function insert_smilies_frame() { global $site_config, $smilies; echo "<table><tr><td>Type...</td><td>To make a...</td></tr>"; foreach ($smilies as $code => $url) { echo "<tr><td>{$code}</td><td><a href=\"javascript:window.opener.SmileIT('{$code}', '" . cleanstr($_GET["form"]) . "', '" . htmlspecialchars($_GET["text"]) . "')\"><img src=\"{$site_config['SITEURL']}/images/smilies/{$url}\" alt=\"{$code}\" title=\"{$code}\" border=\"0\"></a></td></tr>"; } echo "</table>"; }
function ht_select($name, $options, $atribut = "", $pilih = true) { $value = cleanstr($_POST['frm'][$name]); $return = "<select id='{$name}' name='frm[{$name}]' {$atribut}>"; if ($pilih) { $return .= "<option value=''>--pilih--</option>"; } if (!empty($options)) { foreach ($options as $optVal => $optName) { $selected = $optVal == $value ? "selected='selected'" : ""; $return .= "<option value='{$optVal}' {$selected} >{$optName}</option>"; } } $return .= "</select>"; return $return; }
function create_folder($user) { $ret_code = array(1, 0); //GRAB OUR FOLDER PATH, AND THE REQUESTED NAME FOR THE FOLDER $folder_path = $_REQUEST['folder_path']; $create_folder = cleanstr($_REQUEST['create_folder']); $dir = $_REQUEST['dir']; $allowed_ext = $_REQUEST['allowed_ext']; $stat = mkdir($folder_path . $create_folder, 0777); if ($stat) { //CREATE A UNIX TIMESTAMP $stamp = time(); $date = gmdate("Y-m-d H:i:s", $stamp); //INSERT INTO OUR FILES OBJECT $sql = "INSERT INTO " . $this->config->db_prefix . "_files(name, sys_name, location, extension, note) \r\r\n VALUES('{$create_folder}', '{$create_folder}', '{$folder_path}{$create_folder}/', 'folder', '{$allowed_ext}')"; $results = $this->db->DB_Q_C($sql); $lastid = mysql_insert_id(); //LOG THE ACTION $sql = "INSERT INTO " . $this->config->db_prefix . "_object(create_date, create_who) \r\r\n VALUES('{$date}', '{$user->user_id}')"; $results = $this->db->DB_Q_C($sql); $lastobjectid = mysql_insert_id(); $sql = "INSERT INTO " . $this->config->db_prefix . "_logs(object_id, user_id, module_id, sub_module_id, record_id, action)\r\r\n VALUES({$lastobjectid}, '" . $user->user_id . "', '4', 1, {$lastid}, 1)"; $results = $this->db->DB_Q_C($sql); } else { //print "<div id='error'><div id='content'>An error has occurred!</div></div>"; $ret_code = array(-1, 0); } return $ret_code; }
function validasi_form($frm) { $pesanError = array(); $db_function = new db_function(); if (cleanstr($frm['namadebitur']) == "") { array_push($pesanError, "Nama Debitur Harus diisi"); } if (cleanstr($frm['tgl_pk']) == "") { array_push($pesanError, "Tgl Perjanjian Kredit Harus diisi"); } if (cleanstr($frm['jkw_kredit']) == "") { array_push($pesanError, "Jangka Waktu Kredit Harus diisi"); } if (cleanstr($frm['fixed_rate']) == "" && preg_match("/(griya|multiguna)/", strtolower($frm['produk']))) { array_push($pesanError, "Masa fix rate Harus diisi"); } if (cleanstr($frm['no_rekg_pinjaman']) == "") { array_push($pesanError, "Norek Pinjaman Harus diisi"); } //validasi no_rekg_pinjaman $buf = $db_function->selectOnefield("select noaplikasi from debitur where no_rekg_pinjaman ='" . $frm['no_rekg_pinjaman'] . "'"); if (cleanstr($buf) != "") { array_push($pesanError, "Norek Pinjaman sudah ada sebelum nya dengan no aplikasi " . $buf); } $skimPencairan = strtolower($frm['skim_pencairan']); $skimPks = strtolower($frm['skim_pks']); if ($skimPencairan == "partial drow down" && in_array($skimPks, array("kavling bangun", "indent"))) { if ($frm['progress'] == "") { array_push($pesanError, "Progress Pembangunan harus di isi untuk Partial drow down, skim pks kavling bangun/indent "); } elseif ($frm["progress"] != "SELESAI" && !in_array($frm['tgl_cair_tahap_dok'], array("", "00-00-0000"))) { array_push($pesanError, "tanggal cair tahap dok sudah di isi harap progress pembangunan = <b>selesai</b>"); } } return $pesanError; }
