JSP executes SQL statement code

JSP executes SQL statement code
function ExecuteSQL ($operation, $sql)

{

Global $db;

if ($operation = = ' file ')

{

Require_once phpcms_root. ' include/upload.class.php ';

$savepath = ' data/bakup/';

$upload = new Upload (' UploadFile ', $savepath, ', ' sql ', ' 4096000 ', 1);

if (! $upload->up ())

{

ShowMessage ($upload->error ());

}

$sql = file_get_contents ($upload->uploadedfiles[0][saveto]);

Dir_delete ($savepath. Date (' Y '));

if (Trim ($sql)!= ') Sql_execute ($sql);

}

if (empty ($sql))

{

return false;

}

SQL execution

$sql = Stripslashes ($sql);

$sql = Str_replace ("\", "", $sql);

$sql = Str_replace ("R", "", $sql);

$query _items = Split ("; [ T]{0,}n ", $sql);

foreach ($query _items as $key => $value)

{

if (empty ($value))

{

unset ($query _items[$key]);

}

}

if (count ($query _items) > 1)

{

foreach ($query _items as $key => $value)

{

if (! $result = $db->query ($value, ' silent '))

{

return false;

}

}

return true; Exit function

}

Else

{

if (Preg_match ("/^: update| delete| truncate| alter| drop| flush| Insert| replace| Set| CREATE) \s+/i ", $sql))

{

$result = $db->query ($sql);

return $result;

}

Else

{

$result = $db->query ($sql);

$data =array ();

while ($r = $db->fetch_array ($result))

{

$data []= $r;

}

return $data;

}

}

}