function escape_nickname($t)
{
    $t = preg_replace("/[^a-zA-Z0-9-\\[\\]\\*\\ \\+=\\._\\|]/", "", $t);
    $t = substr($t, 0, 15);
    $t = escape($t, 'string');
    return $t;
}

function login($dirty_email, $dirty_password)
{
    $email = escape($dirty_email);
    $password = escape($dirty_password);
    if (!validate_email($email)) {
        echo "login-invalid-email";
        return;
    }
    if (!validate_password($password)) {
        echo "login-invalid-password";
        return;
    }
    $account_id = account_id_from_email($email);
    if ($account_id == -1) {
        echo "DEBUG: email or password invalid";
        return;
    }
    if (correct_password($account_id, $password) == false) {
        echo "DEBUG: email or password invalid";
        return;
    }
    session_regenerate_id();
    fresh_logon($account_id);
    $username = username_from_account_id($account_id);
    setcookie('LOGGED_IN', $username, time() + 3600);
    echo "login-success";
}

function pingWeblogs($name, $url, $server)
{
    global $Paths;
    if (strpos($server, "http://") === false) {
        $server = "http://" . $server;
    }
    $server = parse_url($server);
    if ($server['path'] == "") {
        $server['path'] = "/";
    }
    if ($server['port'] == "") {
        $server['port'] = "80";
    }
    printf("<p><b>%s:%s%s</b>:<br />", $server['host'], $server['port'], $server['path']);
    flush();
    $client = new xmlrpc_client($server['path'], $server['host'], $server['port']);
    $message = new xmlrpcmsg("weblogUpdates.ping", array(new xmlrpcval($name), new xmlrpcval($url)));
    $result = $client->send($message);
    if (!$result || $result->faultCode()) {
        echo "<br />Pivot says: could not send ping. Check if you set the server address correctly, or else the server may be temporarily down. This happens sometimes, and if this error occurs out of the blue, it's likely that it will go away in a few hours or days. <br /></p>";
        echo "<!-- \n";
        print_r($result);
        echo "\n -->\n\n\n";
        return false;
    }
    $msg = $result->serialize();
    $msg = preg_replace('#.*<name>message</name>[^<]*<value>(.*?)</value>.*#si', '$1', $msg);
    // Stripping off any tags in the message value - typically the string element
    $msg = strip_tags($msg);
    $msg = escape($msg);
    echo "Server said: <i>'{$msg}'</i><br /></p>";
    return true;
}

 public function login()
 {
     if (strtoupper($_SERVER['REQUEST_METHOD']) == 'POST') {
         if (strtolower($_SESSION['validCode']) != strtolower(trim($_POST['validCode']))) {
             //记录日志
             $logInfo['success'] = 0;
             $logInfo['password'] = '';
             $user_loginlog_db->insert($logInfo);
             //echo SITE_NAME.':验证码输入错误，<a href="login.php?user='.$_POST['email'].'">返回重新登录</a>';
             echo '<script>window.location.href=\'?user=' . $_POST['email'] . '&error=errorcode\';</script>';
             exit;
         } else {
             $userObj = bpBase::loadAppCLass('userObj', 'user');
             $rt = $userObj->adminLoginWithEmail($_POST['email'], $_POST['password']);
             if ($rt > 0) {
                 //记录日志
                 $logInfo['success'] = 1;
                 $logInfo['password'] = '';
                 $user_loginlog_db->insert($logInfo);
                 //
                 if (!isah()) {
                     $thisUser = $userObj->getUserByUID($rt);
                     setcookie('jsusername', escape($thisUser->username), SYS_TIME + 2592000, '/', DOMAIN_ROOT);
                     $r = setcookie('autousername', $thisUser->username, SYS_TIME + 2592000, '/', DOMAIN_ROOT);
                 } else {
                     if (isset($_COOKIE['jsusername'])) {
                         setcookie('jsusername', '', 0);
                         setcookie('jsusername', '', 0, '/', DOMAIN_ROOT);
                         setcookie('jsusername', '', 0, '/', $_SERVER['HTTP_HOST']);
                     }
                 }
                 delCache('rigthsOf' . $rt);
                 delCache('citysOf' . $rt);
                 $_SESSION['autoAdminUid'] = $rt;
                 //session_regenerate_id();
                 $_SESSION['cmsuid'] = $rt;
                 //session_regenerate_id();
                 //echo '<span style="font-size:12px;">登录成功，正在转向...如果您的浏览器不能自动跳转，<a href="index.php" style="font-size:12px;">请点击</a>';
                 echo '<script>window.location.href=\'index.php\';</script></span>';
                 exit;
             } else {
                 //记录日志
                 $logInfo['success'] = 0;
                 $user_loginlog_db->insert($logInfo);
                 //
                 $_SESSION['autoAdminUid'] = null;
                 unset($_SESSION['autoAdminUid']);
                 //echo SITE_NAME.':登录失败，<a href="login.php?user='.$_POST['email'].'">返回重新登录</a>';
                 echo '<script>window.location.href=\'?user=' . $_POST['email'] . '&error=notmatch\';</script>';
                 exit;
             }
         }
     } else {
         $m = empty($m) ? ROUTE_MODEL : $m;
         if (empty($m)) {
             return false;
         }
         include ABS_PATH . MANAGE_DIR . DIRECTORY_SEPARATOR . 'modules' . DIRECTORY_SEPARATOR . $m . DIRECTORY_SEPARATOR . 'templates' . DIRECTORY_SEPARATOR . 'login.tpl.php';
     }
 }

