booking / includes / _request / wpbc_request.php

wpbc_request.php in Booking Calendar 10.1.3, at includes/_request/wpbc_request.php

881 lines 34.5 KB

Raw Download Zip

1	<?php /**
2	* @version 1.0
3	* @description Universal class for REQUEST params cleaning (sanitizing) and saving such data, relative to current WP user.
4	* @category WPBC_AJX__REQUEST Class
5	* @author wpdevelop
6	*
7	* @web-site http://oplugins.com/
8	* @email info@oplugins.com
9	*
10	* @modified 2022-10-29
11	*/
12
13	if ( ! defined( 'ABSPATH' ) ) exit; // Exit if accessed directly //FixIn: 9.3.1.2
14
15
16	/**
17	* Class for sanitizing $_REQUEST parameters and saving or getting it in/from DB
18	*
19	*
20	* Example 1:
21	*
22	$user_request = new WPBC_AJX__REQUEST( array(
23	'db_option_name' => 'booking_availability_request_params',
24	'user_id' => wpbc_get_current_user_id(),
25	'request_rules_structure' => WPBC_AJX__Availability::request_rules_structure()
26	)
27	);
28	$escaped_request_params_arr = $user_request->get_sanitized__saved__user_request_params(); // Get Saved
29
30	if ( false === $escaped_request_params_arr ) { // This request was not saved before, then get sanitized direct parameters, like: $_REQUEST['resource_id']
31
32	$request_prefix = false;
33	$escaped_request_params_arr = $user_request->get_sanitized__in_request__value_or_default( $request_prefix ); // Direct: $_REQUEST['resource_id']
34	}
35	*
36	*
37	* Example 2:
38	*
39	$user_request = new WPBC_AJX__REQUEST( array(
40	'db_option_name' => 'booking_availability_request_params',
41	'user_id' => wpbc_get_current_user_id(),
42	'request_rules_structure' => array(
43	'resource_id' => array( 'validate' => 'digit_or_csd', 'default' => 1 )
44	, 'ui_wh_booking_date_checkout' => array( 'validate' => 'digit_or_date', 'default' => '' ) // number \| date 2016-07-20
45	, 'wh_modification_date' => array( 'validate' => 'array', 'default' => array( '3' ) ) // number \| date 2016-07-20
46	, 'ui_wh_modification_date_radio' => array( 'validate' => 'd', 'default' => 0 ) // '1' \| '2' ....
47	, 'keyword' => array( 'validate' => 's', 'default' => '' ) //string
48	, 'wh_cost' => array( 'validate' => 'float_or_empty', 'default' => '' ) // '1' \| ''
49	, 'ui_usr__send_emails' => array( 'validate' => array( 'send', 'not_send' ), 'default' => 'send' )
50	)
51	) );
52	*
53	*
54	* OR ******************************************************************************************************************
55	* $user_request = new WPBC_AJX__REQUEST();
56	*
57	* $user_request->set_db_option_name__for_saved_request( 'booking_availability_request_params' );
58	*
59	* $user_request->set_user_id( wpbc_get_current_user_id() );
60	*
61	* $user_request->set_default_request_structure( array(
62	* 'resource_id' => array( 'validate' => 'digit_or_csd', 'default' => array( '1' ) )
63	* ) );
64	* OR:
65	* $user_request->set_default_request_structure( WPBC_AJX__Availability::get__request_params__names_default() );
66	*
67	***********************************************************************************************************************
68	*
69	* $params_arr = $user_request->get_sanitized__saved__user_request_params(); // Initial Load - get params SAVED in DB - user open page with same view as before
70	* OR
71	* $params_arr = $user_request->get_sanitized__in_request__value_or_default( false ); // Direct - $_REQUEST['resource_id']
72	* OR
73	* $params_arr = $user_request->get_sanitized__in_request__value_or_default( 'search_params' ); // In Ajax request - $_REQUEST['search_params']['resource_id']
74	*
75	*
76	***********************************************************************************************************************
77	* Request Rules Structure
78	***********************************************************************************************************************
79	*
80	array(
81	, 'page_num' => array( 'validate' => 'd', 'default' => 1 ) // 1 \| 0
82	, 'cost' => array( 'validate' => 'f', 'default' => 1.5 ) // 1.5 \| 0
83	, 'wh_cost' => array( 'validate' => 'float_or_empty', 'default' => '' ) // 1.5 \| ''
