require_once __DIR__ . "/../../vendor/htmlpurifier/library/HTMLPurifier.auto.php";
function vdv_prepare_query($parameters) {
$query = $parameters["query"];
$db = $parameters["db"];
$stmt = $db->prepare($query);
$sqlStatement = strtok($query, " ");
if (strtoupper(trim($sqlStatement)) == "SELECT") {
return $stmt;
}
return new VdvPdoExecuter($stmt, $parameters);
}
function bindArrayParameters($stmt, $values, $prefix = "arrayBind") {
if (!is_array($values)) {
$values = explode(",", $values);
}
foreach ($values as $key => $value) {
$keyName = ":" . $prefix . $key;
$stmt->bindValue($keyName, $value);
}
}
function createBoundParameters($arrayValues, $prefix = "arrayBind") {
if (!is_array($arrayValues)) {
$arrayValues = explode(",", $arrayValues);
}
$arrayBinder = [];
foreach ($arrayValues as $key => $value) {
$temp = ":" . $prefix . $key;
array_push($arrayBinder, $temp);
}
return implode(",", $arrayBinder);
}
class VdvPdoExecuter {
private $stmt;
private $purify;
private $skipEscape;
private $config;
public function __construct($stmt, array $parameters = array()) {
$this->stmt = $stmt;
$this->purify = $parameters["purify"] ?? [];
$this->skipEscape = $parameters["skipEscape"] ?? [];
$this->config = \HTMLPurifier_Config::createDefault();
}
public function allowIframe() {
$iframeRegex = "%^.*%";
$this->config->set("HTML.SafeIframe", true);
$this->config->set("URI.SafeIframeRegexp", $iframeRegex);
}
public function allowImage() {
$this->config->set("URI.AllowedSchemes", array("a.href" => true, "http" => true, "https" => true, "data" => true, "news" => true, "mailto" => true, "tel" => true));
$this->config->set("CSS.AllowedFonts", null);
}
public function allowLink() {
$this->config->set("URI.AllowedSchemes", array("a.href" => true, "http" => true, "https" => true, "data" => true, "news" => true, "mailto" => true, "tel" => true));
$this->config->set("CSS.AllowedFonts", null);
$this->config->set("Attr.AllowedFrameTargets", array("_blank", "_parent"));
}
public function setOptions($options) {
foreach ($options as $key => $option) {
$this->setOption($option);
}
}
public function setOption($option) {
switch ($option) {
case "allowLink": $this->allowLink();
break;
case "allowIframe": $this->allowIframe();
break;
case "allowImage": $this->allowImage();
break;
default: break;
}
}
public function execute($parameters = null, $extraBinding = null) {
if (is_array($parameters)) {
$parameters = $this->sanitizeParameterStrings($parameters);
}
return $this->stmt->execute($parameters);
}
public function rowCount() {
return $this->stmt->rowCount();
}
public function columnCount() {
return $this->stmt->columnCount();
}
public function errorInfo() {
return $this->stmt->errorInfo();
}
public function setFetchMode($mode, $params = NULL) {
return $this->stmt->setFetchMode($mode, $params);
}
public function fetch($how = NULL, $orientation = PDO::FETCH_ORI_NEXT, $offset = 0) {
return $this->stmt->fetch($how, $orientation, $offset);
}
public function fetchAll($how = NULL, $class_name = NULL, $ctor_args = NULL) {
if ($class_name == null && $how == null) {
return $this->stmt->fetchAll();
}
if ($class_name == null && $how != null) {
return $this->stmt->fetchAll($how);
}
return $this->stmt->fetchAll($how, $class_name, $ctor_args);
}
public function bindValue($paramno, $param, $type = NULL) {
if ($type == NULL) {
return $this->stmt->bindValue($paramno, $param);
}
return $this->stmt->bindValue($paramno, $param, $type);
}
public function bindParam($paramno, &$param, $type = NULL, $maxlen = NULL, $driverdata = NULL) {
if ($type == NULL && $maxlen == NULL && $driverdata == NULL) {
return $this->stmt->bindParam($paramno, $param);
}
return $this->stmt->bindParam($paramno, $param, $type, $maxlen, $driverdata);
}
private function sanitizeParameterStrings($parameters) {
$purifier = new \HTMLPurifier($this->config);
foreach ($parameters as $key => &$param) {
if (!is_numeric($param) && !is_array($param) && $param !== null && !in_array($key, $this->skipEscape)) {
if (in_array($key, $this->purify)) {
$param = $purifier->purify($param);
}
else {
$param = htmlspecialchars($param, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML401, null, false);
}
}
}
return $parameters;
}
}
© 2023 Quttera Ltd. All rights reserved.