OpencachingDeutschland /
oc-server3
| @@ 291-328 (lines=38) @@ | ||
| 288 | $filtered_sql .= mb_substr($sql, $sqlpos, $nextarg - $sqlpos); |
|
| 289 | $sqlpos = $nextarg + $arglength; |
|
| 290 | ||
| 291 | if (isset($args[$arg])) { |
|
| 292 | if (is_numeric($args[$arg])) { |
|
| 293 | $filtered_sql .= $args[$arg]; |
|
| 294 | } else { |
|
| 295 | if ((mb_substr($sql, $sqlpos - $arglength - 1, 1) == '\'') && |
|
| 296 | (mb_substr($sql, $sqlpos + 1, 1) == '\'') |
|
| 297 | ) { |
|
| 298 | $filtered_sql .= sql_escape($args[$arg]); |
|
| 299 | } elseif ((mb_substr($sql, $sqlpos - $arglength - 1, 1) == '`') && |
|
| 300 | (mb_substr($sql, $sqlpos + 1, 1) == '`') |
|
| 301 | ) { |
|
| 302 | $filtered_sql .= sql_escape($args[$arg]); |
|
| 303 | } else { |
|
| 304 | sql_error(); |
|
| 305 | } |
|
| 306 | } |
|
| 307 | } else { |
|
| 308 | // NULL |
|
| 309 | if ((mb_substr($sql, $sqlpos - $arglength - 1, 1) == '\'') && |
|
| 310 | (mb_substr($sql, $sqlpos + 1, 1) == '\'') |
|
| 311 | ) { |
|
| 312 | // Anführungszeichen weg machen und NULL einsetzen |
|
| 313 | $filtered_sql = mb_substr($filtered_sql, 0, mb_strlen($filtered_sql) - 1); |
|
| 314 | $filtered_sql .= 'NULL'; |
|
| 315 | $sqlpos++; |
|
| 316 | } else { |
|
| 317 | $filtered_sql .= 'NULL'; |
|
| 318 | } |
|
| 319 | } |
|
| 320 | ||
| 321 | $sqlpos++; |
|
| 322 | } else { |
|
| 323 | $arglength = 0; |
|
| 324 | $arg = ''; |
|
| 325 | ||
| 326 | // nächstes Zeichen das kein Buchstabe/Zahl ist herausfinden |
|
| 327 | while (mb_ereg_match('^[a-zA-Z0-9]{1}', $nextchar) == 1) { |
|
| 328 | $arg .= $nextchar; |
|
| 329 | ||
| 330 | $arglength++; |
|
| 331 | $nextchar = mb_substr($sql, $nextarg + $arglength + 1, 1); |
|
| @@ 200-222 (lines=23) @@ | ||
| 197 | $filtered_sql .= substr($sql, $sqlpos, $nextarg - $sqlpos); |
|
| 198 | $sqlpos = $nextarg + $arglength; |
|
| 199 | ||
| 200 | if (isset($args[$arg])) { |
|
| 201 | if (is_numeric($args[$arg])) { |
|
| 202 | $filtered_sql .= $args[$arg]; |
|
| 203 | } else { |
|
| 204 | if ((substr($sql, $sqlpos - $arglength - 1, 1) == '\'') && (substr( |
|
| 205 | $sql, |
|
| 206 | $sqlpos + 1, |
|
| 207 | 1 |
|
| 208 | ) == '\'')) { |
|
| 209 | $filtered_sql .= sql_escape($args[$arg]); |
|
| 210 | } elseif ((substr($sql, $sqlpos - $arglength - 1, 1) == '`') && (substr( |
|
| 211 | $sql, |
|
| 212 | $sqlpos + 1, |
|
| 213 | 1 |
|
| 214 | ) == '`')) { |
|
| 215 | $filtered_sql .= sql_escape_backtick($args[$arg]); |
|
| 216 | } else { |
|
| 217 | sql_error($sql); |
|
| 218 | } |
|
| 219 | } |
|
| 220 | } else { |
|
| 221 | // NULL |
|
| 222 | if ((substr($sql, $sqlpos - $arglength - 1, 1) == '\'') && (substr($sql, $sqlpos + 1, 1) == '\'')) { |
|
| 223 | // strip apostroph and insert NULL |
|
| 224 | $filtered_sql = substr($filtered_sql, 0, strlen($filtered_sql) - 1); |
|
| 225 | $filtered_sql .= 'NULL'; |
|
