tooldbobjects.php

一款基于PHP的网络日记程序。WikyBlog支持：多用户的 BLOG

<?php
defined('WikyBlog') or die("Not an entry point...");

if( $_SESSION['userlevel'] !== 4){
	$page->contentA[$page->displayTitle] = 'You must be an administrator to access this page.';
	return;
}

class toolDbObjects{

	function edit($name){
		global $wbTables;
		
		$query = 'SELECT `data` FROM '.$wbTables['ad_objects'].' WHERE `selector` = "class:'. wbDB::escape($name) .'" LIMIT 1;';
		$result = wbDB::runQuery($query);
		$row = mysql_fetch_assoc($result);
		if( !$row ){
			message('Invalid database entry.');
			return;
		}
		
		message('<strong>Warning:</strong> Be very careful when editing the following php code.');
		echo '<input type="hidden" name="name" value="'.$name.'" />';
		echo '<textarea name="code" style="width:100%" wrap="soft" rows="'.$_SESSION['textareaY'].'">';
		echo htmlspecialchars($row['data']);
		
		echo '</textarea>';
		echo '<input type="submit" name="cmd" value="Save Changes" />';
		echo ' &nbsp; <input type="submit" name="cmd" value="Cancel" />';
	}
	
	function saveChanges(){
		global $wbTables;
		
		$testCode = $_POST['code'].'$TEST="hello";';
		eval($testCode);
		if( $TEST !== "hello"){
			message('<strong>Warning:</strong> Your PHP code did not evaluate.');
			return;
		}
		
		$query = 'UPDATE '.$wbTables['ad_objects'].' SET ';
		$query .= ' `data` = "'.wbDB::escape($_POST['code']).'" ';
		$query .= ' WHERE `selector` = "class:'. wbDB::escape($_POST['name']) .'" LIMIT 1;';
		if( wbDB::runQuery($query) ){
			message('Your php code was updated.');
		}else{
			message('<strong>Warning:</strong> There was an error updating your php code.');
		}
	}
	
}