=?|LIKE)\s*(.+)/', $searchTerms, $matches)) { if (!preg_match('/^([\w\.\_]+)\s+(IN)\s+(.+)/', $searchTerms, $matches)) { return false; } } $field = $matches[1]; $operator = $matches[2]; $rest = $matches[3]; $term = ''; $inQuotes = false; $inParenthesis = 0; $escaped = false; while ($rest != '') { $ch = substr($rest, 0, 1); $rest = substr($rest, 1); if ($escaped) { $escaped = false; $term .= $ch; continue; } if ($ch == '\\') { $escaped = true; continue; } if ($ch == "'") { $inQuotes = !$inQuotes; continue; } if ($ch == '(') { ++$inParenthesis; } elseif ($ch == ')') { if (--$inParenthesis < 0) { die('Unbalanced parenthesis'); } } if ($ch == ' ' && !$inQuotes && $inParenthesis == 0) break; $term .= $ch; } if ($inParenthesis > 0) { die('Unbalanced parenthesis'); } if (substr($rest, 0, 4) == 'AND ') { $boolean = ' AND '; $searchTerms = substr($rest, 4); } elseif (substr($rest, 0, 3) == 'OR ') { $boolean = ' OR '; $searchTerms = substr($rest, 3); } else { $boolean = ''; $searchTerms = ''; } return $term != ''; } function createWhereClause($astrSearchFields, $strSearchTerms, &$arrQueryParams, $leftAnchored = false) { $astrTerms = explode(" ", $strSearchTerms); $strWhereClause = "("; $termPrefix = $leftAnchored ? '' : '%'; for( $i = 0; $i < count($astrTerms); $i++ ) { if ($astrTerms[$i]) { $strWhereClause .= '('; for( $j = 0; $j < count($astrSearchFields); $j++ ) { if( $astrSearchFields[$j]['type'] == "TEXT" ) { $strWhereClause .= $astrSearchFields[$j]['name'] . " LIKE ? OR "; $arrQueryParams[] = $termPrefix . $astrTerms[$i] . '%'; } elseif( $astrSearchFields[$j]['type'] == "INT" && preg_match ("/^([0-9]+)$/", $astrTerms[$i]) ) { $strWhereClause .= $astrSearchFields[$j]['name'] . " = ?" . " OR "; $arrQueryParams[] = $astrTerms[$i]; } elseif( $astrSearchFields[$j]['type'] == "PRIMARY" && preg_match ("/^([0-9]+)$/", $intID) ) { $strWhereClause = "WHERE ". $astrSearchFields[$j]['name']. " = ? "; $arrQueryParams = array($intID); unset($astrSearchFields); break 2; } } $strWhereClause = substr( $strWhereClause, 0, -3) . ") AND "; } } $strWhereClause = substr( $strWhereClause, 0, -4) . ')'; return $strWhereClause; } function mysql_query_check($query, $noFail=false) { $query = str_replace('{prefix}', _DB_PREFIX_ . '_', $query); $startTime = microtime(true); $intRes = mysql_query($query); if (defined('_SQL_DEBUG_')) { error_log('QUERY [' . round(microtime(true) - $startTime, 4) . "s]: $query"); } if ($intRes === FALSE) { $intError = mysql_errno(); if (strlen($query) > 1024) $query = substr($query, 0, 1024) . '[' . (strlen($query) - 1024) . ' more characters]'; error_log("Query '$query' failed: ($intError) " . mysql_error()); if (!$noFail) { header('HTTP/1.1 500 Internal Server Error'); if (!defined('_DB_VERBOSE_ERRORS_') || !_DB_VERBOSE_ERRORS_) die($GLOBALS['locDBError']); die(htmlspecialchars("Query '$query' failed: ($intError) " . mysql_error())); } } return $intRes; } function mysql_param_query($query, $params=false, $noFail=false) { if ($params) { foreach ($params as &$v) { if (is_null($v)) $v = 'NULL'; elseif (is_array($v)) { $t = ''; foreach ($v as $v2) { if ($t) $t .= ','; $v2 = mysql_real_escape_string($v2); if (!is_numeric($v2) || (strlen(trim($v2)) > 0 && substr(trim($v2), 0, 1) == '0')) { if (substr(trim($v2), 0, 1 != '(')) { $v2 = "'$v2'"; } } $t .