<?php
/**
 * @copyright (c) Kufer Software GmbH, Oderstraße 7, D-84453 Mühldorf
 */

class InputfilterTools extends FilterBasis
{
  
  public function filterString($pName, $pValue)
  {
    
    $value = $pValue;
    if (is_numeric($pName)) { 
      return $this->clearString($value);
    }

    switch ($pName) {
      default:	
        $tmp = $value;
        $tmp = $this->clearString($tmp);
        $tmp = str_replace("'", '', $tmp);
        $tmp = str_replace('"', '', $tmp);

        return str_replace('\\', '', $tmp);
      case 'emailfilepath': 
        $tmp = $value;
        $tmp = $this->clearString($tmp);
        $tmp = str_replace("'", '', $tmp);

        return str_replace('"', '', $tmp);
      case 'widget': 
        $tmp = $value;
        $tmp = $this->clearString($tmp);
        $tmp = str_replace("'", '', $tmp);

        return str_replace('\\', '', $tmp);
      case 'search_kurstitel':  
      case 'search_stichworte':
      case 'search_teilnehmer':
      case 'search_ma_planend':
      case 'Col_kurzbez':
      case 'Col_dauerdetai':
      case 'Col_info':
      case 'Col_info_intern':
      case 'Col_webinfo':
      case 'Col_material':
      case 'Col_abwtage':
      case 'Col_abg_bemerk':
      case 'Col_vorspann':
      case 'Col_nachspann':
      case 'Col_individtermine':
      case 'Col_zielgruppe':
      case 'Col_voraussetzungen':
      case 'Col_ziel':
      case 'Col_methode':
      case 'Col_anmelde':
      case 'bemerkung':
      case 'ueberschrift':
      case 'fusszeile1':
      case 'fusszeile2':
      case 'fusszeile3':
      case 'fusszeile4':
      case 'fusszeile5':
      case 'marqueetext':
      case 'msgNotenHinweis':
      case 'msgNotenHinweisMehrphasig':
        $tmp = $value;
        $tmp = $this->clearString($tmp);
        $tmp = str_replace("'", '', $tmp);

        return str_replace('\\', '', $tmp);
      case 'Col_titel':
      case 'Col_inhalt': 
        $tmp = $this->_protectAgainstXSS($value);
        $tmp = $this->clearString($tmp);
        $tmp = str_replace("'", '', $tmp);

        return str_replace('\\', '', $tmp);
      case 'Col_beginn_dat':		
      case 'Col_ende_dat':
      case 'kurs_ende_dat':
      case 'kurs_beginn_dat':
      case 'vondat':
      case 'bisdat':
      case 'DatVon':
      case 'DatBis':
      case 'kt_von':
      case 'kt_bis':
      case 'Col_druckdatum':
      case 'w_Geburtsdatum':
      case 'Col_gebdat':
      case 'Col_erm_ende':
      case 'Col_datum':
      case 'gueltikeitszeitraum':
        $tmp = $value;
        $tmp = $this->stdFilterString($tmp);

        return ($tmp == '') ? $tmp : $this->getValidDate($tmp);
      case 'Col_anm_ende':
      case 'kurs_anm_ende':
        $tmp = $value;

        return ($tmp == '') ? $tmp : $this->getValidDateTime($tmp);
      case 'Col_beginn_dat_jahreszahlkurz':
      case 'Col_ende_dat_jahreszahlkurz':
        $tmp = $value;
        $tmp = $this->stdFilterString($tmp);

        return ($tmp == '') ? $tmp : $this->getValidDate($tmp, true);
      case 'Col_beginn':			
      case 'Col_ende':
      case 'kurs_beginn':
      case 'kurs_ende':
      case 'starttime':
      case 'endtime':
        $tmp = $value;
        $tmp = $this->stdFilterString($tmp);

        return ($tmp == '') ? $tmp : $this->getValidTime($tmp);
        
