数据库sql语句过滤函数
@param $input 输入字符串
@return string
189114
public static function toDbString($input)
    {
        if(is_array($input)){
            foreach ($input as $key=>$value){
                $input[$key]=self::toDbString($value);
            }
        }else if(is_object($input)){
            $array=get_object_vars($input);
            foreach ($array as $key=>$value){
                $input->$key=self::toDbString($value);
            }
        }else{
            //$input=str_replace("'","&#039;",$input);	//替換單引號
            $input=str_replace("'","''",$input);
        }

        return $input;
    }
293203
public static function extractCreateQuery(&$input) {
		// To do on Edit
		static::onEdit($input, null);
		
		foreach( $input as $fieldname => $fieldvalue ) {
			if( !in_array($fieldname, static::$fields) ) {
				unset($input[$fieldname]);
			}
		}
		
		$options = array(
			'table' => static::$table,
			'what'  => $input,
		);
		return $options;
	}
1320280
public function parse_sql( $data = null ) {

		if ( ! empty( $data ) ) {
			$this->input = $data;
		}

		$this->parsed = $data;

		return $this->parsed;
	}
1065363
private function parseFields($input)
    {
        if (is_array($input)) {
            return $input;
        }

        $fields = [];
        foreach (explode(' ', $input) as $value) {
            $elements = explode(':', $value);
            $name = $elements[0];
            if (strlen($name)) {
                $type = isset($elements[1]) ? $elements[1] : 'string';
                preg_match_all('/(.*)\((.*)\)/', $type, $matches);
                $type = isset($matches[1][0]) ? $matches[1][0] : $type;
                $length = isset($matches[2][0]) ? $matches[2][0] : null;

                $fields[$name] = ['fieldName' => $name, 'type' => $type, 'length' => $length];
            }
        }

        return $fields;
    }
1209496
private function createQuery(): string
    {
        // 已经直接传递了SQL,Prepare与SQL相同
        $this->prepare = $this->sql;

        // 查找其中的表名
        $this->tables = $this->db->getNameFromQuery($this->sql);

        return $this->prepare;
    }
1094496
public static function escapeSqlWords($input)
    {
        if (! $input) {
            return $input;
        }

        $escapeFunction = function ($value) {
            return '`' . preg_replace('/[^A-Za-z0-9_]+/', '', $value) . '`';
        };

        if (is_array($input)) {
            return array_map($escapeFunction, $input);
        }
        return $escapeFunction($input);
    }
313236
function _query($sql,$inputarr=false)
	{
		if (is_array($inputarr)) {
			$i = 0;
			if (is_array($sql)) {
				foreach($inputarr as $v) {
					$arr['bind'.$i++] = $v;
				}
			} else {
				// Need to identify if the ? is inside a quoted string, and if
				// so not use it as a bind variable
				preg_match_all('/".*\??"|\'.*\?.*?\'/', $sql, $matches);
				foreach($matches[0] as $qmMatch){
					$qmReplace = str_replace('?', '-QUESTIONMARK-', $qmMatch);
					$sql = str_replace($qmMatch, $qmReplace, $sql);
				}

				// Replace parameters if any were found
				$sqlarr = explode('?',$sql);
				if(count($sqlarr) > 1) {
					$sql = $sqlarr[0];

					foreach ($inputarr as $k => $v) {
						$sql .= ":$k" . $sqlarr[++$i];
					}
				}

				$sql = str_replace('-QUESTIONMARK-', '?', $sql);
			}
		}
		return ADODB_oci8::_query($sql,$inputarr);
	}
225157
function _query($sql,$inputarr=false)
  {
  GLOBAL $php_errormsg;
    if (isset($php_errormsg)) $php_errormsg = '';
    $this->_error = '';

                if ($inputarr) {
      if (is_array($sql)) {
        $stmtid = $sql[1];
      } else {
        $stmtid = ads_prepare($this->_connectionID,$sql);

        if ($stmtid == false) {
          $this->_errorMsg = isset($php_errormsg) ? $php_errormsg : '';
          return false;
        }
      }

      if (! ads_execute($stmtid,$inputarr)) {
        //@ads_free_result($stmtid);
        if ($this->_haserrorfunctions) {
          $this->_errorMsg = ads_errormsg();
          $this->_errorCode = ads_error();
        }
        return false;
      }