= $v2; } $v = $t; } else { $v = mysql_real_escape_string($v); if (!is_numeric($v) || (strlen(trim($v)) > 1 && substr(trim($v), 0, 1) == '0')) { if (substr(trim($v), 0, 1) != '(') { $v = "'$v'"; } } } } $sql_query = vsprintf(str_replace("?","%s",$query), $params); return mysql_query_check($sql_query, $noFail); } return mysql_query_check($query); } function mysql_fetch_value($result) { $row = mysql_fetch_row($result); return $row[0]; } function mysql_fetch_prefixed_assoc($result) { if (!($row = mysql_fetch_row($result))) return null; $assoc = Array(); $columns = mysql_num_fields($result); for ($i = 0; $i < $columns; $i++) { $table = mysql_field_table($result, $i); $field = mysql_field_name($result, $i); if (substr($table, 0, strlen(_DB_PREFIX_) + 1) == _DB_PREFIX_ . '_') $assoc[$field] = $row[$i]; else $assoc["$table.$field"] = $row[$i]; } return $assoc; } function create_db_dump() { $in_tables = array('invoice_state', 'row_type', 'company_type', 'base', 'delivery_terms', 'delivery_method', 'company', 'company_contact', 'product', 'session_type', 'users', 'invoice', 'invoice_row', 'quicksearch', 'settings', 'session', 'print_template', 'state'); $filename = 'mlinvoice_backup_' . date('Ymd') . '.sql'; header('Content-type: text/x-sql'); header("Content-Disposition: attachment; filename=\"$filename\""); if (_CHARSET_ == 'UTF-8') echo("SET NAMES 'utf8';\n\n"); $tables = array(); foreach ($in_tables as $table) { $tables[] = _DB_PREFIX_ . "_$table"; } $res = mysql_query_check("SHOW TABLES LIKE '" . _DB_PREFIX_ . "_%'"); while ($row = mysql_fetch_row($res)) { if (!in_array($row[0], $tables)) { error_log("Adding unlisted table $row[0] to export"); $tables[] = $row[0]; } } foreach ($tables as $table) { $res = mysql_query_check("show create table $table"); $row = mysql_fetch_assoc($res); if (!$row) die("Could not read table definition for table $table"); echo $row['Create Table'] . ";\n\n"; $res = mysql_query_check("show fields from $table"); $field_count = mysql_num_rows($res); $field_defs = array(); $columns = ''; while ($row = mysql_fetch_assoc($res)) { $field_defs[] = $row; if ($columns) $columns .= ', '; $columns .= $row['Field']; } // Don't dump current sessions if ($table == _DB_PREFIX_ . '_session') continue; $res = mysql_query_check("select * from $table"); while ($row = mysql_fetch_row($res)) { echo "INSERT INTO `$table` ($columns) VALUES ("; for ($i = 0; $i < $field_count; $i++) { if ($i > 0) echo ', '; $value = $row[$i]; $type = $field_defs[$i]['Type']; if (is_null($value)) echo 'null'; elseif (substr($type, 0, 3) == 'int' || substr($type, 0, 7) == 'decimal') echo $value; elseif ($value && ($type == 'longblob' || strpos($value, "\n"))) echo '0x' . bin2hex($value); else echo '\'' . addslashes($value) . '\''; } echo ");\n"; } echo "\n"; } } function table_valid($table) { $tables = array(); $res = mysql_query_check('SHOW TABLES'); while ($row = mysql_fetch_row($res)) { $tables[] = $row[0]; } return in_array(_DB_PREFIX_ . "_$table", $tables); } /** * Verify database status and upgrade as necessary. * Expects all pre-1.6.0 changes to have been already made. * * @return string status (OK|UPGRADED|FAILED) */ function verifyDatabase() { $res = mysql_query_check("SHOW TABLES LIKE '{prefix}state'"); if (mysql_num_rows($res) == 0) { $res = mysql_query_check(<<