      case 'buttonWidth':
      case 'sightid':
      case 'type': 
      case 'Col_teil_min':
      case 'Col_teil_max':
      case 'kurs_teil_max':
      case 'kurs_teil_min':
      case 'kurs_kinder_max':
      case 'kurs_kinder_min':
      case 'Col_kinder_max':
      case 'Col_kinder_min':
      case 's_DozNoSearch':
      case 'DozNoSearch':
      case 'kurseproseite':
      case 'newsproseite':
      case 'kurstageproseite':
      case 'fontsize':
      case 'width':
      case 'font_size':
      case 'td_width':
      case 'einsaetzeproseite':
      case 'tageAbmeldungMoeglich':
      case 'raeumeproseite':
      case 'celltermheight_vert':
      case 'celltermwidth_vert':
      case 'celltermheight_header_vert':
      case 'celltermwidth_header_vert':
      case 'beltermblock_height_vert':
      case 'sperrtermblock_height_vert':
      case 'celltermheight_hori':
      case 'celltermwidth_hori':
      case 'celltermheight_header_hori':
      case 'celltermwidth_header_hori':
      case 'beltermblock_width_hori':
      case 'sperrtermblock_width_hori':
      case 'cellheight_vert':
      case 'cellwidth_vert':
      case 'cellheight_header_vert':
      case 'cellwidth_header_vert':
      case 'belblock_height_vert':
      case 'sperrblock_height_vert':
      case 'cellheight_hori':
      case 'cellwidth_hori':
      case 'cellheight_header_hori':
      case 'cellwidth_header_hori':
      case 'belblock_width_hori':
      case 'sperrblock_width_hori':
      case 'teilnehmerproseite':
      case 'datensaetzeproseite':
      case 'seitenwahlanz':
      case 'BelegschwSt2minProz':
      case 'BelegschwSt2minZahl':
      case 'BelegschwSt2maxProz':
      case 'BelegschwSt2maxZahl':
      case 'BelegschwelleProz':
      case 'BelegschwelleZahl':
      case 'anzahlLastMinuteTage':
      case 'maxAnzTermineProSeite':
      case 'anzahlSpalten':
      case 'dozentenproseite':
      case 'dozseitenwahlanz':
      case 'gebaeudeproseite':
      case 'gebseitenwahlanz':
      case 'kursorteproseite':
      case 'kursortseitenwahlanz':
      case 'vorschau':
      case 'druckAnwKurstagejeSeiteNorm':
      case 'druckAnwKurstagejeSeiteBig':
        return $this->getOnlyNumeric($value);
        
      case 'tool':
      case 'section':
        return $this->getOnlyNumeric($value, true, true);
      case 'anzahlKurshighlights':
      case 'Col_benutzergruppe':
        $tmp = $value;
        if ($tmp != '-1') {
          $tmp = $this->getOnlyNumeric($tmp);
        }

        return $tmp;
      case 'Col_stundenanz':		
      case 'Col_fahrentfernung':
      case 'Col_honsatz':
      case 'kurs_stundenanz':
      case 'kurs_geb_kind':
      case 'kurs_geb_zuskind':
      case 'kurs_geb_schw1':
      case 'kurs_geb_schw2':
      case 'kurs_kinder_geb':
      case 'kurs_tn_schw_1':
      case 'kurs_tn_schw_2':
      case 'Col_geb_kind':
      case 'Col_geb_zuskind':
      case 'Col_geb_schw1':
      case 'Col_geb_schw2':
      case 'Col_kinder_geb':
      case 'Col_tn_schw_1':
      case 'Col_tn_schw_2':
      case 'Col_honfaktor':
      case 'Col_fahrtfaktor':
      case 'Col_fahrtentfernung':
      case 'Col_fahrtkmsatz':
      case 'Col_fahrtdoppelt':
      case 'Col_spesen':
      case 'Col_spesenprotn':
      case 'Col_erm_proz':
        return $this->getOnlyNumeric($value, false);
      case 'Col_progheft':   
      case 'kurs_progheft':
        if ($value == 1) {
          return '1';
        } else {
          return '0';
        }
        
      case 'Col_gebjahr':    
        if (is_numeric($value) && StringOperations::strlen($value) == 4) {
          return $value;
        } else {
          return '2000';
        }

