Esempi in PHP per mysql_real_escape_string_fixed

Esempio n. 1

File: log.php Progetto: Cavalero/RO-MVP-Timer

	<input id="localdiff" type="hidden" name="localdiff" value="" />
</form>
<br />
<?

$sql = sprintf("SELECT COUNT(%s.id) FROM %s,%s",
	$config['table2'],
	$config['table2'],
	$config['table']);
$where = sprintf(" WHERE %s.id=%s.mvp_id",
		$config['table'],
		$config['table2']);

if($config['multiguild'])
	$where .= sprintf(" AND (user='******' OR %s.ffa=1)",
		mysql_real_escape_string_fixed($_SERVER['REMOTE_USER']),
		$config['table2']);
		

if(isset($_GET['id']) && is_numeric($_GET['id']))
	$where .= sprintf(" AND mvp_id='%d'",
		$_GET['id']);

$sql_query = mysql_query($sql.$where) or die("A critical MySQL error has occurred.<br />Your Query: " . $sql . "<br /> Error: (" . mysql_errno() . ") " . mysql_error());

$logcount = mysql_result($sql_query,0,0);

$pagecount = ceil($logcount/50);

if(isset($_GET['page']) && is_numeric($_GET['page']) && $_GET['page']>0) {
	$_GET['page'] = (int) $_GET['page'];

Esempio n. 2

File: index.php Progetto: Cavalero/RO-MVP-Timer

    }
    if ($validated) {
        // We update the database
        // Get user infos
        $user = array('ip' => $_SERVER["REMOTE_ADDR"], 'agent' => isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : "", 'host' => @gethostbyaddr($_SERVER["REMOTE_ADDR"]));
        $input['newuser'] = $_SERVER['REMOTE_USER'];
        // get old infos
        $sql = sprintf("SELECT lastkill FROM %s WHERE id='%d'", $config['table'], $input['id']);
        $sql_result = mysql_query($sql) or die("A critical MySQL error has occurred.<br />Your Query: " . $sql . "<br /> Error: (" . mysql_errno() . ") " . mysql_error());
        if ($sql_result && mysql_num_rows($sql_result) == 1) {
            $old = mysql_fetch_array($sql_result);
            // insert update
            $sql = sprintf("UPDATE %s SET lastkill='%d', lastname='%s', note='%s', ffa='%d', count=count+'%d' WHERE id='%d'", $config['table'], $input['newtime'], $input['resettime'] ? '' : mysql_real_escape_string_fixed($input['newuser']), mysql_real_escape_string_fixed(mb_substr(htmlspecialchars_decode($input['note']), 0, 255)), $input['ffa'], $input['count'], $input['id']);
            $sql_result = mysql_query($sql) or die("A critical MySQL error has occurred.<br />Your Query: " . $sql . "<br /> Error: (" . mysql_errno() . ") " . mysql_error());
            // insert log
            $sql = sprintf("INSERT INTO %s\n\t\t\t\t\t\t(ip, host, agent, changetime, user, note, ffa, mvp_id, time_old, time_new)\n\t\t\t\t\tVALUES ('%s', '%s', '%s', '%d', '%s', '%s', '%d', '%d', '%d', '%d')", $config['table2'], $user['ip'], mysql_real_escape_string_fixed($user['host']), mysql_real_escape_string_fixed($user['agent']), $time_sec, mysql_real_escape_string_fixed($input['newuser']), mysql_real_escape_string_fixed(mb_substr(htmlspecialchars_decode($input['note']), 0, 255)), $input['ffa'], $input['id'], $old['lastkill'], $input['newtime']);
            $sql_result = mysql_query($sql) or die("A critical MySQL error has occurred.<br />Your Query: " . $sql . "<br /> Error: (" . mysql_errno() . ") " . mysql_error());
        }
    }
    header("Location: http://" . $_SERVER["HTTP_HOST"] . $_SERVER["SCRIPT_NAME"]);
    // Clear the POSTDATA that browser stores when filling web forms, and then asks you to resend when hitting F5 to refresh page
}
if ($autorefresh > 0) {
    //fix for chrome breaking autorefresh
    if (strpos(@strtoupper($_SERVER["HTTP_USER_AGENT"]), 'CHROME')) {
        header('Refresh: ' . $autorefresh . '; url=http://' . $_SERVER["HTTP_HOST"] . $_SERVER["SCRIPT_NAME"]);
    } else {
        header('Refresh: ' . $autorefresh . '; url=' . $_SERVER["REQUEST_URI"]);
    }
}
// the portion below seriously needs some kind of template system