/**
 * Removes HTML tags & encodes HTML entities.
 *
 * @param string $string_
 * @param string $ignoreTags_
 * @param string $charset_
 * @param bool $escape_
 * @param integer $type_
 *
 * @return string
 */
function strip($string_, $ignoreTags_ = null, $charset_ = null, $escape_ = true, $type_ = ENT_XHTML, $flags_ = ENT_QUOTES)
{
    if ($escape_) {
        return escape(strip_tags($string_, $ignoreTags_), $charset_, $type_, $flags_);
    }
    return strip_tags($string_, $ignoreTags_);
}

function submitPurchase($purchase_id, $purchase)
{
    $purchase_id = escape($purchase_id);
    //make sure not already submitted
    $result = mysql_query("SELECT status, club_id, instance_id FROM purchase_order WHERE id = '{$purchase_id}'");
    if ($row = mysql_fetch_array($result)) {
        if ($row[0] != 0) {
            return -1;
        } else {
            $purchase_name = $row[1];
            $instance_id = $row[2];
        }
    } else {
        return -2;
    }
    $error = customSave($instance_id, $purchase);
    if ($error !== TRUE) {
        return -2;
    }
    //create the PDF
    $filename = customSubmit($instance_id, "Puchase Order", $purchase_name);
    if ($filename === -1) {
        //if error during PDF generation
        return -2;
    } else {
        if ($filename === -2) {
            //if incomplete
            return -3;
        }
    }
    mysql_query("UPDATE purchase_order SET status='1', filename='{$filename}' WHERE id = '{$purchase_id}'");
    return 0;
}

function statusDue($overdue = false)
{
    global $db;
    $result = $db->query("SELECT service_id, v FROM service_params WHERE k = 'due'");
    $dueArray = array();
    while ($row = $result->fetch_array()) {
        if (empty($row[1]) || $row[1] == "N/A") {
            continue;
        }
        $service_id = escape($row[0]);
        $due = strtotime($row[1]);
        if ($overdue && time() > $due || !$overdue && time() <= $due && time() > $due - 3600 * 24 * 12) {
            $inner_result = $db->query("SELECT services.account_id, services.name, accounts.email, accounts.name FROM services LEFT JOIN accounts ON accounts.id = services.account_id WHERE services.id = '{$service_id}'");
            if ($inner_row = $inner_result->fetch_array()) {
                $price = getServiceParam($service_id, 'price');
                if ($price === false) {
                    $price = "Unknown";
                }
                $dueArray[] = array('due' => $due, 'service_id' => $service_id, 'account_id' => $inner_row[0], 'service' => $inner_row[1], 'email' => $inner_row[2], 'name' => $inner_row[3], 'price' => $price);
            }
            $inner_result->close();
        }
    }
    $result->close();
    usort($dueArray, "statusDueCompare");
    return $dueArray;
}

