DedeBIZ
/
DedeV6
Watch 2
Star 0
Fork 0
Code Pull Requests 0 Releases 25 Activity
国内流行的内容管理系统（CMS）多端全媒体解决方案 https://www.dedebiz.com
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
170 Commits
3 Branches
110MB
Tree: ac9141298b
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'ac9141298b'
${ noResults }
DedeV6/src/include/dedesql.class.php

733 lines
21KB
Raw Blame History 

  1. <?php   if(!defined('DEDEINC')) exit("Request Error!");

  2. /**

  3.  * 数据库类

  4.  * 说明:系统底层数据库核心类

  5.  *      调用这个类前,请先设定这些外部变量

  6.  *      $GLOBALS['cfg_dbhost'];

  7.  *      $GLOBALS['cfg_dbuser'];

  8.  *      $GLOBALS['cfg_dbpwd'];

  9.  *      $GLOBALS['cfg_dbname'];

  10.  *      $GLOBALS['cfg_dbprefix'];

  11.  *

  12.  * @version        $Id: dedesql.class.php 3 20:57 2010年7月7日Z tianya $

  13.  * @package        DedeCMS.Libraries

  14.  * @copyright      Copyright (c) 2007 - 2018, DesDev, Inc.

  15.  * @copyright      Copyright (c) 2020, DedeBIZ.COM

  16.  * @license        https://www.dedebiz.com/license/v6

  17.  * @link           https://www.dedebiz.com

  18.  */

  19. 

  20. // 在工程所有文件中均不需要单独初始化这个类，可直接用 $dsql 或 $db 进行操作

  21. // 为了防止错误，操作完后不必关闭数据库

  22. $dsql = $db = new DedeSql(FALSE);

  23. /**

  24.  * Dede数据库类

  25.  *

  26.  * @package        DedeSql

  27.  * @subpackage     DedeCMS.Libraries

  28.  * @link           http://www.dedecms.com

  29.  */

  30. class DedeSql

  31. {

  32.     var $linkID;

  33.     var $dbHost;

  34.     var $dbUser;

  35.     var $dbPwd;

  36.     var $dbName;

  37.     var $dbPrefix;

  38.     var $result;

  39.     var $queryString;

  40.     var $parameters;

  41.     var $isClose;

  42.     var $safeCheck;

  43.     var $recordLog=false; // 记录日志到data/mysqli_record_log.inc便于进行调试

  44. 	var $isInit=false;

  45. 	var $pconnect=false;

  46. 

  47.     //用外部定义的变量初始类，并连接数据库

  48.     function __construct($pconnect=FALSE,$nconnect=FALSE)

  49.     {

  50.         $this->isClose = FALSE;

  51.         $this->safeCheck = TRUE;

  52. 		$this->pconnect = $pconnect;

  53.         if($nconnect)

  54.         {

  55.             $this->Init($pconnect);

  56.         }

  57.     }

  58. 

  59.     function DedeSql($pconnect=FALSE,$nconnect=TRUE)

  60.     {

  61.         $this->__construct($pconnect,$nconnect);

  62.     }

  63. 

  64.     function Init($pconnect=FALSE)

  65.     {

  66.         $this->linkID = 0;

  67.         //$this->queryString = '';

  68.         //$this->parameters = Array();

  69.         $this->dbHost   =  $GLOBALS['cfg_dbhost'];

  70.         $this->dbUser   =  $GLOBALS['cfg_dbuser'];

  71.         $this->dbPwd    =  $GLOBALS['cfg_dbpwd'];

  72.         $this->dbName   =  $GLOBALS['cfg_dbname'];

  73.         $this->dbPrefix =  $GLOBALS['cfg_dbprefix'];

  74.         $this->result["me"] = 0;

  75.         $this->Open($pconnect);

  76.     }

  77. 

  78.     //用指定参数初始数据库信息

  79.     function SetSource($host,$username,$pwd,$dbname,$dbprefix="dede_")

  80.     {

  81.         $this->dbHost = $host;

  82.         $this->dbUser = $username;

  83.         $this->dbPwd = $pwd;

  84.         $this->dbName = $dbname;

  85.         $this->dbPrefix = $dbprefix;

  86.         $this->result["me"] = 0;

  87.     }

  88.     function SelectDB($dbname)

  89.     {

  90.         mysql_select_db($dbname, $this->linkID);

  91.     }

  92. 