public function printTrail($key, $jenis = "") { $img = ""; if (isset($this->trailSebelum[$key]) && $this->trailSekarang[$key] != $this->trailSebelum[$key]) { $img = "<img src='images/replace.png' class='tooltip' title='" . $this->trailSebelum[$key] . "' />"; } $printtext = $this->trailSekarang[$key]; if (($jenis == "rp" || $jenis == "number") && cleanstr($this->trailSekarang[$key]) != "") { $printtext = ($jenis == "rp" ? "Rp " : "") . number_format($this->trailSekarang[$key], 0, ',', '.'); } return $printtext . " " . $img; }
// // TorrentTrader v2.x // $LastChangedDate: 2012-09-19 19:13:35 +0100 (Wed, 19 Sep 2012) $ // $LastChangedBy: torrenttrader $ // // http://www.torrenttrader.org // // require_once "backend/functions.php"; dbconn(); loggedinonly(); error_reporting(0); if ($CURUSER["edit_torrents"] == "no") { show_error_msg(T_("ERROR"), T_("NFO_PERMISSION"), 1); } $id = (int) cleanstr($_REQUEST["id"]); $do = $_POST["do"]; $nfo = $site_config["nfo_dir"] . "/{$id}.nfo"; if ($do == "update") { if (is_file($nfo)) { file_put_contents($nfo, $_POST['content']); write_log("NFO ({$id}) was updated by {$CURUSER['username']}."); show_error_msg(T_("NFO_UPDATED"), T_("NFO_UPDATED"), 1); } } if ($do == "delete") { $reason = htmlspecialchars($_POST["reason"]); if (get_row_count("torrents", "WHERE `nfo` = 'yes' AND `id` = {$id}")) { unlink($nfo); write_log("NFO ({$id}) was deleted by {$CURUSER['username']} {$reason}"); SQL_Query_exec("UPDATE `torrents` SET `nfo` = 'no' WHERE `id` = {$id}");
</td> </tr> <tr> <td>Nama Produk</td><td> <?php echo cleanstr($_POST['frm']['produk']); ?> <?php echo ht_input("produk", "", "hidden"); ?> </td> </tr> <tr> <td>Nama Produk Program</td><td> <?php echo cleanstr($_POST['frm']['program']); ?> <?php echo ht_input("program", "", "hidden"); ?> <input type="hidden" value="<?php echo $program_kd; ?> " id="program_kd" /> </td> </tr> <tr> </table> </td>
echo "<table border=\"0\" width=\"180\" align=\"center\"><tr><td>"; include "blocks/" . $name . "_block.php"; echo "</td></tr></table><hr />"; echo "<center><a href=\"javascript: self.close();\">" . T_("_CLS_WIN_") . "</a></center>"; end_frame(); stdfoot(); die; } begin_frame(T_("_BLC_MAN_")); // == addnew if (@count($_POST["addnew"])) { foreach ($_POST["addnew"] as $addthis) { $i = $addthis; $addblock = $_POST["addblock_" . $i]; $wantedname = sqlesc($_POST["wantedname_" . $i]); $name = sqlesc(str_replace("_block.php", "", cleanstr($addblock))); $description = sqlesc($_POST["wanteddescription_" . $i]); SQL_Query_exec("INSERT INTO blocks (named, name, description, position, enabled, sort) VALUES ({$wantedname}, {$name}, {$description}, 'left', 0, 0)") or mysql_errno() == 1062 ? show_error_msg(T_("ERROR"), "Sorry, this block is in database already!", 1) : show_error_msg(T_("ERROR"), "Database Query failed: " . mysql_error()); if (mysql_affected_rows() != 0) { $success = "<center><font size=\"3\"><b>" . T_("_SUCCESS_ADD_") . "</b></font></center><br />"; } else { $success = "<center><font size=\"3\"><b>" . T_("_FAIL_ADD_") . "</b></font></center><br />"; } } echo $success; } // end addnew // == permanent delete if (@count($_POST["deletepermanent"])) { foreach ($_POST["deletepermanent"] as $delpthis) { unlink("blocks/" . $delpthis);