84	, 'wh_num' => array( 'validate' => 'digit_or_empty', 'default' => '' ) // 1 \| ''
85	, 'keyword' => array( 'validate' => 's', 'default' => '' ) // string
86
87	, 'wh_booking_date' => array( 'validate' => 'array', 'default' => array( "3" ) ) // Elements of array checked as string
88	, 'ui_wh_booking_date' => array( 'validate' => 'date', 'default' => '' ) // Date e.g.: '2022-05-31' or ''
89
90	// 'digit_or_csd' can check about 'digit_or_csd' in arrays, as well
91	, 'wh_booking_type' => array( 'validate' => 'digit_or_csd', 'default' => array( '0' ) ) // Digit or comma separated digit ( e.g.: '12,a,45,9' => '12,0,45,9' ) // if ['0'] - All booking resources, ['-1'] - lost bookings in deleted resources
92	, 'ui_wh_booking_date_checkout' => array( 'validate' => 'digit_or_date', 'default' => '' ) // digit or Date e.g.: '2022-05-31' or 5 or ''
93
94	, 'ui_wh_start' => array( 'validate' => 'checked_skip_it', 'default' => '' ) // Skip from checking
95
96	, 'ui_usr__is_expand_remarks' => array( 'validate' => array( 'On', 'Off' ), 'default' => 'Off' )
97	);
98	*
99	*
100	*
101	***********************************************************************************************************************
102	* Otherwise possible to use ' Direct Clean Params '
103	***********************************************************************************************************************
104	*
105	$request_params_ajx_booking = array(
106	'page_num' => array( 'validate' => 'd', 'default' => 1 )
107	, 'page_items_count' => array( 'validate' => 'd', 'default' => 10 )
108	, 'sort' => array( 'validate' => array( 'ajx_booking_id' ), 'default' => 'ajx_booking_id' )
109	, 'sort_type' => array( 'validate' => array( 'ASC', 'DESC'),'default' => 'DESC' )
110	, 'status' => array( 'validate' => 's', 'default' => '' )
111	, 'keyword' => array( 'validate' => 's', 'default' => '' )
112	, 'ru_create_date' => array( 'validate' => 'date', 'default' => '' )
113	);
114	$request_params_values = array( // Usually $request_params_values is $_REQUEST
115	'page_num' => 1,
116	'page_items_count' => 3,
117	'sort' => 'ajx_booking_id',
118	'sort_type' => 'DESC',
119	'status' => '',
120	'keyword' => '',
121	'ru_create_date' => ''
122	);
123	$request_params = wpbc_sanitize_params_in_arr( $request_params_values, $request_params_ajx_booking );
124
125	*/
126	class WPBC_AJX__REQUEST {
127
128	private $db_option_name__for_saved_request;
129	private $request_rules_structure;
130	private $user_id;
131
132	public function __construct( $params ) {
133	$defaults = array(
134	'db_option_name' => 'general_booking_request_params',
135	'user_id' => wpbc_get_current_user_id(),
136	'request_rules_structure' => array()
137	);
138	$params = wp_parse_args( $params, $defaults );
139
140
141	if ( ! empty( $params['db_option_name'] ) ) {
142	$this->set_db_option_name__for_saved_request( $params['db_option_name'] );
143	}
144
145	if ( ! empty( $params['user_id'] ) ) {
146	$this->set_user_id( $params['user_id'] );
147	}
148
149	if ( ! empty( $params['request_rules_structure'] ) ) {
150	$this->set_request_rules_structure( $params['request_rules_structure'] );
151	}
152	}
153
154	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
155	// Setters
156	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
157
158	/**
159	* Set name of option for saving request parameters into DB
160	*
161	* @param string $db_option_name
162	*
163	* @return void
164	*/
165	public function set_db_option_name__for_saved_request( $db_option_name ){
166	$this->db_option_name__for_saved_request = $db_option_name;
167	}
168
169	/**
170	* Set current active user ID
171	*
172	* @param int $user_id
173	*
174	* @return void
175	*/
176	public function set_user_id( $user_id ){
177	$this->user_id = $user_id;
178	}
179
180	/**
181	* Set request structure for validation and default values
182	*
183	* @param array $request_rules_structure array(
184	* 'resource_id' => array( 'validate' => 'digit_or_csd', 'default' => array( '1' ) )
185	* , ...
