败，可能数据库密码不对或数据库服务器出错！</font>");

  134.             exit();

  135.         }

  136. 		$this->isInit = TRUE;

  137.         @mysql_select_db($this->dbName, $this->linkID);

  138.         $mysqlver = explode('.',$this->GetVersion());

  139.         $mysqlver = $mysqlver[0].'.'.$mysqlver[1];

  140.         if (version_compare($mysqlver,'4.0',">=") && $GLOBALS['cfg_db_language'])

  141.         {

  142.             @mysql_query($this->linkID, "SET character_set_connection=" . $GLOBALS['cfg_db_language'] . ",character_set_results=" . $GLOBALS['cfg_db_language'] . ",character_set_client=binary");

  143.         }

  144. 

  145.         return TRUE;

  146.     }

  147.     

  148.     //为了防止采集等需要较长运行时间的程序超时，在运行这类程序时设置系统等待和交互时间

  149.     function SetLongLink()

  150.     {

  151.         @mysql_query("SET interactive_timeout=3600, wait_timeout=3600 ;", $this->linkID);

  152.     }

  153. 

  154.     //获得错误描述

  155.     function GetError()

  156.     {

  157.         $str = mysql_error();

  158.         return $str;

  159.     }

  160. 

  161.     //关闭数据库

  162.     //mysql能自动管理非持久连接的连接池

  163.     //实际上关闭并无意义并且容易出错，所以取消这函数

  164.     function Close($isok=FALSE)

  165.     {

  166.         $this->FreeResultAll();

  167.         if($isok)

  168.         {

  169.             @mysql_close($this->linkID);

  170.             $this->isClose = TRUE;

  171.             $GLOBALS['dsql'] = NULL;

  172.         }

  173.     }

  174. 

  175.     //定期清理死连接

  176.     function ClearErrLink()

  177.     {

  178.     }

  179. 

  180.     //关闭指定的数据库连接

  181.     function CloseLink($dblink)

  182.     {

  183.         @mysql_close($dblink);

  184.     }

  185.     

  186.     function Esc( $_str ) 

  187.     {

  188.         if ( version_compare( phpversion(), '4.3.0', '>=' ) ) 

  189.         {

  190.             return @mysql_real_escape_string( $_str );

  191.         } else {

  192.             return @mysql_escape_string( $_str );

  193.         }

  194.     }

  195. 

  196.     //执行一个不返回结果的SQL语句，如update,delete,insert等

  197.     function ExecuteNoneQuery($sql='')

  198.     {

  199.         global $dsql;

  200. 		if(!$dsql->isInit)

  201. 		{

  202. 			$this->Init($this->pconnect);

  203. 		}

  204.         if($dsql->isClose)

  205.         {

  206.             $this->Open(FALSE);

  207.             $dsql->isClose = FALSE;

  208.         }

  209.         if(!empty($sql))

  210.         {

  211.             $this->SetQuery($sql);

  212.         }else{

  213.             return FALSE;

  214.         }

  215.         if(is_array($this->parameters))

  216.         {

  217.             foreach($this->parameters as $key=>$value)

  218.             {

  219.                 $this->queryString = str_replace("@".$key,"'$value'",$this->queryString);

  220.             }

  221.         }

  222.         //SQL语句安全检查

  223.         if($this->safeCheck) CheckSql($this->queryString,'update');

  224. 		$t1 = ExecTime();

  225. 		$rs = mysql_query($this->queryString,$this->linkID);

  226. 		

  227.         //查询性能测试

  228.         if($this->recordLog) {

  229. 			$queryTime = ExecTime() - $t1;

  230.             $this->RecordLog($queryTime);

  231.             //echo $this->queryString."--{$queryTime}<hr />\r\n"; 

  232.         }

  233.         return $rs;

  234.     }

  235. 

  236. 

  237.     //执行一个返回影响记录条数的SQL语句，如update,delete,insert等

  238.     function ExecuteNoneQuery2($sql='')

  239.     {

  240.         global $dsql;

  241. 		if(!$dsql->isInit)

  242. 		{

  243. 			$this->Init($this->pconnect);

  244. 		}

  245.         if($dsql->isClose)

  246.         {

  247.             $this->Open(FALSE);

  248.             $dsql->isClose = FALSE;

  249.         }

  250. 

  251.         if(!empty($sql))

  252.         {

  253.             $this->SetQuery($sql);

  254.         }

  255.         if(is_array($this->parameters))

  256.         {

  257.             foreach($this->parameters as $key=>$value)

  258.             {

  259.                 $this->queryString = str_replace("@".$key,"'$value'",$this->queryString);

  260.             }

  261.         }

  262. 		$t1 = ExecTime();

  263.         mysql_query($this->queryString,$this->linkID);

  264. 		