        
        
      case 'anwesenheitsInfo':
      case 'jsonData':
      case 'unterrichtsMittel':
        return $this->clearString($value);

        
      case 'kursplanung_kurzbez':
      case 'kursplanung_titel':
      case 'kursplanung_info':
      case 'kursplanung_beginn_dat_wunsch':
      case 'kursplanung_beginn_wunsch':
      case 'kursplanung_dauer':
      case 'kursplanung_raum_anforderung':
      case 'kursplanung_material':
      case 'kursplanung_bemerkung':
      case 'kursplanung_kursort':
      case 'kursplanung_methode':
      case 'kursplanung_voraussetzungen':
      case 'kursplanung_anmeldebedingungen':
      case 'kursplanung_ziel':
      case 'kursplanung_zielgruppe':
      case 'kurstag_ort':
      case 'kurs_info':
      case 'foto_portrait_inArbeit':
      case 'dozwebdatacheck_taetigkeitsbez':
      case 'dozwebdatacheck_kuenstlername':
      case 'dozwebdatacheck_profil':
      case 'kurs_kurzbez':
      case 'kurs_titel':
        $tmp = $value;
        $tmp = $this->clearString($tmp);

        return str_replace('\\', '', $tmp);
      case 'email_betreff': 
      case 'email_body':
      case 'feedback_betreff':
      case 'feedback_body':
      case 'sms_body':
      case 'nachricht_betreff':
      case 'nachricht_body':
        $tmp = $value;

        return $this->clearString($tmp);
        
      case 'oldpwd':
      case 'newpwd':
      case 'newpwd2':
      case 'Passwort':
      case 'passwort':
      case 'password':
      case 'password_repeat':
      case 'new_password':
      case 'new_password_repeat':
        return $this->filterPasswort($pValue);
    }
  }

  
  public function getValidDate($ptime, $pShortYear = false, $default = '01.01.2000')
  {
    $time = $ptime;
    if (DateTimeOperations::isValidDate($time)) {
      $dateary = explode('.', $time);
      $dateary[0] = ltrim($dateary[0], '0'); 
      $dateary[1] = ltrim($dateary[1], '0'); 
      $dateary[2] = ltrim($dateary[2], '0'); 

      if (StringOperations::strlen($dateary[0]) == 1) { 
        $dateary[0] = '0' . $dateary[0];
      }
      if (StringOperations::strlen($dateary[1]) == 1) { 
        $dateary[1] = '0' . $dateary[1];
      }
      if ($pShortYear) {
        $len = 2;
      } else {
        $len = 3;
      }
      while (StringOperations::strlen($dateary[2]) < $len) { 
        $dateary[2] = '0' . $dateary[2];
      }
      if (StringOperations::strlen($dateary[2]) == 3) {
        $dateary[2] = '2' . $dateary[2];
      }

      
      $dateary[2] = StringOperations::substr($dateary[2], 0, ($pShortYear) ? 2 : 4);

      return implode('.', $dateary);
    }
    else {
      return $default;
    }
  }

  
  public function getValidTime($ptime)
  {
    $time = $ptime;
    $timeary = explode(':', $time);

    while (count($timeary) > 2) {
      array_pop($timeary);
    }

    if (count($timeary) == 1) {
      $timeary[1] = '00';
    }

    $minute = (int)MathOperations::stringToFloat($timeary[1]);
    $stunde = (int)MathOperations::stringToFloat($timeary[0]);

    if ($minute > 59 || $minute < 0) {
      $minute = 0;
    }
    if ($stunde > 24 || $stunde < 0 || ($stunde == 24 && $minute != 0)) {
      $stunde = 0;
    }

