3v4l.org

run code in 300+ PHP versions simultaneously
<?php /** * 安全地执行SQL语句. * * 该函数会将所有参数经过安全地转义, 用来替换SQL命令中的占位符, 最后送至服务器进行执行. * * 占位符是 %s , 如果需要在SQL命令中包含百分号, 请连写两个百分号. * * @param resource $conn 由 mysql_connect() 建立的MySQL数据库连接资源 * @param string $sql SQL语句, 可以包含占位符 * @param mixed $more... 用来替换占位符的参数 * * @return resource 该函数会返回 mysql_query() 的返回值. */ function safeSQL($conn,$sql,$more=NULL) { $args=func_get_args(); array_shift($args); array_shift($args); $offset=0; foreach($args as $i) { if(preg_match("/%([tT])/",$sql,$result,PREG_OFFSET_CAPTURE,$offset)) { $fStr=$result[1][0]; $pos=$result[1][1]; $tPos=$pos-1; while($sql[$pos]=="%") $tPos--; if(!(($pos-$tPos)%2)) continue; $value=mysql_real_escape_string($value,$conn); $sql=substr($sql,0,$pos-1) . $value . substr($sql,$pos+1); $offset=$pos + 1; } } $sql=str_replace("%%", "%", $sql); echo $sql."\n"; } safeSQL(0,"SELECT * FROM `user`"); safeSQL(0,"SELECT * FROM `user` WHERE `uname`='%s'","jybox"); safeSQL(0,"UPDATE `%s` SET `email`='%t' WHERE `uname`='%s'","user","m@jybox.net","jybox"); safeSQL(0,"SELECT * FROM `user` WHERE `uname` LIKE ='%%%s%%'","jybox"); safeSQL(0,"SELECT * FROM `user`");
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/JvcRZ
function name:  (null)
number of ops:  26
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   50     0  E >   INIT_FCALL                                               'safesql'
          1        SEND_VAL                                                 0
          2        SEND_VAL                                                 'SELECT+%2A+FROM+%60user%60'
          3        DO_FCALL                                      0          
   51     4        INIT_FCALL                                               'safesql'
          5        SEND_VAL                                                 0
          6        SEND_VAL                                                 'SELECT+%2A+FROM+%60user%60+WHERE+%60uname%60%3D%27%25s%27'
          7        SEND_VAL                                                 'jybox'
          8        DO_FCALL                                      0          
   52     9        INIT_FCALL                                               'safesql'
         10        SEND_VAL                                                 0
         11        SEND_VAL                                                 'UPDATE+%60%25s%60+SET+%60email%60%3D%27%25t%27+WHERE+%60uname%60%3D%27%25s%27'
         12        SEND_VAL                                                 'user'
         13        SEND_VAL                                                 'm%40jybox.net'
         14        SEND_VAL                                                 'jybox'
         15        DO_FCALL                                      0          
   53    16        INIT_FCALL                                               'safesql'
         17        SEND_VAL                                                 0
         18        SEND_VAL                                                 'SELECT+%2A+FROM+%60user%60+WHERE+%60uname%60+LIKE+%3D%27%25%25%25s%25%25%27'
         19        SEND_VAL                                                 'jybox'
         20        DO_FCALL                                      0          
   54    21        INIT_FCALL                                               'safesql'
         22        SEND_VAL                                                 0
         23        SEND_VAL                                                 'SELECT+%2A+FROM+%60user%60'
         24        DO_FCALL                                      0          
         25      > RETURN                                                   1