function do_entry($file, $yearmonth, $day)
{
    global $months;
    global $absoluteurl;
    global $topdir;
    global $firstdate;
    $s = "";
    $monthnum = substr($yearmonth, 4, 2);
    $year = substr($yearmonth, 0, 4);
    // $title = "$months[$monthnum] $day, $year";
    if (!tags_match($file)) {
        return "";
    }
    $title = sprintf("%04d-%02d-%02d", $year, $monthnum, $day);
    $intitle = get_entrytitle($yearmonth, $day);
    $mtime = filemtime($file);
    if ($intitle) {
        $title = $intitle;
    }
    $s .= "    <item>\n" . "      <title>{$title}</title>\n" . "      <pubDate>" . date("r", $mtime) . "</pubDate>\n" . "      <link>{$absoluteurl}/{$topdir}/?m={$yearmonth}#{$day}</link>\n" . "      <guid isPermaLink=\"true\">{$absoluteurl}/{$topdir}/?m={$yearmonth}#{$day}</guid>\n" . "      <description>";
    $entrylines = do_entrycontent($yearmonth, $day);
    if (preg_match('@^\\s*<b>.*</b>\\s*$@', $entrylines[0])) {
        $entrylines[0] = "";
    }
    foreach ($entrylines as $eline) {
        $s .= escape($eline);
    }
    $s .= "      </description>\n" . "    </item>\n";
    return $s;
}

 public function __construct(ApiList $list)
 {
     //Loop through each product name
     foreach ($list->getProdName() as $prodName) {
         $getInfoData = ConfigURL::getURL(ApiInfo::$name, $prodName);
         //Check for any errors and store them in $_errors array
         if (isset($getInfoData['error'])) {
             $this->_errors[$prodName] = $getInfoData['error'];
             continue;
         }
         //Initialize $data array
         $data = array();
         //Loop through the product info and store it in the data array.
         //In the case of suppliers, call the sanitize escape function.
         foreach ($getInfoData as $prodKey) {
             foreach ($prodKey as $name => $value) {
                 switch ($name) {
                     case 'suppliers':
                         $data[$name] = escape(implode(', ', $value));
                         break;
                     default:
                         $data[$name] = $value;
                         break;
                 }
             }
         }
         //Store all the data in $_productInfo
         $this->_productInfo[$prodName] = $data;
     }
 }

 /**
  * @param string $label
  * @param array $attributes
  */
 public function __construct($label, array $attributes = [])
 {
     if (is_string($label)) {
         $label = escape(t($label, [], ['scope' => 'button']));
     }
     parent::__construct('div', $attributes + [self::INNER_HTML => $label]);
 }

 /**
  * The element is created with the type "button" and an union of the provided attributes and
  * the following values:
  *
  * - `type`: "button"
  * - {@link INNER_HTML}: The translated and escaped label. The label is translated with
  * the "button" scope. If an {@link HTMLString} instance is provided, it is used as is.
  *
  * @param string $label Label of the button (inner text).
  * @param array $attributes Optional attributes used to create the element.
  */
 public function __construct($label, array $attributes = [])
 {
     if (!$label instanceof HTMLString) {
         $label = escape(t($label, [], ['scope' => 'button']));
     }
     parent::__construct('button', $attributes + ['type' => 'button', self::INNER_HTML => $label]);
 }