  265.         //查询性能测试

  266.         if($this->recordLog) {

  267. 			$queryTime = ExecTime() - $t1;

  268.             $this->RecordLog($queryTime);

  269.             //echo $this->queryString."--{$queryTime}<hr />\r\n"; 

  270.         }

  271. 		

  272.         return mysql_affected_rows($this->linkID);

  273.     }

  274. 

  275.     function ExecNoneQuery($sql='')

  276.     {

  277.         return $this->ExecuteNoneQuery($sql);

  278.     }

  279.     

  280.     function GetFetchRow($id='me')

  281.     {

  282.         return @mysql_fetch_row($this->result[$id]);

  283.     }

  284.     

  285.     function GetAffectedRows()

  286.     {

  287.         return mysql_affected_rows($this->linkID);

  288.     }

  289. 

  290.     //执行一个带返回结果的SQL语句，如SELECT，SHOW等

  291.     function Execute($id="me", $sql='')

  292.     {

  293.         global $dsql;

  294. 		if(!$dsql->isInit)

  295. 		{

  296. 			$this->Init($this->pconnect);

  297. 		}

  298.         if($dsql->isClose)

  299.         {

  300.             $this->Open(FALSE);

  301.             $dsql->isClose = FALSE;

  302.         }

  303.         if(!empty($sql))

  304.         {

  305.             $this->SetQuery($sql);

  306.         }

  307. 		

  308.         //SQL语句安全检查

  309.         if($this->safeCheck)

  310.         {

  311.             CheckSql($this->queryString);

  312.         }

  313. 		

  314.         $t1 = ExecTime();

  315.         

  316.         $this->result[$id] = mysql_query($this->queryString,$this->linkID);

  317.         

  318.         if($this->recordLog) {

  319. 			$queryTime = ExecTime() - $t1;

  320.             $this->RecordLog($queryTime);

  321.         }

  322.         

  323.         if(!empty($this->result[$id]) && $this->result[$id]===FALSE)

  324.         {

  325.             $this->DisplayError(mysql_error()." <br />Error sql: <font color='red'>".$this->queryString."</font>");

  326.         }

  327.     }

  328. 

  329.     function Query($id="me",$sql='')

  330.     {

  331.         $this->Execute($id,$sql);

  332.     }

  333. 

  334.     //执行一个SQL语句,返回前一条记录或仅返回一条记录

  335.     function GetOne($sql='',$acctype=MYSQL_ASSOC)

  336.     {

  337.         global $dsql;

  338. 		if(!$dsql->isInit)

  339. 		{

  340. 			$this->Init($this->pconnect);

  341. 		}

  342.         if($dsql->isClose)

  343.         {

  344.             $this->Open(FALSE);

  345.             $dsql->isClose = FALSE;

  346.         }

  347.         if(!empty($sql))

  348.         {

  349.             if(!preg_match("/LIMIT/i",$sql)) $this->SetQuery(preg_replace("/[,;]$/i", '', trim($sql))." LIMIT 0,1;");

  350.             else $this->SetQuery($sql);

  351.         }

  352.         $this->Execute("one");

  353.         $arr = $this->GetArray("one",$acctype);

  354.         if(!is_array($arr))

  355.         {

  356.             return '';

  357.         }

  358.         else

  359.         {

  360.             @mysql_free_result($this->result["one"]); return($arr);

  361.         }

  362.     }

  363. 

  364.     //执行一个不与任何表名有关的SQL语句,Create等

  365.     function ExecuteSafeQuery($sql,$id="me")

  366.     {

  367.         global $dsql;

  368. 		if(!$dsql->isInit)

  369. 		{

  370. 			$this->Init($this->pconnect);

  371. 		}

  372.         if($dsql->isClose)

  373.         {

  374.             $this->Open(FALSE);

  375.             $dsql->isClose = FALSE;

  376.         }

  377.         $this->result[$id] = @mysql_query($sql,$this->linkID);

  378.     }

  379. 

  380.     //返回当前的一条记录并把游标移向下一记录

  381.     // MYSQL_ASSOC、MYSQL_NUM、MYSQL_BOTH

  382.     function GetArray($id="me",$acctype=MYSQL_ASSOC)

  383.     {

  384.         if($this->result[$id]==0)

  385.         {

  386.             return FALSE;

  387.         }

  388.         else

  389.         {

  390.             return mysql_fetch_array($this->result[$id],$acctype);

  391.         }

  392.     }

  393. 

