multi_latest

latest.lib.php 추가

 

function latest_multi($skin_dir='', $bo_table_multy, $rows=10, $subject_len=40)

{

    global $g5;

      

      $findMulti = stripos($bo_table_multy,"|");

      if($findMulti){

            $tableExp = explode("|", $bo_table_multy);

      }

    if (!$skin_dir) $skin_dir = 'basic';

    if(preg_match('#^theme/(.+)$#', $skin_dir, $match)) {

        if (G5_IS_MOBILE) {

            $latest_skin_path = G5_THEME_MOBILE_PATH.'/'.G5_SKIN_DIR.'/latest/'.$match[1];

            if(!is_dir($latest_skin_path))

                $latest_skin_path = G5_THEME_PATH.'/'.G5_SKIN_DIR.'/latest/'.$match[1];

            $latest_skin_url = str_replace(G5_PATH, G5_URL, $latest_skin_path);

        } else {

            $latest_skin_path = G5_THEME_PATH.'/'.G5_SKIN_DIR.'/latest/'.$match[1];

            $latest_skin_url = str_replace(G5_PATH, G5_URL, $latest_skin_path);

        }

        $skin_dir = $match[1];

    } else {

        if(G5_IS_MOBILE) {

            $latest_skin_path = G5_MOBILE_PATH.'/'.G5_SKIN_DIR.'/latest/'.$skin_dir;

            $latest_skin_url  = G5_MOBILE_URL.'/'.G5_SKIN_DIR.'/latest/'.$skin_dir;

        } else {

            $latest_skin_path = G5_SKIN_PATH.'/latest/'.$skin_dir;

            $latest_skin_url  = G5_SKIN_URL.'/latest/'.$skin_dir;

        }

    }

      for($i=0; $i<count($tableExp); $i++){

          if($i==0){

              $union = "(SELECT `wr_id`, `wr_subject`, `wr_datetime`, '{$tableExp[$i]}' as 'bo_table' FROM `g5_write_{$tableExp[$i]}` where `wr_is_comment`!='1')";

          }else{

              $union .= "UNION ALL (SELECT `wr_id`, `wr_subject`, `wr_datetime`, '{$tableExp[$i]}' as 'bo_table' FROM `g5_write_{$tableExp[$i]}` where `wr_is_comment`!='1')";

          }

      }

      $union .=" order by `wr_datetime` DESC LIMIT 0,{$rows};";

      

      $aa = sql_query2_multi($union);

      $i=0;

      while($aabb = sql_fetch_array($aa)){

          $list[$i]['wr_id'] = $aabb['wr_id'];

          $list[$i]['subject'] = $aabb['wr_subject'];

          $list[$i]['subject'] = mb_substr($list[$i]['subject'],0,$subject_len,"utf-8");

          $list[$i]['wr_subject'] = $aabb['wr_subject'];

          $list[$i]['bo_table'] = $aabb['bo_table'];

          $list[$i]['href'] = "/bbs/board.php?bo_table={$aabb['bo_table']}&wr_id={$aabb['wr_id']}";

          $i++;

      }

 

      ob_start();

    include $latest_skin_path.'/latest.skin.php';

    $content = ob_get_contents();

      ob_end_clean();

      return $content;

}

function sql_query2_multi($sql, $error=G5_DISPLAY_SQL_ERROR, $link=null)

{

    global $g5;

   

    if(!$link)

        $link = $g5['connect_db'];

       

        // Blind SQL Injection 취약점 해결

        $sql = trim($sql);

        // union의 사용을 허락하지 않습니다.

        //$sql = preg_replace("#^select.*from.*union.*#i", "select 1", $sql);

        //$sql = preg_replace("#^select.*from.*[\s\(]+union[\s\)]+.*#i ", "select 1", $sql);

        // `information_schema` DB로의 접근을 허락하지 않습니다.

        $sql = preg_replace("#^select.*from.*where.*`?information_schema`?.*#i", "select 1", $sql);

       

        if(function_exists('mysqli_query') && G5_MYSQLI_USE) {

            if ($error) {

                $result = @mysqli_query($link, $sql) or die("<p>$sql<p>" . mysqli_errno($link) . " : " .  mysqli_error($link) . "<p>error file : {$_SERVER['SCRIPT_NAME']}");

            } else {

                $result = @mysqli_query($link, $sql);

            }

        } else {

            if ($error) {

                $result = @mysql_query($sql, $link) or die("<p>$sql<p>" . mysql_errno() . " : " .  mysql_error() . "<p>error file : {$_SERVER['SCRIPT_NAME']}");

            } else {

                $result = @mysql_query($sql, $link);

            }

        }

       

        return $result;

}