function CreateGroup($user)
{
    if (isset($_POST["group_title"])) {
        $title = escape($_POST["group_title"]);
        $body = escape($_POST["group_body"]);
        if (isset($_POST["group_private"])) {
            $is_private = 1;
        } else {
            $is_private = 0;
        }
        $time = time();
        $query = "INSERT INTO groups (group_name,description,owner_id,time,is_private)";
        $query .= " VALUES ('{$title}','{$body}',{$user},{$time},{$is_private})";
        query($query);
        //tag processor
        $tags = escape($_POST["group_tags"]);
        if (!empty($tags)) {
            $query = "SELECT group_id FROM groups WHERE time= {$time}";
            //getting id of last added post
            $result = query($query);
            $row = mysqli_fetch_array($result);
            AddTag($tags, $row["group_id"], "group");
        }
        ?>
    <div class="alert alert-success alert-dismissible fade in">
      <button type="button" class="close" data-dismiss="alert">×</button>
      <span class="glyphicon glyphicon-ok glyphicon-pad"></span> Group successfully created!
    </div>
<?php 
    }
}

function getSettings($set, $account)
{
    global $dz, $apiMode;
    // The built setting string:
    $settingString = '';
    // For each one:
    foreach ($set as $setting) {
        if ($settingString != '') {
            $settingString .= ',';
        }
        $settingString .= '"' . escape($setting) . '"';
    }
    // Run the query now, selecting the values from the account settings:
    $list = $dz->get_list('select `Setting`,`Value` from `' . $apiMode . '.Account.Settings` where `Account`=' . $account . ' and `Setting` in (' . $settingString . ')');
    $result = array();
    // Make it associative:
    foreach ($list as $setting) {
        $result[$setting['Setting']] = $setting['Value'];
    }
    // Any settings that were not present are set to null:
    foreach ($set as $setting) {
        // Was it added?
        if (!isset($result[$setting])) {
            // No - Add it but as a null:
            $result[$setting] = null;
        }
    }
    return $result;
}

 /**
  * Send an email with Swift library engine.
  *
  * @param array $aInfo
  * @param string $sContents
  * @param boolean $bHtmlFormat Default TRUE
  * @return integer Number of recipients who were accepted for delivery.
  */
 public function send(array $aInfo, $sContents, $bHtmlFormat = true)
 {
     // Default values
     $sFromMail = empty($aInfo['from']) ? DbConfig::getSetting('returnEmail') : $aInfo['from'];
     // Email noreply (generally [email protected])
     $sFromName = empty($aInfo['form_name']) ? DbConfig::getSetting('emailName') : $aInfo['form_name'];
     $sToMail = empty($aInfo['to']) ? DbConfig::getSetting('adminEmail') : $aInfo['to'];
     $sToName = empty($aInfo['to_name']) ? $sToMail : $aInfo['to_name'];
     $sSubject = $aInfo['subject'];
     // Setup the mailer
     $oTransport = \Swift_MailTransport::newInstance();
     $oMailer = \Swift_Mailer::newInstance($oTransport);
     $oMessage = \Swift_Message::newInstance()->setSubject(escape($sSubject, true))->setFrom(array(escape($sFromMail, true) => escape($sFromName, true)))->setTo(array(escape($sToMail, true) => escape($sToName, true)));
     $bHtmlFormat ? $oMessage->addPart($sContents, 'text/html') : $oMessage->setBody($sContents);
     $iResult = $oMailer->send($oMessage);
     unset($oTransport, $oMailer, $oMessage);
     /*
      * Check if Swift is able to send message, otherwise we use the traditional native PHP mail() function
      * as on some hosts config, Swift Mail doesn't work.
      */
     if (!$iResult) {
         $aData = ['from' => $sFromMail, 'to' => $sToMail, 'subject' => $sSubject, 'body' => $sContents];
         $iResult = (int) $this->phpMail($aData);
     }
     return $iResult;
 }

