fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-27 22:33:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

merge with 1.4.5.7

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.0@8356 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
ovclas 2011-05-06 02:42:14 +00:00
parent 25d2f6af1e
commit b5d2e05282
12 changed files with 48 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

9
classes/db/DB.class.php
View file

@ -693,5 +693,14 @@
return $arr;
}
/**
* @brief Just like numbers, and operations needed to remove the rest
**/
function _filterNumber(&$value)
{
$value = preg_replace('/[^\d\w\+\-\*\/\.\(\)]/', '', $value);
if(!$value) $value = 0;
}
}
?>

8
classes/db/DBCubrid.class.php
View file

@ -678,9 +678,7 @@
}
}
}
elseif (!$value || is_numeric ($value)) {
$value = (int) $value;
}
else $this->_filterNumber(&$value);
$column_list[] = '"'.$name.'"';
$value_list[] = $value;
@ -733,9 +731,7 @@
$check_column = false;
$value = "'".$this->addQuotes ($value)."'";
}
elseif (!$value || is_numeric ($value)) {
$value = (int) $value;
}
else $this->_filterNumber(&$value);
$column_list[] = sprintf ("\"%s\" = %s", $name, $value);
}

3
classes/db/DBFirebird.class.php
View file

@ -688,7 +688,8 @@
}
else if($output->column_type[$name]!='number') {
// if(!$value) $value = 'null';
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
else $this->_filterNumber(&$value);
$column_list[] = '"'.$name.'"';
$value_list[] = $value;

5
classes/db/DBMssql.class.php
View file

@ -547,6 +547,8 @@
} elseif(!$value){
$value = '';
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = '['.$name.']';
$value_list[] = '?';
@ -591,10 +593,9 @@
$column_list[] = sprintf("[%s] = ?", $name);
}else{
if(!$value) $value = '';
$this->_filterNumber(&$value);
$column_list[] = sprintf("[%s] = %s", $name, $value);
}
}
}
// List the conditional clause

6
classes/db/DBMysql.class.php
View file

@ -443,7 +443,9 @@
}
}
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
//elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = '`'.$name.'`';
$value_list[] = $value;
@ -473,7 +475,7 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = sprintf("`%s` = %s", $name, $value);
}

10
classes/db/DBPostgresql.class.php
View file

@ -566,8 +566,10 @@ class DBPostgresql extends DB
$value = "'" . $this->addQuotes($value) . "'";
if (!$value)
$value = 'null';
} elseif (!$value || is_numeric($value))
$value = (int)$value;
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
// elseif (!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = $name;
$value_list[] = $value;
@ -599,8 +601,8 @@ class DBPostgresql extends DB
else {
if ($output->column_type[$name] != 'number')
$value = "'" . $this->addQuotes($value) . "'";
elseif (!$value || is_numeric($value))
$value = (int)$value;
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}

8
classes/db/DBSqlite2.class.php
View file

@ -422,7 +422,10 @@
if($output->column_type[$name]!='number') {
$value = "'".$this->addQuotes($value)."'";
if(!$value) $value = 'null';
} elseif(!$value || is_numeric($value)) $value = (int)$value;
}
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
// elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = $name;
$value_list[] = $value;
@ -450,7 +453,8 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
// sql injection 문제로 xml 선언이 number인 경우이면서 넘어온 값이 숫자형이 아니면 숫자형으로 강제 형변환
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}

4
classes/db/DBSqlite3_pdo.class.php
View file

@ -460,7 +460,7 @@
if($output->column_type[$name]!='number') $val_list[] = $this->addQuotes($value);
else {
if(!$value || is_numeric($value)) $value = (int)$value;
$this->_filterNumber(&$value);
$val_list[] = $value;
}
@ -495,7 +495,7 @@
if(strpos($name,'.')!==false&&strpos($value,'.')!==false) $column_list[] = $name.' = '.$value;
else {
if($output->column_type[$name]!='number') $value = "'".$this->addQuotes($value)."'";
elseif(!$value || is_numeric($value)) $value = (int)$value;
else $this->_filterNumber(&$value);
$column_list[] = sprintf("%s = %s", $name, $value);
}