  394.     function GetObject($id="me")

  395.     {

  396.         if($this->result[$id]==0)

  397.         {

  398.             return FALSE;

  399.         }

  400.         else

  401.         {

  402.             return mysql_fetch_object($this->result[$id]);

  403.         }

  404.     }

  405. 

  406.     // 检测是否存在某数据表

  407.     function IsTable($tbname)

  408.     {

  409.         global $dsql;

  410. 		if(!$dsql->isInit)

  411. 		{

  412. 			$this->Init($this->pconnect);

  413. 		}

  414.         $prefix="#@__";

  415.         $tbname = str_replace($prefix, $GLOBALS['cfg_dbprefix'], $tbname);

  416.         if( mysql_num_rows( @mysql_query("SHOW TABLES LIKE '".$tbname."'", $this->linkID)))

  417.         {

  418.             return TRUE;

  419.         }

  420.         return FALSE;

  421.     }

  422. 

  423.     //获得MySql的版本号

  424.     function GetVersion($isformat=TRUE)

  425.     {

  426.         global $dsql;

  427. 		if(!$dsql->isInit)

  428. 		{

  429. 			$this->Init($this->pconnect);

  430. 		}

  431.         if($dsql->isClose)

  432.         {

  433.             $this->Open(FALSE);

  434.             $dsql->isClose = FALSE;

  435.         }

  436.         

  437.         $rs = @mysql_query("SELECT VERSION();",$this->linkID);

  438.         $row = @mysql_fetch_array($rs);

  439.         $mysql_version = $row[0];

  440.         @mysql_free_result($rs);

  441.         if($isformat)

  442.         {

  443.             $mysql_versions = explode(".",trim($mysql_version));

  444.             $mysql_version = number_format($mysql_versions[0].".".$mysql_versions[1],2);

  445.         }

  446.         return $mysql_version;

  447.     }

  448. 

  449.     //获取特定表的信息

  450.     function GetTableFields($tbname,$id="me")

  451.     {

  452. 		global $dsql;

  453. 		if(!$dsql->isInit)

  454. 		{

  455. 			$this->Init($this->pconnect);

  456. 		}

  457.         $this->result[$id] = mysql_list_fields($this->dbName,$tbname,$this->linkID);

  458.     }

  459. 

  460.     //获取字段详细信息

  461.     function GetFieldObject($id="me")

  462.     {

  463.         return mysql_fetch_field($this->result[$id]);

  464.     }

  465. 

  466.     //获得查询的总记录数

  467.     function GetTotalRow($id="me")

  468.     {

  469.         if($this->result[$id]==0)

  470.         {

  471.             return -1;

  472.         }

  473.         else

  474.         {

  475.             return mysql_num_rows($this->result[$id]);

  476.         }

  477.     }

  478. 

  479.     //获取上一步INSERT操作产生的ID

  480.     function GetLastID()

  481.     {

  482.         //如果 AUTO_INCREMENT 的列的类型是 BIGINT，则 mysql_insert_id() 返回的值将不正确。

  483.         //可以在 SQL 查询中用 MySQL 内部的 SQL 函数 LAST_INSERT_ID() 来替代。

  484.         //$rs = mysql_query("Select LAST_INSERT_ID() as lid",$this->linkID);

  485.         //$row = mysql_fetch_array($rs);

  486.         //return $row["lid"];

  487.         return mysql_insert_id($this->linkID);

  488.     }

  489. 

  490.     //释放记录集占用的资源

  491.     function FreeResult($id="me")

  492.     {

  493.         @mysql_free_result($this->result[$id]);

  494.     }

  495.     function FreeResultAll()

  496.     {

  497.         if(!is_array($this->result))

  498.         {

  499.             return '';

  500.         }

  501.         foreach($this->result as $kk => $vv)

  502.         {

  503.             if($vv)

  504.             {

  505.                 @mysql_free_result($vv);

  506.             }

  507.         }

  508.     }

  509. 

  510.     //设置SQL语句，会自动把SQL语句里的#@__替换为$this->dbPrefix(在配置文件中为$cfg_dbprefix)

  511.     function SetQuery($sql)

  512.     {

  513.         $prefix="#@__";

  514.         $sql = str_replace($prefix,$GLOBALS['cfg_dbprefix'],$sql);

  515.         $this->queryString = $sql;

  516.     }

  517. 

  518.     function SetSql($sql)

  519.     {

  520.         $this->SetQuery($sql);

  521.     }

  522. 	

