fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-21 20:29:57 +09:00
Code Issues Projects Releases Packages Wiki Activity

merge 1.4.5.7

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/trunk@8398 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
devjin 2011-05-27 06:03:31 +00:00
parent e6e93c40a9
commit 92332c8ebb
12 changed files with 286 additions and 270 deletions
Download patch file Download diff file Expand all files Collapse all files

9
classes/db/DB.class.php
View file

@ -694,5 +694,14 @@
return $arr;
}
/**
* @brief Just like numbers, and operations needed to remove the rest
**/
function _filterNumber(&$value)
{
$value = preg_replace('/[^\d\w\+\-\*\/\.\(\)]/', '', $value);
if(!$value) $value = 0;
}
}
?>

8
classes/db/DBCubrid.class.php
View file

@ -679,9 +679,7 @@
}
}
}
elseif (!$value || is_numeric ($value)) {
$value = (int) $value;
}
else $this->_filterNumber(&$value);
$column_list[] = '"'.$name.'"';
$value_list[] = $value;
@ -734,9 +732,7 @@
$check_column = false;
$value = "'".$this->addQuotes ($value)."'";
}
elseif (!$value || is_numeric ($value)) {
$value = (int) $value;
}
else $this->_filterNumber(&$value);
$column_list[] = sprintf ("\"%s\" = %s", $name, $value);
}

3
classes/db/DBFirebird.class.php
View file

@ -706,7 +706,8 @@
}
else if($output->column_type[$name]!='number') {
// if(!$value) $value = 'null';
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
else $this->_filterNumber(&$value);
$column_list[] = '"'.$name.'"';
$value_list[] = $value;

5
classes/db/DBMssql.class.php
View file

@ -548,6 +548,8 @@
} elseif(!$value){
$value = '';
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = '['.$name.']';
$value_list[] = '?';
@ -591,10 +593,9 @@
$column_list[] = sprintf("[%s] = ?", $name);
}else{
if(!$value) $value = '';
$this->_filterNumber(&$value);
$column_list[] = sprintf("[%s] = %s", $name, $value);
}
}
}

6
classes/db/DBMysql.class.php
View file

@ -455,7 +455,9 @@
}
}
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
//elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = '`'.$name.'`';
$value_list[] = $value;
@ -482,7 +484,7 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = sprintf("`%s` = %s", $name, $value);
}

10
classes/db/DBPostgresql.class.php
View file

@ -581,8 +581,10 @@ class DBPostgresql extends DB
$value = "'" . $this->addQuotes($value) . "'";
if (!$value)
$value = 'null';
} elseif (!$value || is_numeric($value))
$value = (int)$value;
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
// elseif (!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = $name;
$value_list[] = $value;
@ -615,8 +617,8 @@ class DBPostgresql extends DB
else {
if ($output->column_type[$name] != 'number')
$value = "'" . $this->addQuotes($value) . "'";
elseif (!$value || is_numeric($value))
$value = (int)$value;
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}

8
classes/db/DBSqlite2.class.php
View file

@ -430,7 +430,10 @@
if($output->column_type[$name]!='number') {
$value = "'".$this->addQuotes($value)."'";
if(!$value) $value = 'null';
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
// elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = $name;
$value_list[] = $value;
@ -460,7 +463,8 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}

4
classes/db/DBSqlite3_pdo.class.php
View file

@ -462,7 +462,7 @@
if($output->column_type[$name]!='number') $val_list[] = $this->addQuotes($value);
else {
if(!$value || is_numeric($value)) $value = (int)$value;
$this->_filterNumber(&$value);
$val_list[] = $value;
}
@ -499,7 +499,7 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}