WooYun.org

if (function_exists('get_magic_quotes_gpc'))
{
	if (@get_magic_quotes_gpc()) // GPC 进行反向处理
	{
		if (! function_exists('stripslashes_gpc'))
		{
			function stripslashes_gpc(&$value)
			{
				$value = stripslashes($value);
			}
		}

public function quote($string)
	{
		if (is_object($this->db()))
		{
			//下面return有点意思的，我们去踪$this->db()->quote($string)，俩个quote是不一样，不要以为是递归，不然溢出了
			return trim($this->db()->quote($string), "'");
		}
		
		if (function_exists('mysql_escape_string'))
		{
			$string = @mysql_escape_string($string);
		}
		else
		{
			$string = addslashes($string);
		}
		return $string;
	}

public function quote($value, $type = null)
    {
        $this->_connect();
        if ($value instanceof Zend_Db_Select) {
            return '(' . $value->assemble() . ')';
        }
        if ($value instanceof Zend_Db_Expr) {
            return $value->__toString();
        }
        if (is_array($value)) {
            foreach ($value as &$val) {
                $val = $this->quote($val, $type);
            }
            return implode(', ', $value);
        }
        if ($type !== null && array_key_exists($type = strtoupper($type), $this->_numericDataTypes)) {
            $quotedValue = '0';
            switch ($this->_numericDataTypes[$type]) {
                case Zend_Db::INT_TYPE: // 32-bit integer
                    $quotedValue = (string) intval($value);
                    break;
                case Zend_Db::BIGINT_TYPE: // 64-bit integer
                    // ANSI SQL-style hex literals (e.g. x'[\dA-F]+')
                    // are not supported here, because these are string
                    // literals, not numeric literals.
                    if (preg_match('/^(
                          [+-]?                  # optional sign
                          (?:
                            0[Xx][\da-fA-F]+     # ODBC-style hexadecimal
                            |\d+                 # decimal or octal, or MySQL ZEROFILL decimal
                            (?:[eE][+-]?\d+)?    # optional exponent on decimals or octals
                          )
                        )/x',
                        (string) $value, $matches)) {
                        $quotedValue = $matches[1];
                    }
                    break;
                case Zend_Db::FLOAT_TYPE: // float or decimal
                    $quotedValue = sprintf('%F', $value);
            }
            return $quotedValue;
        }
        return $this->_quote($value);
    }

protected function _quote($value)
    {
        if (is_int($value)) {
            return $value;
        } elseif (is_float($value)) {
            return sprintf('%F', $value);
        }
        return "'" . addcslashes($value, "\000\n\r\\'\"\032") . "'";
    }