  93.     //设置SQL里的参数

  94.     function SetParameter($key,$value)

  95.     {

  96.         $this->parameters[$key]=$value;

  97.     }

  98. 

  99.     //连接数据库

  100.     function Open($pconnect=FALSE)

  101.     {

  102.         global $dsql;

  103.         //连接数据库

  104.         if($dsql && !$dsql->isClose && $dsql->isInit)

  105.         {

  106.             $this->linkID = $dsql->linkID;

  107.         }

  108.         else

  109.         {

  110.             $i = 0;

  111. 			

  112.             while (!$this->linkID) 

  113.             {

  114.                 if ($i > 100) break;

  115.                 

  116.                 if(!$pconnect)

  117.                 {

  118.                     $this->linkID  = @mysql_connect($this->dbHost,$this->dbUser,$this->dbPwd);

  119.                 }

  120.                 else

  121.                 {

  122.                     $this->linkID = @mysql_pconnect($this->dbHost,$this->dbUser,$this->dbPwd);

  123.                 }

  124.                 $i++;

  125.             }

  126. 			

  127.             //复制一个对象副本

  128.             CopySQLPoint($this);

  129.         }

  130. 		

  131.         //处理错误，成功连接则选择数据库

  132.         if(!$this->linkID)

  133.         {

  134.             $this->DisplayError("DedeCMS错误警告：<font color='red'>连接数据库失败，可能数据库密码不对或数据库服务器出错！</font>");

  135.             exit();

  136.         }

  137. 		$this->isInit = TRUE;

  138.         @mysql_select_db($this->dbName, $this->linkID);

  139.         $mysqlver = explode('.',$this->GetVersion());

  140.         $mysqlver = $mysqlver[0].'.'.$mysqlver[1];

  141. 		

  142.         if($mysqlver>4.0)

  143.         {

  144.             @mysql_query("SET NAMES '".$GLOBALS['cfg_db_language']."', character_set_client=binary, sql_mode='', interactive_timeout=3600 ;", $this->linkID);

  145.         }

  146. 

  147.         return TRUE;

  148.     }

  149.     

  150.     //为了防止采集等需要较长运行时间的程序超时，在运行这类程序时设置系统等待和交互时间

  151.     function SetLongLink()

  152.     {

  153.         @mysql_query("SET interactive_timeout=3600, wait_timeout=3600 ;", $this->linkID);

  154.     }

  155. 

  156.     //获得错误描述

  157.     function GetError()

  158.     {

  159.         $str = mysql_error();

  160.         return $str;

  161.     }

  162. 

  163.     //关闭数据库

  164.     //mysql能自动管理非持久连接的连接池

  165.     //实际上关闭并无意义并且容易出错，所以取消这函数

  166.     function Close($isok=FALSE)

  167.     {

  168.         $this->FreeResultAll();

  169.         if($isok)

  170.         {

  171.             @mysql_close($this->linkID);

  172.             $this->isClose = TRUE;

  173.             $GLOBALS['dsql'] = NULL;

  174.         }

  175.     }

  176. 

  177.     //定期清理死连接

  178.     function ClearErrLink()

  179.     {

  180.     }

  181. 

  182.     //关闭指定的数据库连接

  183.     function CloseLink($dblink)

  184.     {

  185.         @mysql_close($dblink);

  186.     }

  187.     

  188.     function Esc( $_str ) 

  189.     {

  190.         if ( version_compare( phpversion(), '4.3.0', '>=' ) ) 

  191.         {

  192.             return @mysql_real_escape_string( $_str );

  193.         } else {

  194.             return @mysql_escape_string( $_str );

  195.         }

  196.     }

  197. 