    $timeary[1] = MathOperations::floatToStringTruncateNull($minute);
    $timeary[0] = MathOperations::floatToStringTruncateNull($stunde);

    if (StringOperations::strlen($timeary[1]) == 1) {
      $timeary[1] = '0' . $timeary[1];
    }
    if (StringOperations::strlen($timeary[0]) == 1) {
      $timeary[0] = '0' . $timeary[0];
    }

    return implode(':', $timeary);
  }

  public function getValidDateTime(string $pDateTime, bool $pShortYear = false, string $defaultDateTime = '01.01.2000 00:00'): string
  {
    $dateTimeAry = explode(' ', $pDateTime);
    $result = $this->getValidDate($dateTimeAry[0]);
    if (isset($dateTimeAry[1])) {
      $result .= ' ' . $this->getValidTime($dateTimeAry[1]);
    }

    return $result;
  }

  
  public static function getOnlyNumeric($pString, $pGanzzahl = true, $pNegativeZahlenErlauben = false)
  {
    if ($pString === '') {
      return '';
    }
    $vorzeichen = '';
    $pString = (string)$pString;
    if ($pNegativeZahlenErlauben && $pString[0] == '-') {
      $vorzeichen = '-';
    }
    $pattern = '/[^0-9,]+/';
    if ($pGanzzahl) {
      $pattern = str_replace(',', '', $pattern);
    }
    $string = preg_replace($pattern, '', $pString);
    $retour = '';
    if ($pGanzzahl) {
      $retour = $string;
    } else {
      $strlen = StringOperations::strlen($string);
      $erstesKomma = true;
      for ($i = 0; $i < $strlen; $i++) {
        if ($string[$i] == ',') {
          if ($erstesKomma) {
            $retour .= $string[$i];
            $erstesKomma = false;
          }
        } else {
          $retour .= $string[$i];
        }
      }
    }
    
    if (isset($retour[0]) && $retour[0] == ',') {
      $retour = '0' . $retour;
    }
    
    if (isset($retour[StringOperations::strlen($retour) - 1]) && $retour[StringOperations::strlen($retour) - 1] == ',') {
      $retour = str_replace(',', '', $retour);
    }

    return $vorzeichen . $retour;
  }

  
  public function filterSQLStatements($pString, $pInQuote = false, $pSimulateGetSQLValue = false)
  {
    $string = $pString;

    switch (SessionOperations::getVarValueEinst('dbtyp')) {
      case 'MYSQL': $string = str_replace("\\'", '[SINGLEQUOTE]', $string);
        
      case 'MSSQL':
      case 'MSSQLODBC':
      case 'ORACLE':
      default: $string = str_replace("''", '[SINGLEQUOTE]', $string);
    }

    if ($pSimulateGetSQLValue) {
      $pInQuote = true;
      $string = str_replace('`', '[BACKTICK]', $string);
      $string = strtr($string, "'", '`');
    }

    
    
    $strary = explode("'", $string);
    $i = $pInQuote == true ? 1 : 0;
    for (; $i < count($strary); $i += 2) {
      
      

      $strary[$i] = ' ' . $strary[$i] . ' ';

      $strary[$i] = str_replace('/*', '  ', $strary[$i]);
      $strary[$i] = str_replace('*/', '  ', $strary[$i]);
      $strary[$i] = str_replace('--', '  ', $strary[$i]);
      $strary[$i] = str_replace(';', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' select ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' drop ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' create ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' delete ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' insert ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' truncate ', '  ', $strary[$i]);
      $strary[$i] = str_ireplace(' rename ', '  ', $strary[$i]);

      
      $string = StringOperations::substr($string, 1);
      $string = StringOperations::substr($string, 0, -1);

      
      $strary[$i] = StringOperations::substr($strary[$i], 1);
      $strary[$i] = StringOperations::substr($strary[$i], 0, -1);
    }

    if ($pSimulateGetSQLValue) {
      $string = str_replace('[BACKTICK]', '`', $string);
      $string = strtr($string, '`', "'");
    }

    $string = implode("'", $strary);

    return str_replace('[SINGLEQUOTE]', "''", $string);
  }
}