function execute_query($input_query, $page_source = 'none.php', $limit = 0, $offset = 0, $skip_log = false) {
global $debug_message, $queries, $link, $CONFIG_log_select, $CONFIG_log_insert,
$CONFIG_log_update, $CONFIG_log_delete, $CONFIG_debug, $CONFIG_passphrase,
$total_execution, $STORED_login;
$start_time = getmicrotime();
$analyze_query = strtolower(htmlspecialchars($input_query)); // analyzes the query for illegal inputs
// disables the use of UNION SELECT
$banned_combos = array(
"UNION SELECT" => "union",
"xp_stored procedure" => "xp_",
"comment" => "--"
);
foreach ($banned_combos as $index => $value) {
if (strstr($analyze_query, $value) == true) {
add_exploit_entry("Attempted to inject a $index into a query!");
redir("../index.php", "Invalid query to be executed!");
}
}
$queries++;
$debug_message .= "\n\t
\n\t\t| $queries | \n\t\t";
if (!$skip_log) {
if (strstr($analyze_query, 'select') !== false && $CONFIG_log_select) {
$debug_message .= "Logging: ";
$log_query = true;
}
if (strstr($analyze_query, 'insert') !== false && $CONFIG_log_insert) {
$debug_message .= "Logging: ";
$log_query = true;
}
elseif (strstr($analyze_query, 'update') !== false && $CONFIG_log_update) {
$debug_message .= "Logging: ";
$log_query = true;
}
elseif (strstr($analyze_query, 'delete') !== false && $CONFIG_log_delete) {
$debug_message .= "Logging: ";
$log_query = true;
}
else {
$debug_message .= "Executing: ";
$log_query = false;
}
}
else {
$debug_message .= "Executing: ";
$log_query = false;
}
if ($limit == 0 && $offset == 0) {
$result = $link->Execute($input_query) or die("Query ($input_query) failed: " . $link->ErrorMsg());
}
else {
$result = $link->SelectLimit($input_query, $limit, $offset) or die("Query ($input_query) failed: " . $link->ErrorMsg());
}
// Displays each query (SELECT, INSERT, UPDATE, DELETE)
$debug_message .= " | \n\t\t";
$execute_time = (getmicrotime() - $start_time);
$total_execution += $execute_time;
if ($CONFIG_debug) {
$rows = $result->RowCount();
$debug_message .= "$page_source | \n\t\t";
$debug_message .= "$input_query | \n\t\t$execute_time | \n\t\t
";
}
if ($log_query) {
// replaces each line break with a space
$input_query = str_replace("\r\n", " ", $input_query);
add_query_entry($page_source, $input_query);
}
return $result;
}