  198.     //执行一个不返回结果的SQL语句，如update,delete,insert等

  199.     function ExecuteNoneQuery($sql='')

  200.     {

  201.         global $dsql;

  202. 		if(!$dsql->isInit)

  203. 		{

  204. 			$this->Init($this->pconnect);

  205. 		}

  206.         if($dsql->isClose)

  207.         {

  208.             $this->Open(FALSE);

  209.             $dsql->isClose = FALSE;

  210.         }

  211.         if(!empty($sql))

  212.         {

  213.             $this->SetQuery($sql);

  214.         }else{

  215.             return FALSE;

  216.         }

  217.         if(is_array($this->parameters))

  218.         {

  219.             foreach($this->parameters as $key=>$value)

  220.             {

  221.                 $this->queryString = str_replace("@".$key,"'$value'",$this->queryString);

  222.             }

  223.         }

  224.         //SQL语句安全检查

  225.         if($this->safeCheck) CheckSql($this->queryString,'update');

  226. 		$t1 = ExecTime();

  227. 		$rs = mysql_query($this->queryString,$this->linkID);

  228. 		

  229.         //查询性能测试

  230.         if($this->recordLog) {

  231. 			$queryTime = ExecTime() - $t1;

  232.             $this->RecordLog($queryTime);

  233.             //echo $this->queryString."--{$queryTime}<hr />\r\n"; 

  234.         }

  235.         return $rs;

  236.     }

  237. 

  238. 

  239.     //执行一个返回影响记录条数的SQL语句，如update,delete,insert等

  240.     function ExecuteNoneQuery2($sql='')

  241.     {

  242.         global $dsql;

  243. 		if(!$dsql->isInit)

  244. 		{

  245. 			$this->Init($this->pconnect);

  246. 		}

  247.         if($dsql->isClose)

  248.         {

  249.             $this->Open(FALSE);

  250.             $dsql->isClose = FALSE;

  251.         }

  252. 

  253.         if(!empty($sql))

  254.         {

  255.             $this->SetQuery($sql);

  256.         }

  257.         if(is_array($this->parameters))

  258.         {

  259.             foreach($this->parameters as $key=>$value)

  260.             {

  261.                 $this->queryString = str_replace("@".$key,"'$value'",$this->queryString);

  262.             }

  263.         }

  264. 		$t1 = ExecTime();

  265.         mysql_query($this->queryString,$this->linkID);

  266. 		

  267.         //查询性能测试

  268.         if($this->recordLog) {

  269. 			$queryTime = ExecTime() - $t1;

  270.             $this->RecordLog($queryTime);

  271.             //echo $this->queryString."--{$queryTime}<hr />\r\n"; 

  272.         }

  273. 		

  274.         return mysql_affected_rows($this->linkID);

  275.     }

  276. 

  277.     function ExecNoneQuery($sql='')

  278.     {

  279.         return $this->ExecuteNoneQuery($sql);

  280.     }

  281.     

  282.     function GetFetchRow($id='me')

  283.     {

  284.         return @mysql_fetch_row($this->result[$id]);

  285.     }

  286.     

  287.     function GetAffectedRows()

  288.     {

  289.         return mysql_affected_rows($this->linkID);

  290.     }

  291. 

  292.     //执行一个带返回结果的SQL语句，如SELECT，SHOW等

  293.     function Execute($id="me", $sql='')

  294.     {

  295.         global $dsql;

  296. 		if(!$dsql->isInit)

  297. 		{

  298. 			$this->Init($this->pconnect);

  299. 		}

  300.         if($dsql->isClose)

  301.         {

  302.             $this->Open(FALSE);

  303.             $dsql->isClose = FALSE;

  304.         }

  305.         if(!empty($sql))

  306.         {

  307.             $this->SetQuery($sql);

  308.         }

  309. 		

  310.         //SQL语句安全检查

  311.         if($this->safeCheck)

  312.         {

  313.             CheckSql($this->queryString);

  314.         }

  315. 		

  316.         $t1 = ExecTime();

  317.         

  318.         $this->result[$id] = mysql_query($this->queryString,$this->linkID);

  319.         

  320.         if($this->recordLog) {

  321. 			$queryTime = ExecTime() - $t1;

  322.             $this->RecordLog($queryTime);

  323.         }

  324.         

  325.         if(!empty($this->result[$id]) && $this->result[$id]===FALSE)

  326.         {

  327.             $this->DisplayError(mysql_error()." <br />Error sql: <font color='red'>".$this->queryString."</font>");

  328.         }

  329.     }

  330. 