  523. 	function RecordLog($runtime=0)

  524. 	{

  525. 		$RecordLogFile = dirname(__FILE__).'/../data/mysqli_record_log.inc';

  526. 		$url = $this->GetCurUrl();

  527. 		$savemsg = <<<EOT

  528. 

  529. ------------------------------------------

  530. SQL:{$this->queryString}

  531. Page:$url

  532. Runtime:$runtime	

  533. EOT;

  534.         $fp = @fopen($RecordLogFile, 'a');

  535.         @fwrite($fp, $savemsg);

  536.         @fclose($fp);

  537. 	}

  538. 

  539.     //显示数据链接错误信息

  540.     function DisplayError($msg)

  541.     {

  542.         $errorTrackFile = dirname(__FILE__).'/../data/mysql_error_trace.inc';

  543.         if( file_exists(dirname(__FILE__).'/../data/mysql_error_trace.php') )

  544.         {

  545.             @unlink(dirname(__FILE__).'/../data/mysql_error_trace.php');

  546.         }

  547.         $emsg = '';

  548.         $emsg .= "<div><h3>DedeCMS Error Warning!</h3>\r\n";

  549.         $emsg .= "<div><a href='http://bbs.dedecms.com' target='_blank' style='color:red'>Technical Support: http://bbs.dedecms.com</a></div>";

  550.         $emsg .= "<div style='line-helght:160%;font-size:14px;color:green'>\r\n";

  551.         $emsg .= "<div style='color:blue'><br />Error page: <font color='red'>".$this->GetCurUrl()."</font></div>\r\n";

  552.         $emsg .= "<div>Error infos: {$msg}</div>\r\n";

  553.         $emsg .= "<br /></div></div>\r\n";

  554.         

  555.         echo $emsg;

  556.         

  557.         $savemsg = 'Page: '.$this->GetCurUrl()."\r\nError: ".$msg."\r\nTime".date('Y-m-d H:i:s');

  558.         //保存MySql错误日志

  559.         $fp = @fopen($errorTrackFile, 'a');

  560.         @fwrite($fp, '<'.'?php  exit();'."\r\n/*\r\n{$savemsg}\r\n*/\r\n?".">\r\n");

  561.         @fclose($fp);

  562.     }

  563.     

  564.     //获得当前的脚本网址

  565.     function GetCurUrl()

  566.     {

  567.         if(!empty($_SERVER["REQUEST_URI"]))

  568.         {

  569.             $scriptName = $_SERVER["REQUEST_URI"];

  570.             $nowurl = $scriptName;

  571.         }

  572.         else

  573.         {

  574.             $scriptName = $_SERVER["PHP_SELF"];

  575.             if(empty($_SERVER["QUERY_STRING"])) {

  576.                 $nowurl = $scriptName;

  577.             }

  578.             else {

  579.                 $nowurl = $scriptName."?".$_SERVER["QUERY_STRING"];

  580.             }

  581.         }

  582.         return $nowurl;

  583.     }

  584.     

  585. }

  586. 

  587. $arrs1 = array(0x63,0x66,0x67,0x5f,0x70,0x6f,0x77,0x65,0x72,0x62,0x79);

  588. $arrs2 = array(0x20,0x3c,0x61,0x20,0x68,0x72,0x65,0x66,0x3d,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,

  589. 0x77,0x77,0x77,0x2e,0x64,0x65,0x64,0x65,0x63,0x6d,0x73,0x2e,0x63,0x6f,0x6d,0x20,0x74,0x61,0x72,

  590. 0x67,0x65,0x74,0x3d,0x27,0x5f,0x62,0x6c,0x61,0x6e,0x6b,0x27,0x3e,0x50,0x6f,0x77,0x65,0x72,0x20,

  591. 0x62,0x79,0x20,0x44,0x65,0x64,0x65,0x43,0x6d,0x73,0x3c,0x2f,0x61,0x3e);

  592. 

  593. //特殊操作

  594. if(isset($GLOBALS['arrs1']))

  595. {

  596.     $v1 = $v2 = '';

  597.     for($i=0;isset($arrs1[$i]);$i++)

  598.     {

  599.         $v1 .= chr($arrs1[$i]);

  600.     }

  601.     for($i=0;isset($arrs2[$i]);$i++)

  602.     {

  603.         $v2 .= chr($arrs2[$i]);

  604.     }

  605.     $GLOBALS[$v1] .= $v2;

  606. }

  607. 

  608. //复制一个对象副本

  609. function CopySQLPoint(&$ndsql)

  610. {

  611.     $GLOBALS['dsql'] = $ndsql;

  612. }

  613. 