186	* )
187	*
188	* @return void
189	*/
190	public function set_request_rules_structure( $request_rules_structure ){
191	$this->request_rules_structure = $request_rules_structure;
192	}
193
194
195	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
196	/// Request Structure
197	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
198
199	/**
200	* Get params names for escaping and/or default value of such params
201	*
202	* @param string $structure_type 'validate_and_default' (default) \| 'validate' \| 'default'
203	*
204	* @return array
205	* if $structure_type == '' array ( 'keyword' => array( 'validate' => 's', 'default' => '' )
206	* , 'wh_booking_date' => array( 'validate' => 'digit_or_date', 'default' => '3' ), ...
207	* if $structure_type == 'validate' array ( 'keyword' => 's'
208	* , 'wh_booking_date' => 'digit_or_date'), ...
209	* if $structure_type == 'default' array ( 'keyword' => ''
210	* , 'wh_booking_date' => '3' ), ...
211	*/
212	public function get_request_rules_structure( $structure_type = 'validate_and_default' ){
213
214	$params_for_cleaning = $this->request_rules_structure;
215
216	if ( 'validate_and_default' == $structure_type ) {
217	return $params_for_cleaning;
218	}
219
220	$return_simple_arr = array();
221
222	foreach ( $params_for_cleaning as $key => $value ) {
223	$return_simple_arr[ $key ] = $value[ $structure_type ];
224	}
225	return $return_simple_arr;
226
227	}
228
229
230	/**
231	* Get default values from rules structure
232	*
233	* @return array array ( 'keyword' => '', 'wh_booking_date' => '3' ), ...
234	*/
235	public function get_request_rules__default( ){
236
237	return $this->get_request_rules_structure( 'default' );
238	}
239
240
241	/**
242	* Get validate rules from params structure
243	*
244	* @return array array ( 'keyword' => 's', 'wh_booking_date' => 'digit_or_date'), ...
245	*/
246	public function get_request_rules__validate( ){
247
248	return $this->get_request_rules_structure( 'validate' );
249	}
250
251	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
252	// Get user Saved params
253	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
254
255	/**
256	* Get $_REQUEST saved before in DB from user - Sanitized Array
257	*
258	* @return
259	* false - if not saved before
260	* OR
261	* array(
262	* 'page_num' => 1
263	* , 'page_items_count' => 100
264	* , 'sort' => 'ajx_booking_id'
265	* , 'sort_type' => 'DESC'
266	* , 'keyword' => ''
267	* , 'status' => ''
268	* )
269	*/
270	public function get_sanitized__saved__user_request_params() {
271
272	$request_params_values_arr = $this->user_request_params__db_get(); // - $request_params_values_arr - un-serialized here automatically
273
274	if ( false !== $request_params_values_arr ) {
275
276	$request_params_structure = $this->get_request_rules_structure(); /**
277	* array( 'page_num' => array( 'validate' => 'd', 'default' => 1 )
278	* , 'page_items_count' => array( 'validate' => 'd', 'default' => 10 )
279	* , 'sort' => array( 'validate' => array( 'booking_id' ), 'default' => 'booking_id' )
280	* , 'sort_type' => array( 'validate' => array( 'ASC', 'DESC'),'default' => 'DESC' )
281	* , 'keyword' => array( 'validate' => 's', 'default' => '' )
282	* , 'create_date' => array( 'validate' => 'date', 'default' => '' )
283	* )
284	*/
285
286	$escaped_request_params = wpbc_sanitize_params_in_arr( $request_params_values_arr, $request_params_structure ); // Escaping params here
287
288	return $escaped_request_params;
289
290	} else {
291	return false;
292	}
293	}
294
295
296	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
297	// Get sanitized $_REQUEST params \| default values
298	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