function insertDebiturTrail($data, $row) { if (cleanstr($data->val($row, 9)) != "") { $pesan = ""; $db_function = new db_function(); $sql = "delete from debitur_trail where no_rekg_pinjaman='" . $data->val($row, 7) . "' and no_trail='" . $data->val($row, 156) . "'"; $pesan = $db_function->exec($sql); if ($pesan != "") { $_SESSION['colateral']['message_loop'][] = $pesan; } $sql = "insert into debitur_trail (LNC,NOAPLIKASI,NAMADEBITUR,TEMPATLAHIR,TGLLAHIR,CIF,no_rekg_pinjaman,afiliasi,instansi,produk,maksimum_kredit,no_pk,tgl_pk,jkw_kredit,fixed_rate,tgl_jt_pk,tgl_jt_fixed_rate,lokasi_dokumen_asli,amplop_asli,amplopasli,lokasi_dokumen_copy,amplop_copy,amplopcopy,jaminan,jml_jaminan,jenis_surat_tanah,alamat_collateral,luas_tanah,tgl_jt_surat_tanah,jenis_pengikatan,nilai_ht,jkw_covernote,notaris,appraisal,no_ajb,no_surat_tanah,collateral_zipcode,luas_bangunan,nilai_taksasi,harga_tanah,harga_bangunan,harga_tanah_imb,harga_bangunan_imb,no_pengikatan,tgl_covernote,tgl_jt_covernote,developer,skim_pks,no_imb,status_imb,nama_perumahan,asuransi_jiwa,no_polis_ass_jiwa,premi_jiwa,nilai_pertanggungan_ass_jiwa,tgl_ass_jiwa,tgl_jt_ass_jiwa,asuransi_kerugian,no_polis_ass_kerugian,premi_kerugian,nilai_pertanggungan_ass_kerugian,tgl_ass_kerugian,tgl_jt_ass_kerugian,jenis_kendaraan,no_bpkb,no_rangka,nama_dealer,merk,no_mesin,no_polisi,status_rekg,tgl_pelunasan,memo,skdr,siup,tdp,others,serah,kendala,tgl_update,bunga,program,agama,npwp,kelamin,tgl_imb,penilai,tgl_taksasi,tinggal,cabang,no_ktp,ibu_kandung,jabatan,memo_appraisal,plafond_dimohon,nama_emergency,telp_emergency,alamat_kantor,hubungan,progress,sales,hp_sales,kjpp,status,tgl_update_app,tgl_update_los,tgl_update_asc,skim_pencairan,input_date,no_covernote,no_covernote_n,no_pengikatan_n,tgl_penyerahan_berkas,proses_pengikatan,jenis_sertifikat,jenis_proyek,kategori_proyek,total_unitdibangun,penguasaan_sertifikat,no_rek_escrow,cair_tahap_fondasi,tgl_cair_tahap_fondasi,ket_cair_tahap_fondasi,cair_tahap_topping,tgl_cair_tahap_topping,ket_cair_tahap_topping,cair_tahap_bast,tgl_cair_tahap_bast,ket_cair_tahap_bast,cair_tahap_dok,tgl_cair_tahap_dok,ket_cair_tahap_dok,proses_agunan,no_polis_ass_kerugian_n,berkas_asuransi_kerugian,no_polis_ass_jiwa_n,berkas_assuransi_jiwa,no_jaminan_fleksi,no_jaminan_fleksi_n,jns_jaminan_fleksi,srt_pernyataan_fleksi,no_bpkb_n,tgl_serah,pelunasan_penerima,pelunasan_keterangan,siup_n,tdp_n,no_pks,tgl_pengikatan,others_n,kjpp_flag,no_ajb_n,jml_jaminan_n,userupdate,insertfrom,no_trail) values("; for ($col = 1; $col <= 156; $col++) { $value = $data->val($row, $col); $sql .= "'" . $value . "',"; } $sql = substr($sql, 0, strlen($sql) - 1); $sql .= ")"; $pesan = $db_function->exec($sql); if ($pesan != "") { $_SESSION['colateral']['message_loop'][] = "[insrt debitur trail]no_rekg_pinjaman->" . $data->val($row, 7) . ":" . $pesan; } } }