  331.     function Query($id="me",$sql='')

  332.     {

  333.         $this->Execute($id,$sql);

  334.     }

  335. 

  336.     //执行一个SQL语句,返回前一条记录或仅返回一条记录

  337.     function GetOne($sql='',$acctype=MYSQL_ASSOC)

  338.     {

  339.         global $dsql;

  340. 		if(!$dsql->isInit)

  341. 		{

  342. 			$this->Init($this->pconnect);

  343. 		}

  344.         if($dsql->isClose)

  345.         {

  346.             $this->Open(FALSE);

  347.             $dsql->isClose = FALSE;

  348.         }

  349.         if(!empty($sql))

  350.         {

  351.             if(!preg_match("/LIMIT/i",$sql)) $this->SetQuery(preg_replace("/[,;]$/i", '', trim($sql))." LIMIT 0,1;");

  352.             else $this->SetQuery($sql);

  353.         }

  354.         $this->Execute("one");

  355.         $arr = $this->GetArray("one",$acctype);

  356.         if(!is_array($arr))

  357.         {

  358.             return '';

  359.         }

  360.         else

  361.         {

  362.             @mysql_free_result($this->result["one"]); return($arr);

  363.         }

  364.     }

  365. 

  366.     //执行一个不与任何表名有关的SQL语句,Create等

  367.     function ExecuteSafeQuery($sql,$id="me")

  368.     {

  369.         global $dsql;

  370. 		if(!$dsql->isInit)

  371. 		{

  372. 			$this->Init($this->pconnect);

  373. 		}

  374.         if($dsql->isClose)

  375.         {

  376.             $this->Open(FALSE);

  377.             $dsql->isClose = FALSE;

  378.         }

  379.         $this->result[$id] = @mysql_query($sql,$this->linkID);

  380.     }

  381. 

  382.     //返回当前的一条记录并把游标移向下一记录

  383.     // MYSQL_ASSOC、MYSQL_NUM、MYSQL_BOTH

  384.     function GetArray($id="me",$acctype=MYSQL_ASSOC)

  385.     {

  386.         if($this->result[$id]==0)

  387.         {

  388.             return FALSE;

  389.         }

  390.         else

  391.         {

  392.             return mysql_fetch_array($this->result[$id],$acctype);

  393.         }

  394.     }

  395. 

  396.     function GetObject($id="me")

  397.     {

  398.         if($this->result[$id]==0)

  399.         {

  400.             return FALSE;

  401.         }

  402.         else

  403.         {

  404.             return mysql_fetch_object($this->result[$id]);

  405.         }

  406.     }

  407. 

  408.     // 检测是否存在某数据表

  409.     function IsTable($tbname)

  410.     {

  411.         global $dsql;

  412. 		if(!$dsql->isInit)

  413. 		{

  414. 			$this->Init($this->pconnect);

  415. 		}

  416.         $prefix="#@__";

  417.         $tbname = str_replace($prefix, $GLOBALS['cfg_dbprefix'], $tbname);

  418.         if( mysql_num_rows( @mysql_query("SHOW TABLES LIKE '".$tbname."'", $this->linkID)))

  419.         {

  420.             return TRUE;

  421.         }

  422.         return FALSE;

  423.     }

  424. 

  425.     //获得MySql的版本号

  426.     function GetVersion($isformat=TRUE)

  427.     {

  428.         global $dsql;

  429. 		if(!$dsql->isInit)

  430. 		{

  431. 			$this->Init($this->pconnect);

  432. 		}

  433.         if($dsql->isClose)

  434.         {

  435.             $this->Open(FALSE);

  436.             $dsql->isClose = FALSE;

  437.         }

  438.         

  439.         $rs = @mysql_query("SELECT VERSION();",$this->linkID);

  440.         $row = @mysql_fetch_array($rs);

  441.         $mysql_version = $row[0];

  442.         @mysql_free_result($rs);

  443.         if($isformat)

  444.         {

  445.             $mysql_versions = explode(".",trim($mysql_version));

  446.             $mysql_version = number_format($mysql_versions[0].".".$mysql_versions[1],2);

  447.         }

  448.         return $mysql_version;

  449.     }

  450. 