299
300	/**
301	* Get "sanitized values" from $_REQUEST or "default values", based on rules structure
302	*
303	* @param string \| false $prefix_in_request
304	*
305	* default FALSE
306	*
307	* string parameter useful, if request like this (usually in Ajax):
308	*
309	* $_REQUEST (
310	* ['listing_page']['page_num'] => 3
311	* ['listing_page']['page_items_count'] => 20
312	* ['listing_page']['sort'] => 'booking_id'
313	* )
314	*
315	* then we use this: $this->get_sanitized__in_request__value_or_default( 'listing_page' )
316	*
317	*
318	* @return array
319	* Example: array(
320	* ['page_num'] => 3
321	* ['page_items_count'] => 20
322	* ['sort'] => 'booking_id'
323	* )
324	*/
325	public function get_sanitized__in_request__value_or_default( $prefix_in_request = false ){
326
327	$request_rules_structure = $this->get_request_rules_structure();
328
329	$request_params_values_arr = array();
330
331	foreach ( $request_rules_structure as $request_key => $clean_type ) {
332
333	$exist_request_param_value = wpbc_get_direct_value_in_request( $request_key, $prefix_in_request ); // Get direct request values: $_REQUEST['page_num'] => 3
334	// if ( $prefix_in_request == 'listing_page' ): $_REQUEST['listing_page']['page_num'] => 3
335	if ( false !== $exist_request_param_value ) {
336	$request_params_values_arr[ $request_key ] = $exist_request_param_value;
337	}
338	}
339
340	$escaped_request_params = wpbc_sanitize_params_in_arr( $request_params_values_arr, $request_rules_structure );
341
342	return $escaped_request_params;
343	}
344
345
346	// <editor-fold defaultstate="collapsed" desc=" D B S A V E / G E T U S E R R E Q U E S T " >
347
348	/**
349	* Save user filter request - saving user filters in toolbar
350	*
351	* @param array $params_arr
352	*
353	* @return bool\|int
354	*/
355	function user_request_params__db_save( $params_arr ) {
356
357	return update_user_option( $this->user_id, $this->db_option_name__for_saved_request , $params_arr );
358	}
359
360	/**
361	* Delete saved user request - used for resetting user filters in toolbar
362	*
363	* @return bool
364	*/
365	function user_request_params__db_delete() {
366
367	return delete_user_option( $this->user_id, $this->db_option_name__for_saved_request );
368	}
369
370	/**
371	* Get saved user filter request - params for user filters in toolbar
372	*
373	* @return false\|mixed
374	*/
375	function user_request_params__db_get() {
376
377	return get_user_option( $this->db_option_name__for_saved_request, $this->user_id );
378	}
379
380	// </editor-fold>
381
382	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
383	// Get user option - single parameter
384	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
385
386	/**
387	* Get user saved option from Request in Booking Listing
388	*
389	* @param $user_id int 1
390	* @param $option_name string 'ui_usr__send_emails'
391	*
392	* @return false\|mixed
393	*/
394	function user_request_params__get_option( $option_name ){
395
396	// Get User saved option from request
397	$escaped_request_params = $this->get_sanitized__saved__user_request_params();
398	if ( ( ! empty( $escaped_request_params ) ) && ( ! empty( $escaped_request_params[ $option_name ] ) ) ) {
399	return $escaped_request_params[ $option_name ];
400	}
401
402	// Get default option
403	$default_param_values = $this->get_request_rules_structure( 'default' );
404	if ( ! empty( $default_param_values[ $option_name ] ) ) {
405	return $default_param_values[ $option_name ];
406	}
407
408	// There is no such option
409	return false;
410	}
411
412	// Helpers:
413	/**
414	* Is send emails ? Check DB SAVED user defined option from Options toolbar.