function readFileDirectory($path)
{
    global $mysql, $getID3, $albumSongs;
    foreach (scandir($path) as $currentFile) {
        if ($currentFile == "." || $currentFile == "..") {
            continue;
        }
        $fullPath = $path . "/" . $currentFile;
        if (is_dir($fullPath)) {
            readFileDirectory($fullPath);
        } else {
            $fileExtension = pathinfo($currentFile, PATHINFO_EXTENSION);
            if ($fileExtension == "mp3" || $fileExtension == "wav" || $fileExtension == "ogg") {
                $songInfo = $getID3->analyze($fullPath);
                getid3_lib::CopyTagsToComments($songInfo);
                if (!$songInfo['comments_html']['title'][0]) {
                    $songInfo['comments_html']['title'][0] = basename($currentFile);
                }
                if ($songInfo['tags']['id3v2']['album'][0]) {
                    $albumSongs[escape($songInfo['tags']['id3v2']['album'][0])] = true;
                } else {
                    $albumSongs[escape($songInfo['comments_html']['artist'][0])] = true;
                }
                $mysql->query("INSERT INTO `songs` (`path`, `title`, `artist`, `album`, `length`) VALUES ('{$fullPath}', '" . escape($songInfo['comments_html']['title'][0]) . "', '" . escape($songInfo['comments_html']['artist'][0]) . "', '" . escape($songInfo['tags']['id3v2']['album'][0]) . "', '" . escape($songInfo['playtime_string']) . "')");
            }
        }
    }
}

 public function updateCar($car)
 {
     $Id = $car->getId();
     $SiteId = toNull($car->getSiteId(), false);
     $CarBrandId = toNull($car->getCarBrandId(), false);
     $Type = toNull(escape($car->getType()), true);
     $TypeShort = toNull(escape($car->getTypeShort()), true);
     $PreviewLink = toNull(escape($car->getPreviewLink()), true);
     $DateAdded = toNull(toYYYYMMDD($car->getDateAdded()), true);
     $State = toNull(escape($car->getState()), true);
     $DateApproved = toNull(toYYYYMMDD($car->getDateApproved()), true);
     $FolderName = toNull(escape($car->getFolderName()), true);
     $PressContactId = toNull($car->getPressContactId(), false);
     $UserIdAdded = toNull($car->getUserIdAdded(), false);
     $UserIdApproved = toNull($car->getUserIdApproved(), false);
     $DetailTypeId = toNull($car->getDetailTypeId(), false);
     $DefaultPictureId = toNull($car->getDefaultPictureId(), false);
     $LRClicks = toNull($car->getLRClicks(), false);
     $HRClicks = toNull($car->getHRClicks(), false);
     $Views = toNull($car->getViews(), false);
     $ReleaseDate = toNull(escape($car->getReleaseDate()), true);
     $MovieFolder = toNull(escape($car->getMovieFolder()), true);
     $sql = "UPDATE car\n\t\t\tSET SiteId = {$SiteId},\n\t\t\tCarBrandId = {$CarBrandId},\n\t\t\tType = {$Type},\n\t\t\tTypeShort = {$TypeShort},\n\t\t\tPreviewLink = {$PreviewLink},\n\t\t\tDateAdded = {$DateAdded},\n\t\t\tState = {$State},\n\t\t\tDateApproved = {$DateApproved},\n\t\t\tFolderName = {$FolderName},\n\t\t\tPressContactId = {$PressContactId},\n\t\t\tUserIdAdded = {$UserIdAdded},\n\t\t\tUserIdApproved = {$UserIdApproved},\n\t\t\tDetailTypeId = {$DetailTypeId},\n\t\t\tDefaultPictureId = {$DefaultPictureId},\n\t\t\tLRClicks = {$LRClicks},\n\t\t\tHRClicks = {$HRClicks},\n\t\t\tViews = {$Views},\n\t\t\tReleaseDate = {$ReleaseDate},\n                        MovieFolder = {$MovieFolder}\n\t\t\tWHERE Id = {$Id}";
     if (!mysql_query($sql, $this->connectie)) {
         die('Error: ' . mysql_error());
     }
 }

function UpdateCourse()
{
    if (isset($_POST['update_course'])) {
        $CID = $_GET['id'];
        //course id
        $code = escape($_POST['code']);
        $credit = $_POST['credit'];
        $semester = $_POST['semester'];
        $point = $_POST['grade'];
        global $USERID;
        if (isset($_POST['retake'])) {
            $is_retake = true;
        } else {
            $is_retake = 'NULL';
        }
        $query = "UPDATE GRADES SET course='{$code}', grade={$point}, credit={$credit}, semester={$semester}, is_retake={$is_retake}";
        $query .= " WHERE user_id= {$USERID} AND grade_id={$CID}";
        query($query);
        ?>
    <div class="alert alert-success alert-dismissible fade in">
      <button type="button" class="close" data-dismiss="alert">×</button>
      <span class="glyphicon glyphicon-thumbs-up glyphicon-pad"></span> Course successfully updated!
    </div>
  <?php 
    }
}