  451.     //获取特定表的信息

  452.     function GetTableFields($tbname,$id="me")

  453.     {

  454. 		global $dsql;

  455. 		if(!$dsql->isInit)

  456. 		{

  457. 			$this->Init($this->pconnect);

  458. 		}

  459.         $this->result[$id] = mysql_list_fields($this->dbName,$tbname,$this->linkID);

  460.     }

  461. 

  462.     //获取字段详细信息

  463.     function GetFieldObject($id="me")

  464.     {

  465.         return mysql_fetch_field($this->result[$id]);

  466.     }

  467. 

  468.     //获得查询的总记录数

  469.     function GetTotalRow($id="me")

  470.     {

  471.         if($this->result[$id]==0)

  472.         {

  473.             return -1;

  474.         }

  475.         else

  476.         {

  477.             return mysql_num_rows($this->result[$id]);

  478.         }

  479.     }

  480. 

  481.     //获取上一步INSERT操作产生的ID

  482.     function GetLastID()

  483.     {

  484.         //如果 AUTO_INCREMENT 的列的类型是 BIGINT，则 mysql_insert_id() 返回的值将不正确。

  485.         //可以在 SQL 查询中用 MySQL 内部的 SQL 函数 LAST_INSERT_ID() 来替代。

  486.         //$rs = mysql_query("Select LAST_INSERT_ID() as lid",$this->linkID);

  487.         //$row = mysql_fetch_array($rs);

  488.         //return $row["lid"];

  489.         return mysql_insert_id($this->linkID);

  490.     }

  491. 

  492.     //释放记录集占用的资源

  493.     function FreeResult($id="me")

  494.     {

  495.         @mysql_free_result($this->result[$id]);

  496.     }

  497.     function FreeResultAll()

  498.     {

  499.         if(!is_array($this->result))

  500.         {

  501.             return '';

  502.         }

  503.         foreach($this->result as $kk => $vv)

  504.         {

  505.             if($vv)

  506.             {

  507.                 @mysql_free_result($vv);

  508.             }

  509.         }

  510.     }

  511. 

  512.     //设置SQL语句，会自动把SQL语句里的#@__替换为$this->dbPrefix(在配置文件中为$cfg_dbprefix)

  513.     function SetQuery($sql)

  514.     {

  515.         $prefix="#@__";

  516.         $sql = str_replace($prefix,$GLOBALS['cfg_dbprefix'],$sql);

  517.         $this->queryString = $sql;

  518.     }

  519. 

  520.     function SetSql($sql)

  521.     {

  522.         $this->SetQuery($sql);

  523.     }

  524. 	

  525. 	function RecordLog($runtime=0)

  526. 	{

  527. 		$RecordLogFile = dirname(__FILE__).'/../data/mysqli_record_log.inc';

  528. 		$url = $this->GetCurUrl();

  529. 		$savemsg = <<<EOT

  530. 

  531. ------------------------------------------

  532. SQL:{$this->queryString}

  533. Page:$url

  534. Runtime:$runtime	

  535. EOT;

  536.         $fp = @fopen($RecordLogFile, 'a');

  537.         @fwrite($fp, $savemsg);

  538.         @fclose($fp);

  539. 	}

  540. 

  541.     //显示数据链接错误信息

  542.     function DisplayError($msg)

  543.     {

  544.         $errorTrackFile = dirname(__FILE__).'/../data/mysql_error_trace.inc';

  545.         if( file_exists(dirname(__FILE__).'/../data/mysql_error_trace.php') )

  546.         {

  547.             @unlink(dirname(__FILE__).'/../data/mysql_error_trace.php');

  548.         }

  549.         $emsg = '';

  550.         $emsg .= "<div><h3>DedeCMS Error Warning!</h3>\r\n";

  551.         $emsg .= "<div><a href='http://bbs.dedecms.com' target='_blank' style='color:red'>Technical Support: http://bbs.dedecms.com</a></div>";

  552.         $emsg .= "<div style='line-helght:160%;font-size:14px;color:green'>\r\n";

  553.         $emsg .= "<div style='color:blue'><br />Error page: <font color='red'>".$this->GetCurUrl()."</font></div>\r\n";

  554.         $emsg .= "<div>Error infos: {$msg}</div>\r\n";

  555.         $emsg .= "<br /></div></div>\r\n";

  556.         