415	* @param $user_id int ID of user
416	*
417	* @return int 1 \| 0
418	*/
419	function user_request_option__is_send_emails(){
420
421	$is_send_emeils = $this->user_request_params__get_option( 'ui_usr__send_emails' );
422
423	$is_send_emeils = ( 'send' == $is_send_emeils ) ? 1 : 0;
424
425	return $is_send_emeils;
426	}
427	}
428
429
430
431	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
432	// Request
433	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
434
435
436	/**
437	* Get indexed or direct request from REQUEST
438	*
439	* @param $request_key
440	* @param false $prefix_in_request
441	*
442	* @return false\|mixed
443	*/
444	function wpbc_get_direct_value_in_request( $request_key, $prefix_in_request = false ) {
445
446	/**
447	* Get value from 'direct request' - "$_REQUEST['page_num'] => 3"
448	* or
449	* from 'prefix request' - "$_REQUEST['request_params']['page_num'] => 3"
450	*/
451
452	if (
453	( empty( $prefix_in_request ) )
454	&& ( isset( $_REQUEST[ $request_key ] ) )
455	) {
456	return $_REQUEST[ $request_key ];
457	}
458
459	if (
460	( ! empty( $prefix_in_request ) )
461	&& ( isset( $_REQUEST[ $prefix_in_request ] ) )
462	&& ( isset( $_REQUEST[ $prefix_in_request ][ $request_key ] ) )
463	) {
464	return $_REQUEST[ $prefix_in_request ][ $request_key ];
465	}
466
467	return false;
468	}
469
470
471	/**
472	* Check specific parameters in ARRAY and return cleaned params or default values
473	*
474	* @param array $request_params_values_arr = / think like in $_REQUEST parameter /
475	* array(
476	* 'page_num' => 1,
477	* 'page_items_count' => 10,
478	* 'sort' => 'rule_id',
479	* 'sort_type' => 'DESC',
480	* 'status' => '',
481	* 'keyword' => '',
482	* 'create_date' => ''
483	* )
484	* @param array $params_rules = array(
485	* 'page_num' => array( 'validate' => 'd', 'default' => 1 )
486	* , 'page_items_count' => array( 'validate' => 'd', 'default' => 10 )
487	* , 'sort' => array( 'validate' => array( 'rule_id' ), 'default' => 'rule_id' )
488	* , 'sort_type' => array( 'validate' => array( 'ASC', 'DESC'),'default' => 'DESC' )
489	* , 'status' => array( 'validate' => 's', 'default' => '' )
490	* , 'keyword' => array( 'validate' => 's', 'default' => '' )
491	* , 'create_date' => array( 'validate' => 'date', 'default' => '' )
492	* )
493	*
494	*
495	* 'd'; // '1' \| ''
496	* 's'; // string !!! Clean 'LIKE' string for DB !!!
497	* 'digit_or_csd'; // '0' \| '1,2,3' \| ''
498	* 'digit_or_date'; // number \| date 2016-07-20
499	*
500	* 'checked_skip_it' // Skip checking
501	* array( '0', 'trash', 'any'); // Elements only listed in array
502	*
503	*@return array $clean_params = Array (
504	* [page_num] => 3
505	* [page_items_count] => 20
506	* [sort] => booking_id
507	* [sort_type] => DESC
508	* [keyword] =>
509	* [source] =>
510	* [create_date] =>
511	* )
512	*
513	*
514	Example of Direct Clean Params:
515
516	$request_params_ajx_booking = array(
517	'page_num' => array( 'validate' => 'd', 'default' => 1 )
518	, 'page_items_count' => array( 'validate' => 'd', 'default' => 10 )
519	, 'sort' => array( 'validate' => array( 'ajx_booking_id' ), 'default' => 'ajx_booking_id' )
520	, 'sort_type' => array( 'validate' => array( 'ASC', 'DESC'),'default' => 'DESC' )
521	, 'status' => array( 'validate' => 's', 'default' => '' )
522	, 'keyword' => array( 'validate' => 's', 'default' => '' )
523	, 'ru_create_date' => array( 'validate' => 'date', 'default' => '' )
524	);
525	$request_params_values = array( // Usually $request_params_values is $_REQUEST
526	'page_num' => 1,
527	'page_items_count' => 3,
528	'sort' => 'ajx_booking_id',
529	'sort_type' => 'DESC',
530	'status' => '',
531	'keyword' => '',
532	'ru_create_date' => ''
533	);
534	$request_params = wpbc_sanitize_params_in_arr( $request_params_values, $request_params_ajx_booking );
535	*/