<?php //session_start(); //không đặt session start ở đây thì gán biến session vẫn ko báo lỗi nhưng ko lưu lại giá trị được. //$cont=$_POST['cont']; //if ($cont=='cont'){ // define('_DO_EXC',true); //} require '../../../donghq.php'; require HOMEPATH . 'libs/db_functions.php'; CONNECT_DB(); $tbl_name = 'user'; // Table name // username and password sent from form - user clean function to protect MySQL injection $myusername = cleanstr($_POST['user']); $mypassword = cleanstr($_POST['pass']); //echo $myusername." :: ".$mypassword;//exit(); $sql = "SELECT enable FROM {$tbl_name} WHERE username='******' and password='******'"; $result = mysql_query($sql); // Mysql_num_row is counting table row $count = mysql_num_rows($result); //echo $count;exit(); // If result matched $myusername and $mypassword, table row must be 1 row if ($count == 1) { //kiểm tra sự tồn tại của user $enable = (int) GET_DB_VALUE($sql, 'enable'); //kiểm tra xem user có bị disable không if ($enable == 1) { // Register $myusername, $mypassword and redirect to file "login_success.php" //session_start(); //session_register("name"); //session_register("myusername");
$email = $_POST["email"]; if (!is_valid_id($userid)) { show_error_msg(T_("EDITING_FAILED"), T_("INVALID_USERID"), 1); } if (!validemail($email)) { show_error_msg(T_("EDITING_FAILED"), T_("EMAIL_ADDRESS_NOT_VALID"), 1); } if ($avatar != null) { # Allowed Image Extenstions. $allowed_types =& $site_config["allowed_image_types"]; # We force http:// if (!preg_match("#^\\w+://#i", $avatar)) { $avatar = "http://" . $avatar; } # Clean Avatar Path. $avatar = cleanstr($avatar); # Validate Image. $im = @getimagesize($avatar); if (!$im[2] || !@array_key_exists($im['mime'], $allowed_types)) { show_error_msg("Error", "The avatar url was determined to be of a invalid nature.", 1); } } # Save New Avatar. $avatar = sqlesc($avatar); //change user class $res = SQL_Query_exec("SELECT class FROM users WHERE id={$userid}"); $arr = mysql_fetch_row($res); $uc = $arr[0]; // skip if class is same as current if ($uc != $class && $class > 0) { if ($userid == $CURUSER["id"]) {
</td> <td> <table class="tbllayout" > <tr> <td class="w180">CIF</td><td class="w300"> <?php echo ht_input("cif"); ?> </td> </tr> <tr> <td>Norek Pinjaman <span class="red">*)</span></td><td> <?php echo ht_input("no_rekg_pinjaman", "", "hidden"); ?> <?php echo cleanstr($_POST['frm']['no_rekg_pinjaman']); ?> </td> </tr> <tr> <td>Norek Afiliasi</td><td> <?php echo ht_input("afiliasi"); ?> </td> </tr> <tr> <td>Kode Cabang</td><td> <?php echo ht_input("cabang"); ?> </td>
function process_edit_page($user, $theid) { //SET THE RETURN CODE TO SUCCESS, AND THE ID $ret_code = array(1, $theid); //GRAB ALL THE INFORMATION FROM THE POST ACTION $title = stripslashes($_REQUEST['title']); //STRING SHOULD ALLREADY BE CLEAN FROM JAVASCRIPT, BUT JUST IN CASE CLEAN IT WITH PHP $file_title = rtrim(stripslashes(cleanstr($_REQUEST['file_title']))); $template = stripslashes($_REQUEST['template']); $parent_page = $_REQUEST['parent_page']; $old_parent_page = $_REQUEST['old_parent_page']; $old_title = rtrim(stripslashes(cleanstr($_REQUEST['old_title']))); $block_count = $_REQUEST['block_count']; //CREATE A UNIX TIMESTAMP $stamp = time(); $date = gmdate("Y-m-d H:i:s", $stamp); //LOAD UP OUR TEMPLATE AND STICK THE USER DATA IN IT $sql = "SELECT * FROM " . $this->config->db_prefix . "_block_template WHERE id = {$template}"; $results = $this->db->DB_Q_C($sql); $row = mysql_fetch_array($results); $template_body = $this->strip_attributes($row['body'], "block", array()); //REMOVE ALL BLOCKS IN OUR LIST $sql = "DELETE FROM " . $this->config->db_prefix . "_block_list WHERE page_id = {$theid}"; $results = $this->db->DB_Q_C($sql); //CREATE ALL OF OUR CONTENT BLOCKS $replacements = array(); $pattern = array(); for ($i = 0; $i < $block_count; $i++) { $name = "text_block_" . $i; $block_id = $_REQUEST[$name]; //INSERT INTO OUR LIST $sql = "INSERT INTO " . $this->config->db_prefix . "_block_list(block_id, page_id, template_block_id) \n\n \t\t\t\t\t VALUES('{$block_id}', '{$theid}', '{$i}')"; $results = $this->db->DB_Q_C($sql); //GRAB THE CONTENT OF THIS BLOCK $sql = "SELECT * FROM " . $this->config->db_prefix . "_block_content WHERE id = {$block_id}"; $results = $this->db->DB_Q_C($sql); $row = mysql_fetch_array($results); // $pattern[$i] = "/<block>(.|\\s)*?<\\/block>/"; $replacements[$i] = stripslashes($row['body']); } //SET UP OUR FILE INFO //SPECIAL CASE FOR OUR MAIN INDEX PAGE if ($theid == 1) { //REPLACE OUR [TITLE] KEYWORD $template_body = str_replace("[TITLE]", $title, $template_body); //REPLACE OUR [DEPTH] KEYWORD $retval = ""; $template_body = str_replace("[DEPTH]", $retval, $template_body); // $file_data = preg_replace($pattern, $replacements, $template_body, 1); //CREATE THE INDEX PAGE $file = "../index.php"; if (!($handle = fopen($file, 'w+'))) { //display error message, since this function is called with a header, the page will not display correctly echo "Cannot open file ({$file})"; exit; } if (fwrite($handle, $file_data) === FALSE) { //display error message, since this function is called with a header, the page will not display correctly echo "Cannot write to file ({$file})"; exit; } fclose($handle); } else { //CONSTRUCT THE FILEPATH $tmp_array = explode("/", $this->getParentName($parent_page)); $depth = 0; for ($i = count($tmp_array) - 2; $i >= 0; $i--) { $tmp_path .= $tmp_array[$i] . "/"; $depth++; } $file_path = "../{$tmp_path}{$file_title}"; $file = "{$file_path}/index.php"; //REPLACE OUR [TITLE] KEYWORD $template_body = str_replace("[TITLE]", $title, $template_body); //REPLACE OUR [DEPTH] KEYWORD $retval = ""; for ($i = 0; $i <= $depth; $i++) { $retval .= "../"; } $template_body = str_replace("[DEPTH]", $retval, $template_body); // $file_data = preg_replace($pattern, $replacements, $template_body, 1); //CONSTRUCT THE FILEPATH $tmp_path = ""; $tmp_array = explode("/", $this->getParentName($old_parent_page)); for ($i = count($tmp_array) - 2; $i >= 0; $i--) { $tmp_path .= $tmp_array[$i] . "/"; } $old_file_path = "../{$tmp_path}{$old_title}"; $old_file = "{$old_file_path}/index.php"; //RENAME IF THE TITLE HAS CHANGED, OR IF THE FOLDER HAS BEEN MOVED if ($old_title != $file_title || $old_parent_page != $parent_page) { rename($old_file_path, $file_path); } //CREATE THE INDEX PAGE if (!