function execute_query($input_query, $page_source = 'none.php', $limit = 0, $offset = 0, $skip_log = false) { global $debug_message, $queries, $link, $CONFIG_log_select, $CONFIG_log_insert, $CONFIG_log_update, $CONFIG_log_delete, $CONFIG_debug, $CONFIG_passphrase, $total_execution, $STORED_login; $start_time = getmicrotime(); $analyze_query = strtolower(htmlspecialchars($input_query)); // analyzes the query for illegal inputs // disables the use of UNION SELECT $banned_combos = array( "UNION SELECT" => "union", "xp_stored procedure" => "xp_", "comment" => "--" ); foreach ($banned_combos as $index => $value) { if (strstr($analyze_query, $value) == true) { add_exploit_entry("Attempted to inject a $index into a query!"); redir("../index.php", "Invalid query to be executed!"); } } $queries++; $debug_message .= "\n\t\n\t\t$queries\n\t\t"; if (!$skip_log) { if (strstr($analyze_query, 'select') !== false && $CONFIG_log_select) { $debug_message .= "Logging: "; $log_query = true; } if (strstr($analyze_query, 'insert') !== false && $CONFIG_log_insert) { $debug_message .= "Logging: "; $log_query = true; } elseif (strstr($analyze_query, 'update') !== false && $CONFIG_log_update) { $debug_message .= "Logging: "; $log_query = true; } elseif (strstr($analyze_query, 'delete') !== false && $CONFIG_log_delete) { $debug_message .= "Logging: "; $log_query = true; } else { $debug_message .= "Executing: "; $log_query = false; } } else { $debug_message .= "Executing: "; $log_query = false; } if ($limit == 0 && $offset == 0) { $result = $link->Execute($input_query) or die("Query ($input_query) failed: " . $link->ErrorMsg()); } else { $result = $link->SelectLimit($input_query, $limit, $offset) or die("Query ($input_query) failed: " . $link->ErrorMsg()); } // Displays each query (SELECT, INSERT, UPDATE, DELETE) $debug_message .= "\n\t\t"; $execute_time = (getmicrotime() - $start_time); $total_execution += $execute_time; if ($CONFIG_debug) { $rows = $result->RowCount(); $debug_message .= "$page_source\n\t\t"; $debug_message .= "$input_query\n\t\t$execute_time\n\t\t"; } if ($log_query) { // replaces each line break with a space $input_query = str_replace("\r\n", " ", $input_query); add_query_entry($page_source, $input_query); } return $result; }