536	function wpbc_sanitize_params_in_arr( $request_params_values_arr, $params_rules ){
537
538	$clean_params = array();
539
540	foreach ( $params_rules as $request_key_name => $clean_type ) {
541
542	if ( isset( $request_params_values_arr[ $request_key_name ] ) ) {
543	$request_value_check = $request_params_values_arr[ $request_key_name ];
544	} else {
545	$request_value_check = false;
546	}
547
548	// If not defined in VALUES (think like in $_REQUEST parameter), then get default value
549	if ( false === $request_value_check ) {
550
551	// D E F A U L T
552	$clean_params[ $request_key_name ] = $params_rules[ $request_key_name ]['default'];
553
554	} else {
555
556	// C L E A N I N G
557	$clean_type = $params_rules[ $request_key_name ]['validate'];
558
559	// Check only values from this Array
560	if ( is_array( $clean_type ) ) {
561
562	$clean_type = array_map( 'strtolower', $clean_type );
563
564	if ( ( isset( $request_value_check ) ) && ( ! in_array( strtolower( $request_value_check ), $clean_type ) ) ) {
565	$clean_type = 'checked_skip_it';
566	$request_value_check = $params_rules[ $request_key_name ]['default']; // Reset it, if value not in array And get default value
567	} else {
568	$clean_type = 'checked_skip_it';
569	}
570	}
571
572	switch ( $clean_type ) {
573
574	case 'checked_skip_it':
575	$clean_params[ $request_key_name ] = $request_value_check;
576	break;
577
578	case 'date': // Date
579	$clean_params[ $request_key_name ] = wpbc_sanitize_date( $request_value_check );
580	break;
581
582	case 'csv_dates': // CSV Dates: '11.11.2025, 12.11.2025, 13.11.2025' or '2024-02-06, 2024-02-10'
583	$clean_params[ $request_key_name ] = wpbc_sanitize_csv_dates( $request_value_check ); //FixIn: 9.9.1.1
584	break;
585
586	case 'digit_or_date': // digit or Date
587	$clean_params[ $request_key_name ] = wpbc_sanitize_digit_or_date( $request_value_check );
588	break;
589
590	case 'digit_or_csd': // digit or comma separated digit
591	$clean_params[ $request_key_name ] = wpbc_sanitize_digit_or_csd( $request_value_check );
592	break;
593
594	case 's': // string
595	$clean_params[ $request_key_name ] = wpbc_sanitize_text( $request_value_check );
596	break;
597
598	case 'strong': // string
599	$clean_params[ $request_key_name ] = wpbc_sanitize_text_strong( $request_value_check );
600	break;
601
602	case 'array':
603	if ( is_array( $request_value_check ) ) {
604	foreach ( $request_value_check as $check_arr_index => $check_arr_value ) {
605	$request_value_check[ $check_arr_index ] = wpbc_sanitize_text( $check_arr_value ); // Check each option as string
606	}
607	$clean_params[ $request_key_name ] = $request_value_check;
608
609	} else {
610	$clean_params[ $request_key_name ] = $params_rules[ $request_key_name ]['default'];
611	}
612	break;
613
614	case 'digit_or_empty': // digit or ''
615	if ( '' === $request_value_check) {
616	$clean_params[ $request_key_name ] = '';
617	} else {
618	$clean_params[ $request_key_name ] = intval( $request_value_check );
619	}
620	break;
621
622	case 'float_or_empty': // digit or ''
623	if ( '' === $request_value_check) {
624	$clean_params[ $request_key_name ] = '';
625	} else {
626
627	// In case if was entered 10,99 instead of 10.99
628	$request_value_check = str_replace( ',', '.', $request_value_check );
629
630	$clean_params[ $request_key_name ] = floatval( $request_value_check );
631	}
632	break;
633
634	case 'f': // float
635	$clean_params[ $request_key_name ] = floatval( $request_value_check );
636	break;
637
638	case 'd': // digit
639	$clean_params[ $request_key_name ] = intval( $request_value_check );
640	break;
641
642	default:
643	$clean_params[ $request_key_name ] = intval( $request_value_check );
644	break;
645	}
646	}
647	}
648	return $clean_params;
649	}
650
651
652	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