($handle = fopen($file, 'w+'))) { //display error message, since this function is called with a header, the page will not display correctly echo "Cannot open file ({$file})"; exit; } if (fwrite($handle, $file_data) === FALSE) { //display error message, since this function is called with a header, the page will not display correctly echo "Cannot write to file ({$file})"; exit; } fclose($handle); } //UPDATE OUR PAGE OBJECT $sql = "UPDATE " . $this->config->db_prefix . "_block_page\n\n SET title = \"{$title}\", file_title = '{$file_title}', template_id = '{$template}', parent_id = '{$parent_page}'\n\n WHERE id = {$theid}"; $results = $this->db->DB_Q_C($sql); //STORE OUR OBJECT $sql = "INSERT INTO `" . $this->config->db_prefix . "_object` (create_date, create_who) VALUES ('{$date}', 1);"; $results = $this->db->DB_Q_C($sql); $object_id = mysql_insert_id(); //STORE OUR LOG INFO $sql = "INSERT INTO `" . $this->config->db_prefix . "_logs` (object_id, user_id, module_id, sub_module_id, record_id, action) VALUES ({$object_id}, {$user->user_id}, {$this->id}, 2, {$theid}, 2)"; $results = $this->db->DB_Q_C($sql); return $ret_code; }
:</b> <input type="text" size="40" name="username" /></td></tr> <tr><td align="center"><b><?php echo T_("PASSWORD"); ?> :</b> <input type="password" size="40" name="password" /></td></tr> <tr><td colspan="2" align="center"><input type="submit" value="<?php echo T_("LOGIN"); ?> " /><br /><br /><i><?php echo T_("COOKIES"); ?> </i></td></tr> </table> <?php if (!empty($_REQUEST["returnto"])) { print "<input type=\"hidden\" name=\"returnto\" value=\"" . cleanstr($_REQUEST["returnto"]) . "\" />\n"; } ?> </form> <p align="center"><a href="account-signup.php"><?php echo T_("SIGNUP"); ?> </a> | <a href="account-recover.php"><?php echo T_("RECOVER_ACCOUNT"); ?> </a></p> <?php end_frame(); stdfoot();
<?php session_start(); //không đặt session start ở đây thì gán biến session vẫn ko báo lỗi nhưng ko lưu lại giá trị được. require '../../../../donghq.php'; require HOMEPATH . 'libs/db_functions.php'; require HOMEPATH . 'libs/common_functions.php'; CONNECT_DB(); $myusername = cleanstr($_REQUEST['user']); $activity = isset($_REQUEST["status"]) ? $_REQUEST["status"] : 2; if ($activity == '') { $activity = 2; } //$activity=0; //$time_now=strtotime(date("m/d/Y H:i:s")); $time_now = time(); $sql = "INSERT INTO userlogs (username, activities, time) VALUES ('{$myusername}',{$activity},{$time_now})"; $result = mysql_query($sql); if ($result) { echo 'Ban da thoat khoi ung dung '; } else { echo 'ERROR'; } //sleep(55);
function json_nomor_aplikasi() { $db_function = new db_function(); $dataprint = array('status' => 'gagal'); $noaplikasi = $_GET['noaplikasi']; if (strlen($noaplikasi) == 20) { $buf['tgl'] = substr($noaplikasi, 0, 8); $buf['program_kd'] = substr($noaplikasi, 8, 2); $buf['cab_kd'] = substr($noaplikasi, 10, 5); $program_kd = $buf['program_kd']; $cab_kd = $buf['cab_kd']; $inputdate = substr($buf['tgl'], 0, 2) . "-" . substr($buf['tgl'], 2, 2) . "-" . substr($buf['tgl'], 4, 4); $lnc = cleanstr($db_function->selectOnefield("select singkatan from master_cab where cab_kd='" . $buf['cab_kd'] . "'")); $buf = $db_function->selectOneRows("select prog.program_nm,prod.produk_kd,prod.produk_nm from master_program prog \n left join master_produk prod on prog.produk_kd=prod.produk_kd\n where prog.program_kd='" . $buf['program_kd'] . "'\n "); $produk_kd = ""; $program = ""; $produk = ""; if (!empty($buf)) { $produk = $buf['produk_nm']; $program = $buf['program_nm']; $produk_kd = $buf['produk_kd']; } $ListProgram = getlistProgram($produk); if ($produk != "") { $dataprint = array('status' => 'sukses', 'listProgram' => $ListProgram, 'field' => array('produk' => $produk, 'program' => $program, 'inputdate' => $inputdate, 'lnc' => $lnc)); } } echo json_encode($dataprint); exit; }