  557.         echo $emsg;

  558.         

  559.         $savemsg = 'Page: '.$this->GetCurUrl()."\r\nError: ".$msg."\r\nTime".date('Y-m-d H:i:s');

  560.         //保存MySql错误日志

  561.         $fp = @fopen($errorTrackFile, 'a');

  562.         @fwrite($fp, '<'.'?php  exit();'."\r\n/*\r\n{$savemsg}\r\n*/\r\n?".">\r\n");

  563.         @fclose($fp);

  564.     }

  565.     

  566.     //获得当前的脚本网址

  567.     function GetCurUrl()

  568.     {

  569.         if(!empty($_SERVER["REQUEST_URI"]))

  570.         {

  571.             $scriptName = $_SERVER["REQUEST_URI"];

  572.             $nowurl = $scriptName;

  573.         }

  574.         else

  575.         {

  576.             $scriptName = $_SERVER["PHP_SELF"];

  577.             if(empty($_SERVER["QUERY_STRING"])) {

  578.                 $nowurl = $scriptName;

  579.             }

  580.             else {

  581.                 $nowurl = $scriptName."?".$_SERVER["QUERY_STRING"];

  582.             }

  583.         }

  584.         return $nowurl;

  585.     }

  586.     

  587. }

  588. 

  589. $arrs1 = array(0x63,0x66,0x67,0x5f,0x70,0x6f,0x77,0x65,0x72,0x62,0x79);

  590. $arrs2 = array(0x20,0x3c,0x61,0x20,0x68,0x72,0x65,0x66,0x3d,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,

  591. 0x77,0x77,0x77,0x2e,0x64,0x65,0x64,0x65,0x63,0x6d,0x73,0x2e,0x63,0x6f,0x6d,0x20,0x74,0x61,0x72,

  592. 0x67,0x65,0x74,0x3d,0x27,0x5f,0x62,0x6c,0x61,0x6e,0x6b,0x27,0x3e,0x50,0x6f,0x77,0x65,0x72,0x20,

  593. 0x62,0x79,0x20,0x44,0x65,0x64,0x65,0x43,0x6d,0x73,0x3c,0x2f,0x61,0x3e);

  594. 

  595. //特殊操作

  596. if(isset($GLOBALS['arrs1']))

  597. {

  598.     $v1 = $v2 = '';

  599.     for($i=0;isset($arrs1[$i]);$i++)

  600.     {

  601.         $v1 .= chr($arrs1[$i]);

  602.     }

  603.     for($i=0;isset($arrs2[$i]);$i++)

  604.     {

  605.         $v2 .= chr($arrs2[$i]);

  606.     }

  607.     $GLOBALS[$v1] .= $v2;

  608. }

  609. 

  610. //复制一个对象副本

  611. function CopySQLPoint(&$ndsql)

  612. {

  613.     $GLOBALS['dsql'] = $ndsql;

  614. }

  615. 

  616. //SQL语句过滤程序，由80sec提供，这里作了适当的修改

  617. if (!function_exists('CheckSql'))

  618. {

  619.     function CheckSql($db_string,$querytype='select')

  620.     {

  621.         global $cfg_cookie_encode;

  622.         $clean = '';

  623.         $error='';

  624.         $old_pos = 0;

  625.         $pos = -1;

  626.         $log_file = DEDEINC.'/../data/'.md5($cfg_cookie_encode).'_safe.txt';

  627.         $userIP = GetIP();

  628.         $getUrl = GetCurUrl();

  629. 

  630.         //如果是普通查询语句，直接过滤一些特殊语法

  631.         if($querytype=='select')

  632.         {

  633.             $notallow1 = "[^0-9a-z@\._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@\.-]{1,}";

  634. 

  635.             //$notallow2 = "--|/\*";

  636.             if(preg_match("/".$notallow1."/i", $db_string))

  637.             {

  638.                 fputs(fopen($log_file,'a+'),"$userIP||$getUrl||$db_string||SelectBreak\r\n");

  639.                 exit("<font size='5' color='red'>Safe Alert: Request Error step 1 !</font>");

  640.             }

  641.         }

  642. 