653	// Sanitize functions
654	////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
655
656	/**
657	* Check parameter if it number or comma separated list of numbers
658	*
659	* @param string \| array $value
660	*
661	* @return string
662	*
663	* Example:
664	* wpbc_sanitize_digit_or_csd( '12,a,45,9' ) => '12,0,45,9'
665	* or
666	* wpbc_sanitize_digit_or_csd( '10a' ) => '10
667	* or
668	* wpbc_sanitize_digit_or_csd( array( '12,a,45,9', '10a' ) ) => array ( '12,0,45,9', '10' )
669	*@global type $wpdb
670	*/
671	function wpbc_sanitize_digit_or_csd( $value ) { //FixIn:6.2.1.4
672
673	if ( $value === '' ) {
674	return $value;
675	}
676
677	if ( is_array( $value ) ) {
678	foreach ( $value as $key => $check_value ) {
679	$value[ $key ] = wpbc_sanitize_digit_or_csd( $check_value );
680	}
681
682	return $value;
683	}
684
685	$value = str_replace( ';', ',', $value );
686	$array_of_nums = explode( ',', $value );
687
688
689	$result = array();
690	foreach ( $array_of_nums as $check_element ) {
691	$result[] = intval( $check_element );
692	}
693	$result = implode( ',', $result );
694
695	return $result;
696	}
697
698
699	/**
700	* Check about Valid date or number, like 2016-07-20 and return this date or number
701	*
702	* @param string $value
703	*
704	* @return string\|digit '2022-05-31' or 5 or ''
705	*/
706	function wpbc_sanitize_digit_or_date( $value ) { //FixIn:6.2.1.4
707
708	if ( $value === '' ) return $value;
709
710	if ( preg_match("/^[0-9]{4}-(0[1-9]\|1[0-2])-(0[1-9]\|[1-2][0-9]\|3[0-1])$/", $value ) ) {
711
712	return $value; // Date is valid in format: 2016-07-20
713	} else {
714	return intval( $value );
715	}
716
717	}
718
719
720	/**
721	* Check about Valid date, like 2016-07-20 and return this date or ''
722	*
723	* @param string $value
724	*
725	* @return string '2022-05-31' or ''
726	*/
727	function wpbc_sanitize_date( $value ) { //FixIn:6.2.1.4
728
729	if ( $value === '' ) return $value;
730
731	if ( preg_match("/^[0-9]{4}-(0[1-9]\|1[0-2])-(0[1-9]\|[1-2][0-9]\|3[0-1])$/", $value ) ) {
732
733	return $value; // Date is valid in format: 2016-07-20
734	} else {
735	return '';
736	}
737
738	}
739
740	//FixIn: 9.9.1.1
741	/**
742	* Check about Valid date, like '31.05.2022 and return this date or ''
743	*
744	* @param string $value
745	*
746	* @return string '31.05.2022' or ''
747	*/
748	function wpbc_sanitize_date_dmy( $value ) {
749
750	if ( $value === '' ) return $value;
751
752	if ( preg_match("/^(0[1-9]\|[1-2][0-9]\|3[0-1]).(0[1-9]\|1[0-2]).[0-9]{4}$/", $value ) ) {
753
754	return $value; // Date is valid in format: 31.05.2022
755	} else {
756	return '';
757	}
758
759	}
760
761
762	//FixIn: 9.9.1.1
763	/**
764	* Check about Valid date(s), like CSV Dates: such as: '11.11.2025, 12.11.2025, 13.11.2025' or '2024-02-06, 2024-02-10' and then return them sanitized dates or ''
765	*
766	* @param string $value
767	*
768	* @return string '2022-05-31' or ''
769	*/
770	function wpbc_sanitize_csv_dates( $value ) {
771
772	if ( '' === $value ) { return $value; }
773
774	$value = str_replace( ';', ',', $value );
775	$array_of_nums = explode( ',', $value );
776
777	$result = array();
778
779	foreach ( $array_of_nums as $single_date ) {
780
781	$single_date = trim( $single_date );
782
783	// Check for date '2024-02-06
784	$date_ymd = wpbc_sanitize_date( $single_date );
785
786	if ( '' !== $date_ymd ) {
787	$result[] = $date_ymd;
788	} else {
789
790	// Otherwise check for date: '06.02.2024'
791	$date_dmy = wpbc_sanitize_date_dmy( $single_date );
792	if ( '' !== $date_dmy ) {
793	$result[] = $date_dmy;
794	}
795	}
796	}
797
798	$result = implode( ',', $result );
799
800	return $result;
801	}
802
803
804
805
806	/**
807	* Escape string from SQL for the HTML form field
808	*
809	* @param string $value
810	*
811	* @return string
812	*
813	* Used: esc_sql function.