/**
 * Formats a string for HTML display by replacing variable placeholders.
 *
 * This function replaces variable placeholders in a string with the requested values and escapes
 * the values so they can be safely displayed as HTML. It should be used on any unknown text that
 * is intended to be printed to an HTML page (especially text that may have come from untrusted
 * users, since in that case it prevents cross-site scripting and other security problems).
 *
 * @param string   $string A string containing placeholders.
 * @param string[] $args   An associative array of replacements to make. Occurrences in $string of
 *                         any key in $args are replaced with the corresponding value, after optional
 *                         sanitization and formatting. The type of sanitization and formatting
 *                         depends on the first character of the key:
 *                         - @variable: Escaped to HTML.
 *                         - *variable: Escaped to HTML and formatted as <strong>emphasized</strong> text.
 *                         - %variable: Escaped to HTML and formatted as <em>emphasized</em> text.
 *                         - !variable: Inserted as is, with no sanitization or formatting.
 *
 * @return string
 */
function format($string, array $args)
{
    // Transform arguments before inserting them.
    foreach ($args as $key => $value) {
        switch ($key[0]) {
            case '@':
                // Escaped only.
                $args[$key] = escape($value);
                break;
            case '%':
                // Escaped and emphasised.
                $value = escape($value);
                $args[$key] = '<em>' . $value . '</em>';
                break;
            case '*':
                // Escaped and strong.
                $value = escape($value);
                $args[$key] = '<strong>' . $value . '</strong>';
                break;
            case '!':
                // Pass-through.
                break;
            default:
                throw new \RuntimeException('String format type not provided.');
        }
    }
    return strtr($string, $args);
}

function pageController()
{
    $data = [];
    //$data['counter'] = isset($_GET["counter"]) ? $_GET["counter"] : 0;
    $data['counter'] = inputHas('counter') ? escape(inputGet('counter')) : 0;
    return $data;
}

 public function step1()
 {
     $db_name = $this->db->real_escape_string(escape(Input::get('db-name')));
     $query = "CREATE DATABASE IF NOT EXISTS `" . $db_name . "`";
     $result = $this->db->query($query);
     if ($this->db->error != '') {
         echo $this->db->error;
         return;
     }
     $this->db->select_db($db_name);
     $table_name = $this->db->real_escape_string(escape(Input::get('db-table')));
     $query = "CREATE TABLE IF NOT EXISTS `" . $table_name . "` (id bigint(20) NOT NULL auto_increment,\n                                                                uid bigint(20),\n                                                                email varchar(100) NOT NULL,\n                                                                first_name varchar(50) NOT NULL,\n                                                                last_name varchar(50) NOT NULL,\n                                                                name varchar(100) NOT NULL,\n                                                                gender varchar(10) NOT NULL,\n                                                                dob date,\n                                                                dos date NOT NULL,\n                                                                profile_pic_link varchar(255),\n                                                                PRIMARY KEY(id),\n                                                                UNIQUE KEY(email))";
     $result = $this->db->query($query);
     if ($this->db->error != '') {
         echo $this->db->error;
         echo "<br/>Something Went Wrong!";
         return;
     }
     Session::put('db-server', Input::get('db-server'));
     Session::put('db-username', Input::get('db-username'));
     Session::put('db-password', Input::get('db-password'));
     Session::put('db-name', Input::get('db-name'));
     Session::put('db-table', Input::get('db-table'));
     Session::put('proxy-rule', Input::get('proxy-rule'));
     return 1;
 }