  614. //SQL语句过滤程序，由80sec提供，这里作了适当的修改

  615. if (!function_exists('CheckSql'))

  616. {

  617.     function CheckSql($db_string,$querytype='select')

  618.     {

  619.         global $cfg_cookie_encode;

  620.         $clean = '';

  621.         $error='';

  622.         $old_pos = 0;

  623.         $pos = -1;

  624.         $log_file = DEDEINC.'/../data/'.md5($cfg_cookie_encode).'_safe.txt';

  625.         $userIP = GetIP();

  626.         $getUrl = GetCurUrl();

  627. 

  628.         //如果是普通查询语句，直接过滤一些特殊语法

  629.         if($querytype=='select')

  630.         {

  631.             $notallow1 = "[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";

  632. 

  633.             //$notallow2 = "--|/\*";

  634.             if(preg_match("/".$notallow1."/i", $db_string))

  635.             {

  636.                 fputs(fopen($log_file,'a+'),"$userIP||$getUrl||$db_string||SelectBreak\r\n");

  637.                 exit("<font size='5' color='red'>Safe Alert: Request Error step 1 !</font>");

  638.             }

  639.         }

  640. 

  641.         //完整的SQL检查

  642.         while (TRUE)

  643.         {

  644.             $pos = strpos($db_string, '\'', $pos + 1);

  645.             if ($pos === FALSE)

  646.             {

  647.                 break;

  648.             }

  649.             $clean .= substr($db_string, $old_pos, $pos - $old_pos);

  650.             while (TRUE)

  651.             {

  652.                 $pos1 = strpos($db_string, '\'', $pos + 1);

  653.                 $pos2 = strpos($db_string, '\\', $pos + 1);

  654.                 if ($pos1 === FALSE)

  655.                 {

  656.                     break;

  657.                 }

  658.                 elseif ($pos2 == FALSE || $pos2 > $pos1)

  659.                 {

  660.                     $pos = $pos1;

  661.                     break;

  662.                 }

  663.                 $pos = $pos2 + 1;

  664.             }

  665.             $clean .= '$s$';

  666.             $old_pos = $pos + 1;

  667.         }

  668.         $clean .= substr($db_string, $old_pos);

  669.         $clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));

  670.         

  671.         if (strpos($clean, '@') !== FALSE  OR strpos($clean,'char(')!== FALSE OR strpos($clean,'"')!== FALSE 

  672.         OR strpos($clean,'$s$$s$')!== FALSE)

  673.         {

  674.             $fail = TRUE;

  675.             if(preg_match("#^create table#i",$clean)) $fail = FALSE;

  676.             $error="unusual character";

  677.         }

  678. 

  679.         //老版本的Mysql并不支持union，常用的程序里也不使用union，但是一些黑客使用它，所以检查它

  680.         if (strpos($clean, 'union') !== FALSE && preg_match('~(^|[^a-z])union($|[^[a-z])~is', $clean) != 0)

  681.         {

  682.             $fail = TRUE;

  683.             $error="union detect";

  684.         }

  685. 

  686.         //发布版本的程序可能比较少包括--,#这样的注释，但是黑客经常使用它们

  687.         elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE)

  688.         {

  689.             $fail = TRUE;

  690.             $error="comment detect";

  691.         }

  692. 

  693.         //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库

  694.         elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~is', $clean) != 0)

  695.         {

  696.             $fail = TRUE;

  697.             $error="slown down detect";

  698.         }

  699.         elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~is', $clean) != 0)

  700.         {

  701.             $fail = TRUE;

  702.             $error="slown down detect";

  703.         }

  704.         elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~is', $clean) != 0)

  705.         {

  706.             $fail = TRUE;

  707.             $error="file fun detect";

  708.         }

  709.         elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~is', $clean) != 0)

  710.         {

  711.             $fail = TRUE;

  712.             $error="file fun detect";

  713.         }

  714. 

  715.         //老版本的MYSQL不支持子查询，我们的程序里可能也用得少，但是黑客可以使用它来查询数据库敏感信息

  716.         elseif (preg_match('~\([^)]*?select~is', $clean) != 0)

  717.         {

  718.             $fail = TRUE;

  719.             $error="sub select detect";

  720.         }

  721.         if (!empty($fail))

  722.         {

  723.             fputs(fopen($log_file,'a+'),"$userIP||$getUrl||$db_string||$error\r\n");

  724.             exit("<font size='5' color='red'>Safe Alert: Request Error step 2!</font>");

  725.         }

  726.         else

  727.         {

  728.             return $db_string;

  729.         }

  730.     }

  731. }