814	*
815	* https://codex.wordpress.org/Function_Reference/esc_sql
816	* Note: Be careful to use this function correctly. It will only escape values to be used in strings in the query.
817	* That is, it only provides escaping for values that will be within quotes in the SQL (as in field = '{$escaped_value}').
818	* If your value is not going to be within quotes, your code will still be vulnerable to SQL injection.
819	* For example, this is vulnerable, because the escaped value is not surrounded by quotes in the SQL query:
820	* ORDER BY {$escaped_value}. As such, this function does not escape unquoted numeric values, field names, or SQL keywords.
821	*
822	*/
823	function wpbc_sanitize_text( $value ){
824
825	$value_trimmed = trim( stripslashes( $value ) ); // \' becomes ' and so on
826
827	$esc_sql_value = sanitize_textarea_field( $value_trimmed ); // preserves new lines (\n) and other whitespace
828	//$esc_sql_value = sanitize_text_field( $value_trimmed ); // remove new lines (\n) and other whitespace
829
830	//global $wpdb;
831	//$value = trim( $wpdb->prepare( "'%s'", $esc_sql_value ) , "'" );
832	//$esc_sql_value = trim( stripslashes( $esc_sql_value ) );
833
834	return $esc_sql_value;
835	}
836
837
838
839
840	/**
841	* Escape string from SQL for the HTML form field
842	*
843	* @param string $value
844	*
845	* @return string
846	*
847	* Used: esc_sql function.
848	*
849	* https://codex.wordpress.org/Function_Reference/esc_sql
850	* Note: Be careful to use this function correctly. It will only escape values to be used in strings in the query.
851	* That is, it only provides escaping for values that will be within quotes in the SQL (as in field = '{$escaped_value}').
852	* If your value is not going to be within quotes, your code will still be vulnerable to SQL injection.
853	* For example, this is vulnerable, because the escaped value is not surrounded by quotes in the SQL query:
854	* ORDER BY {$escaped_value}. As such, this function does not escape unquoted numeric values, field names, or SQL keywords.
855	*
856	*/
857	function wpbc_sanitize_text_strong( $value ){
858
859	$value_trimmed = trim( stripslashes( $value ) ); // \' becomes ' and so on
860
861	//$esc_sql_value = sanitize_text_field( $value_trimmed ); // remove new lines (\n) and other whitespace
862	$esc_sql_value = sanitize_textarea_field( $value_trimmed ); // preserves new lines (\n) and other whitespace
863
864	// clean any tags
865	$esc_sql_value = preg_replace( '/<[^>]*>/', '', $esc_sql_value );
866	$esc_sql_value = str_replace( '<', ' ', $esc_sql_value );
867	$esc_sql_value = str_replace( '>', ' ', $esc_sql_value );
868	$esc_sql_value = strip_tags( $esc_sql_value );
869
870	//FixIn: 9.7.4.1 - escape coded html/xss // Escape any XSS injection
871	// If we have field converted to 'Unicode Hex Character Code', then we make HTML decode firstly (html_entity_decode) and then make sanitizing
872	$esc_sql_value = sanitize_textarea_field( html_entity_decode( $esc_sql_value ) );
873
874	// $esc_sql_value = str_replace('%', '%', $esc_sql_value ); // clean any % from the form, because otherwise, there is problems with SQL prepare function
875	// $esc_sql_value = str_replace('_', '_', $esc_sql_value ); // clean any _
876
877	// $esc_sql_value = str_replace('^', '^', $esc_sql_value ); // clean any ^ caret symbols
878	// $esc_sql_value = str_replace('~', '~', $esc_sql_value ); // clean any ~ equivalency sign - tilde
879
880	return $esc_sql_value;
881	}