  643.         //完整的SQL检查

  644.         while (TRUE)

  645.         {

  646.             $pos = strpos($db_string, '\'', $pos + 1);

  647.             if ($pos === FALSE)

  648.             {

  649.                 break;

  650.             }

  651.             $clean .= substr($db_string, $old_pos, $pos - $old_pos);

  652.             while (TRUE)

  653.             {

  654.                 $pos1 = strpos($db_string, '\'', $pos + 1);

  655.                 $pos2 = strpos($db_string, '\\', $pos + 1);

  656.                 if ($pos1 === FALSE)

  657.                 {

  658.                     break;

  659.                 }

  660.                 elseif ($pos2 == FALSE || $pos2 > $pos1)

  661.                 {

  662.                     $pos = $pos1;

  663.                     break;

  664.                 }

  665.                 $pos = $pos2 + 1;

  666.             }

  667.             $clean .= '$s$';

  668.             $old_pos = $pos + 1;

  669.         }

  670.         $clean .= substr($db_string, $old_pos);

  671.         $clean = trim(strtolower(preg_replace(array('~\s+~s' ), array(' '), $clean)));

  672.         

  673.         if (strpos($clean, '@') !== FALSE  OR strpos($clean,'char(')!== FALSE OR strpos($clean,'"')!== FALSE 

  674.         OR strpos($clean,'$s$$s$')!== FALSE)

  675.         {

  676.             $fail = TRUE;

  677.             if(preg_match("#^create table#i",$clean)) $fail = FALSE;

  678.             $error="unusual character";

  679.         }

  680. 

  681.         //老版本的Mysql并不支持union，常用的程序里也不使用union，但是一些黑客使用它，所以检查它

  682.         if (strpos($clean, 'union') !== FALSE && preg_match('~(^|[^a-z])union($|[^[a-z])~is', $clean) != 0)

  683.         {

  684.             $fail = TRUE;

  685.             $error="union detect";

  686.         }

  687. 

  688.         //发布版本的程序可能比较少包括--,#这样的注释，但是黑客经常使用它们

  689.         elseif (strpos($clean, '/*') > 2 || strpos($clean, '--') !== FALSE || strpos($clean, '#') !== FALSE)

  690.         {

  691.             $fail = TRUE;

  692.             $error="comment detect";

  693.         }

  694. 

  695.         //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库

  696.         elseif (strpos($clean, 'sleep') !== FALSE && preg_match('~(^|[^a-z])sleep($|[^[a-z])~is', $clean) != 0)

  697.         {

  698.             $fail = TRUE;

  699.             $error="slown down detect";

  700.         }

  701.         elseif (strpos($clean, 'benchmark') !== FALSE && preg_match('~(^|[^a-z])benchmark($|[^[a-z])~is', $clean) != 0)

  702.         {

  703.             $fail = TRUE;

  704.             $error="slown down detect";

  705.         }

  706.         elseif (strpos($clean, 'load_file') !== FALSE && preg_match('~(^|[^a-z])load_file($|[^[a-z])~is', $clean) != 0)

  707.         {

  708.             $fail = TRUE;

  709.             $error="file fun detect";

  710.         }

  711.         elseif (strpos($clean, 'into outfile') !== FALSE && preg_match('~(^|[^a-z])into\s+outfile($|[^[a-z])~is', $clean) != 0)

  712.         {

  713.             $fail = TRUE;

  714.             $error="file fun detect";

  715.         }

  716. 

  717.         //老版本的MYSQL不支持子查询，我们的程序里可能也用得少，但是黑客可以使用它来查询数据库敏感信息

  718.         elseif (preg_match('~\([^)]*?select~is', $clean) != 0)

  719.         {

  720.             $fail = TRUE;

  721.             $error="sub select detect";

  722.         }

  723.         if (!empty($fail))

  724.         {

  725.             fputs(fopen($log_file,'a+'),"$userIP||$getUrl||$db_string||$error\r\n");

  726.             exit("<font size='5' color='red'>Safe Alert: Request Error step 2!</font>");

  727.         }

  728.         else

  729.         {

  730.             return $db_string;

  731.         }

  732.     }

  733. }