Function safesql:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 13, Position 2 = 62
Branch analysis from position: 13
2 jumps found. (Code = 78) Position 1 = 14, Position 2 = 62
Branch analysis from position: 14
2 jumps found. (Code = 43) Position 1 = 22, Position 2 = 61
Branch analysis from position: 22
1 jumps found. (Code = 42) Position 1 = 32
Branch analysis from position: 32
2 jumps found. (Code = 44) Position 1 = 35, Position 2 = 31
Branch analysis from position: 35
2 jumps found. (Code = 43) Position 1 = 39, Position 2 = 40
Branch analysis from position: 39
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
Branch analysis from position: 40
1 jumps found. (Code = 42) Position 1 = 13
Branch analysis from position: 13
Branch analysis from position: 31
2 jumps found. (Code = 44) Position 1 = 35, Position 2 = 31
Branch analysis from position: 35
Branch analysis from position: 31
Branch analysis from position: 61
Branch analysis from position: 62
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 62
filename:       /in/JvcRZ
function name:  safeSQL
number of ops:  72
compiled vars:  !0 = $conn, !1 = $sql, !2 = $more, !3 = $args, !4 = $offset, !5 = $i, !6 = $result, !7 = $fStr, !8 = $pos, !9 = $tPos, !10 = $value
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   16     0  E >   RECV                                             !0      
          1        RECV                                             !1      
          2        RECV_INIT                                        !2      null
   18     3        FUNC_GET_ARGS                                    ~11     
          4        ASSIGN                                                   !3, ~11
   19     5        INIT_FCALL                                               'array_shift'
          6        SEND_REF                                                 !3
          7        DO_ICALL                                                 
   20     8        INIT_FCALL                                               'array_shift'
          9        SEND_REF                                                 !3
         10        DO_ICALL                                                 
   22    11        ASSIGN                                                   !4, 0
   23    12      > FE_RESET_R                                       $16     !3, ->62
         13    > > FE_FETCH_R                                               $16, !5, ->62
   25    14    >   INIT_FCALL                                               'preg_match'
         15        SEND_VAL                                                 '%2F%25%28%5BtT%5D%29%2F'
         16        SEND_VAR                                                 !1
         17        SEND_REF                                                 !6
         18        SEND_VAL                                                 256
         19        SEND_VAR                                                 !4
         20        DO_ICALL                                         $17     
         21      > JMPZ                                                     $17, ->61
   27    22    >   FETCH_DIM_R                                      ~18     !6, 1
         23        FETCH_DIM_R                                      ~19     ~18, 0
         24        ASSIGN                                                   !7, ~19
   28    25        FETCH_DIM_R                                      ~21     !6, 1
         26        FETCH_DIM_R                                      ~22     ~21, 1
         27        ASSIGN                                                   !8, ~22
   30    28        SUB                                              ~24     !8, 1
         29        ASSIGN                                                   !9, ~24
   31    30      > JMP                                                      ->32
   32    31    >   PRE_DEC                                                  !9
   31    32    >   FETCH_DIM_R                                      ~27     !1, !8
         33        IS_EQUAL                                                 ~27, '%25'
         34      > JMPNZ                                                    ~28, ->31
   34    35    >   SUB                                              ~29     !8, !9
         36        MOD                                              ~30     ~29, 2
         37        BOOL_NOT                                         ~31     ~30
         38      > JMPZ                                                     ~31, ->40
   35    39    > > JMP                                                      ->13
   37    40    >   INIT_FCALL_BY_NAME                                       'mysql_real_escape_string'
         41        SEND_VAR_EX                                              !10
         42        SEND_VAR_EX                                              !0
         43        DO_FCALL                                      0  $32     
         44        ASSIGN                                                   !10, $32
   39    45        INIT_FCALL                                               'substr'
         46        SEND_VAR                                                 !1
         47        SEND_VAL                                                 0
         48        SUB                                              ~34     !8, 1
         49        SEND_VAL                                                 ~34
         50        DO_ICALL                                         $35     
         51        CONCAT                                           ~36     $35, !10
         52        INIT_FCALL                                               'substr'
         53        SEND_VAR                                                 !1
         54        ADD                                              ~37     !8, 1
         55        SEND_VAL                                                 ~37
         56        DO_ICALL                                         $38     
         57        CONCAT                                           ~39     ~36, $38
         58        ASSIGN                                                   !1, ~39
   41    59        ADD                                              ~41     !8, 1
         60        ASSIGN                                                   !4, ~41
   23    61    > > JMP                                                      ->13
         62    >   FE_FREE                                                  $16
   45    63        INIT_FCALL                                               'str_replace'
         64        SEND_VAL                                                 '%25%25'
         65        SEND_VAL                                                 '%25'
         66        SEND_VAR                                                 !1
         67        DO_ICALL                                         $43     
         68        ASSIGN                                                   !1, $43
   47    69        CONCAT                                           ~45     !1, '%0A'
         70        ECHO                                                     ~45
   48    71      > RETURN                                                   null

End of function safesql

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
160.56 ms | 1407 KiB | 26 Q