新装了个dzx，忽然想起来服务器上是php5.4.10。禁用且不支持*_magic_quotes_*函数。想看看dzx是怎么做的。翻了翻代码。没有发现addslashes。然后提取了dzx的过滤函数。share一下。没什么用。可以看看。
所有函数定义，均在/source/class/discuz/discuz_database.php
db类定义在/source/class/class_core.php最下方 function quote($str, $noarray = false) { if (is_string($str)) return '\'' . addcslashes($str, \n\r\\'\\032) . '\''; if (is_int($str) or is_float($str)) return '\'' . $str . '\''; if (is_array($str)) { if($noarray === false) { foreach ($str as &$v) { $v = self::quote($v, true); } return $str; } else { return '\'\''; } } if (is_bool($str)) return $str ? '1' : '0'; return '\'\'';}
复制代码
function quote_field($field) { if (is_array($field)) { foreach ($field as $k => $v) { $field[$k] = self::quote_field($v); } } else { if (strpos($field, '`') !== false) $field = str_replace('`', '', $field); $field = '`' . $field . '`'; } return $field;}
复制代码
function format($sql, $arg) { $count = substr_count($sql, '%'); if (!$count) { return $sql; } elseif ($count > count($arg)) { throw new dbexception('sql string format error! this sql need ' . $count . ' vars to replace into.', 0, $sql); } $len = strlen($sql); $i = $find = 0; $ret = ''; while ($i if ($sql{$i} == '%') { $next = $sql{$i + 1}; if ($next == 't') { $ret .= self::table($arg[$find]); } elseif ($next == 's') { $ret .= self::quote(is_array($arg[$find]) ? serialize($arg[$find]) : (string) $arg[$find]); } elseif ($next == 'f') { $ret .= sprintf('%f', $arg[$find]); } elseif ($next == 'd') { $ret .= dintval($arg[$find]); } elseif ($next == 'i') { $ret .= $arg[$find]; } elseif ($next == 'n') { if (!empty($arg[$find])) { $ret .= is_array($arg[$find]) ? implode(',', self::quote($arg[$find])) : self::quote($arg[$find]); } else { $ret .= '0'; } } else { $ret .= self::quote($arg[$find]); } $i++; $find++; } else { $ret .= $sql{$i}; } $i++; } if ($i $ret .= substr($sql, $i); } return $ret;}}
复制代码