1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
<?php
/*
# Copyright (C) 2013-2015 Chaoyi Zha
# Polr is an open-source project licensed under the GPL.
# The above copyright notice and the following license are applicable to
# the entire project, unless explicitly defined otherwise.
# http://github.com/cydrobolt/polr
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or (at
# your option) any later version.
# See http://www.gnu.org/copyleft/gpl.html for the full text of the
# license.
#
*/
@(require_once('config.php'));
include('version.php');
$debug = 0; // Set to 1 in order to enable debug mode (shows sensitive database info), use for troubleshooting
$footer = "© Copyright 2014 $wsn. Powered by <a href='http://github.com/cydrobolt/polr'>Polr</a> ver $version build $reldate";
$hidefooter = true; // Let's hide this for now
//connect to mysql with $mysqli variable
$mysqli = new mysqli($host, $user, $passwd, $db) ;
if ($mysqli->connect_errno) {
echo "Database error. If you are a member of the general public, contact an administrator to solve this issue.
If you are the administrator of this website, please make sure your database is turned on and that credentials are correct.";
die();
}
// Attempt to set Charset as UTF8 to avoid real_escape_string vulnerabilities
if (!$mysqli->set_charset("utf8")) {
$insecure = true;
} else {
$insecure = false;
}
function autoloader($class) {
include $class . '.php';
}
spl_autoload_register('autoloader');
session_start();
function sqlex($table, $rowf, $where, $wval) {
global $mysqli;
//Sanitize strings
$rowfs = $mysqli->real_escape_string($rowf);
$tables = $mysqli->real_escape_string($table);
$wheres = $mysqli->real_escape_string($where);
$wvals = $mysqli->real_escape_string($wval);
$q2p = "SELECT {$rowfs} FROM {$tables} WHERE {$wheres}=?";
$stmt = $mysqli->prepare($q2p);
$stmt->bind_param('s', $wvals);
$stmt->execute();
$result = $stmt->get_result();
$numrows = $result->num_rows;
if (!$numrows) {
return false;
} else {
return true;
}
}
function sqlfetch($table, $rowf, $where, $wval) {
global $mysqli;
$rowfs = $mysqli->real_escape_string($rowf);
$tables = $mysqli->real_escape_string($table);
$wheres = $mysqli->real_escape_string($where);
$wvals = $mysqli->real_escape_string($wval);
//$query = "SELECT $rowfs FROM $tables WHERE $wheres='$wvals'";
$q2p = "SELECT {$rowfs} FROM {$tables} WHERE {$wheres}=?";
$stmt = $mysqli->prepare($q2p);
$stmt->bind_param('s', $wvals);
$stmt->execute();
$result = $stmt->get_result();
$row = mysqli_fetch_assoc($result);
return $row[$rowf];
}
//SQL Functions
//Sanitize input when using sqlrun!
function sqlrun($query) {
global $mysqli;
$queryrs = $query;
$resultrs = $mysqli->query($queryrs) or ($err = $mysqli->error);
if (strstr($err, "already exists")) {
echo "<br />Could not create tables because the database already has Polr tables (perhaps from a previous installation?). If you wanted a clean install, delete the existing Polr table and try again. Otherwise, your existing database may be used. ";
die();
}
return true;
}
function showerror() {
//Show an error, and die. If Debug is on, show SQL error message
global $debug;
global $mysqli;
echo "There seems to be a problem. Contact an administrator to report this issue.";
if ($debug == 1) {
echo "<br>Error:<br>";
echo $mysqli->error;
}
die();
}
function filterurl($url) {
if (!filter_var($url, FILTER_VALIDATE_URL, FILTER_FLAG_HOST_REQUIRED)) {
return false;
} else {
return true;
}
}
function filteremail($email) {
// Validate an email
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
return false;
} else {
return true;
}
}
|