    } else if (is_array($sql)) {
      $stmtid = $sql[1];
      if (!ads_execute($stmtid)) {
        //@ads_free_result($stmtid);
        if ($this->_haserrorfunctions) {
          $this->_errorMsg = ads_errormsg();
          $this->_errorCode = ads_error();
        }
        return false;
      }
    } else
                        {

      $stmtid = ads_exec($this->_connectionID,$sql);

                        }

                $this->_lastAffectedRows = 0;

    if ($stmtid)
                {

      if (@ads_num_fields($stmtid) == 0) {
        $this->_lastAffectedRows = ads_num_rows($stmtid);
        $stmtid = true;

      } else {

        $this->_lastAffectedRows = 0;
        ads_binmode($stmtid,$this->binmode);
        ads_longreadlen($stmtid,$this->maxblobsize);

      }

      if ($this->_haserrorfunctions)
                        {

        $this->_errorMsg = '';
        $this->_errorCode = 0;
      }
                        else
        $this->_errorMsg = isset($php_errormsg) ? $php_errormsg : '';
    }
                else
                {
      if ($this->_haserrorfunctions) {
        $this->_errorMsg = ads_errormsg();
        $this->_errorCode = ads_error();
      } else
        $this->_errorMsg = isset($php_errormsg) ? $php_errormsg : '';
    }

    return $stmtid;

  }
421882
public static function ucFirst($input): string
    {
        $string = Str::low($input);
        $string = ucfirst($string);

        return $string;
    }
936960
private function select() {
        $this->performed  = true;
        $this->resultSet  = [];
        $this->resultSets = [];
        $this->resultIdx  = 0;
        $this->maxIdx     = 0;
        $this->size       = 0;
        try {
            $this->checkDialect();
        } catch (DialectException $e) {
            $this->error = $e->getMessage();

            return;
        }
        //生成SQL
        if (!$this->sql) {
            $this->sql = $this->getSQL();
            if (!$this->sql) {
                $this->error       = 'can not generate the SQL';
                $this->errorSQL    = '';
                $this->errorValues = $this->values->__toString();

                return;
            }
            //重新生成SQL.
            $this->statement = null;
        }
        //生成prepare statement
        if (!$this->statement) {
            $this->prepareStatement();
        }
        //执行
        if ($this->statement) {
            try {
                if ($this->values) {
                    foreach ($this->values as $value) {
                        list ($name, $val, $type, $field, $rkey) = $value;
                        if ($this->whereData) {
                            $val = isset($this->whereData[ $rkey ]) ? $this->whereData[ $rkey ] : (isset($this->whereData[ $name ]) ? $this->whereData[ $name ] : $val);
                        }
                        if (!$this->statement->bindValue($name, $val, $type)) {
                            $this->errorSQL    = $this->sql;
                            $this->errorValues = $this->values->__toString();
                            $this->error       = 'can not bind the value ' . $val . '[' . $type . '] to the argument:' . $name . '(' . $field . ')';

                            return;
                        }
                    }
                }
                $rst = $this->statement->execute();
                QueryBuilder::addSqlCount();
                if ($rst) {
                    $this->resultSets = $this->statement->fetchAll(\PDO::FETCH_ASSOC);
                    $this->size       = count($this->resultSets);
                    if ($this->size > 0) {
                        $this->maxIdx    = $this->size - 1;
                        $this->resultSet = $this->resultSets[0];
                    }
                } else {
                    $this->dumpSQL($this->statement);
                }
            } catch (\PDOException $e) {
                $this->exception   = $e;
                $this->error       = $e->getMessage();
                $this->errorSQL    = $this->sql;
                $this->errorValues = $this->values->__toString();
            }
        }
    }
768711
public static function unXSS($input)
    {
        $return = '';
        if (version_compare(phpversion(), '5.4', '<')) {
            $return = htmlspecialchars($input);
        } else {
            $return = htmlentities($input, ENT_QUOTES | ENT_DISALLOWED | static::$outputLanguage);
        }

        return $return;
    }
204448
public function getEndedStatements($input) {

        if (is_array($input)) {
            foreach ($input as $key=>$content) {
                $input[$key] = $this->getEndedStatements($content);
            }
            return $input;
        } else {
            $input = trim($input).$this->statement_end;
            return $input;
        }
    }
1198092
public function create( $inputs = [] )
	{
		$columns = [];
		$placeholders = [];
		$values = [];

		foreach( $inputs as $column => $value )
		{
			$columns []= "`$column`";
			$placeholders []= ":$column";
			$values[":$column"] = $value;
		}

		$keys = implode(',', $columns);
		$placeholders = implode(',', $placeholders);

		$this->_exec_( "INSERT INTO `{$this->table}` ( $keys ) VALUES ( $placeholders )", $values );

		return $this->insert_id();
	}
1317404
public static function convert($input = STDIN)
    {
        $stream = fopen('php://temp', 'rw');

        foreach ($_SERVER as $key => $value) {
            if (0 === strpos($key, 'HTTP_')) {
                $key = str_replace('_', '-', strtolower(substr($key, 5)));
                fwrite($stream, "$key: $value\r\n");
            } elseif (in_array($key, ['CONTENT_LENGTH', 'CONTENT_MD5', 'CONTENT_TYPE'])) {
                $key = str_replace('_', '-', strtolower($key));
                fwrite($stream, "$key: $value\r\n");
            }
        }

        fwrite($stream, "\r\n");

        stream_copy_to_stream($input, $stream);

        rewind($stream);

        return new StreamedPart($stream);
    }
654307
public function query($sql)
    {
        if (true == Config::get('sql_log')) {
            wlog('SQL-Log', $sql);
        }

        // Prepare one MySQL client connect
        $isFromPool = $this->prepareDB();

        try {
            $rs = $this->db->query($sql);
        } catch (\Exception $e) {
            // echo 'error:'. $e->getCode() . $e->getMessage();
            // 如果发生了mysqli::query(): MySQL server has gone away，直接抛出异常，
            // 需要捕获后，重新reconnect
        }

        if ( !empty($rs) ) {
            $GLOBALS['__$DB_QUERY_COUNT']++;
        } else if($this->db->errno == 2006 || $this->db->errno == 2013) {
            // Catch database pool long running
            // 2013 Lost connection to MySQL server during query
            // 2006 MySQL server has gone away
            try {
                $this->reconnect();
            } catch (\Exception $e) {
                DBPool::init($this->db_config)->cap--;
                DBPool::init($this->db_config)->activeCount--;
                \throw_error('DB_ERROR: ' . $this->db->error . "\nRAW_SQL: " . $sql, $this->db->errno);
            }

            $GLOBALS['__$DB_QUERY_COUNT']++;
            $rs = $this->db->query($sql);
        } else {
            DBPool::init($this->db_config)->cap--;
            DBPool::init($this->db_config)->activeCount--;
            \throw_error('DB_ERROR: ' . $this->db->error . "\nRAW_SQL: " . $sql, $this->db->errno);
        }

        // Put db connction to pool
        // If it is new client, queue in, else put pool client back
        if ($isFromPool) {
            DBPool::init($this->db_config)->back($this->db);
        } else {
            DBPool::init($this->db_config)->in($this->db);
        }

        // echo 'db_config='. $this->db_config;
        // echo 'activeCount='. (DBPool::init($this->db_config)->activeCount);
        // echo ',cap='. (DBPool::init($this->db_config)->cap);
        // var_dump(DBPool::init($this->db_config)->queue);

        return $rs;
    }
795061
private static function _prepareQuestionString($input)
    {
        $regex = '';
        if (is_array($input) === true) {
            $regex = '^';
            $start = true;
            foreach ($input as $row) {
                if ($start === false) {
                    $regex .= '|';
                }

                $start  = false;
                $regex .= '(';
                $one    = null;
                if (strlen($row) > 2) {
                    $one = true;
                }

                foreach (str_split($row, 1) as $char) {
                    $regex .= '[' . $char;
                    $regex .= strtoupper($char) . ']';
                    if ($one === true) {
                        $one    = false;
                        $regex .= '(';
                    }
                }

                if ($one === false) {
                    $regex .= ')';
                }

                $regex .= '?)';
            }
        }

        return $regex;
    }
812149
private function stringToUtf($input)
    {
        if (is_array($input)) {
            $temp = array();
            foreach ($input as $key => $value) {
                $temp[$this->stringToUtf($key)] = $this->stringToUtf($value);
            }
            $input = $temp;
        } elseif (is_string($input)) {
            $input = iconv('iso-8859-15', 'utf-8', $input);
        }

        return $input;
    }