#!/bin/php
<?php

global $xmlelement;
global $isevent;
global $edataarray;
global $edataelement;
global $emeta;
global $infile;
global $configfile;
global $argv;
global $argc;

class EventMeta {
	public $eventrecordid;
	public $time;
	public $eventid;
	public $task;
	public $level;
	public $keywords;
	public $computer;
	public $server;
	public $username;
	public $domainname;
	public $servicename;
	public $data;
	public $status;
	public $result;
	function Clear() {
		$this->eventrecordid = 0;
		$this->time = 0;
		$this->eventid = 0;
		$this->task = "";
		$this->level = "";
		$this->keywords = "";
		$this->computer = "";
		$this->server = "";
		$this->username = "";
		$this->domainname = "";
		$this->servicename = "";
		$this->data = "";
		$this->status = "";
		$this->result= 0;
	}
}

class EventData {
	public $name;
	public $value;
}

$xmlelement = "";
$isevent = false;
$edataelement = new EventData();
$edataarray = array();
$emeta = new EventMeta();
$infile = "";


function sql_addmeta ($data, $darray) {
	$data->status = 0;
	$data->result = 0;

	if ($data->eventid == 0) {
		// do something
	}
	else {
		// default
		if (isset ($darray['IpAddress'])) $data->server = $darray['IpAddress'];
		if (isset ($darray['TargetUserName'])) $data->username = $darray['TargetUserName'];
		if (isset ($darray['TargetDomainName'])) $data->domainname = $darray['TargetDomainName'];
		if (isset ($darray['ServiceName'])) $data->servicename = $darray['ServiceName'];
		if (isset ($darray['Status'])) $data->status = $darray['Status'];
	}

	printf ("INSERT INTO tbl_EventMeta (eventrecordid, time, eventid, task, level, keywords, computer, server, username, domainname, servicename, data, status) VALUES('%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s','%s');\n",
	 	$data->eventrecordid, 
		$data->time,
		$data->eventid, 
		$data->task, 
		$data->level, 
		$data->keywords, 
		$data->computer, 
		$data->server, 
		$data->username, 
		$data->domainname, 
		$data->servicename, 
		$data->data, 
		$data->status
	);
	$data->Clear();
};


function xmlstarthandler($parser, $name, $attribs) {
	global $xmlelement;
	global $edataelement;
	global $emeta;
	
	$xmlelement = $xmlelement . "\t" . $name;
	
	if (count($attribs)) {
		foreach ($attribs as $k => $v) {
			if (strstr($xmlelement, "EVENT\tEVENTDATA\tDATA") <> false && strstr($k, "NAME") <> false) {
				$edataelement->name = $v;
				$edataelement->value = "";
			}
			else if (strstr($xmlelement, "EVENT\tSYSTEM\tTIMECREATED") <> false && strstr($k, "SYSTEMTIME") <> false) {
				$v[strpos($v,'T')] = ' ';
				$v[strpos($v,'Z')] = ' ';
				$emeta->time = $v;
			}
    	}	
    }
};

function xmlendhandler($parser, $name) {
	global $xmlelement;
	global $emeta;
	global $edataelement;
	global $edataarray;

	if (strstr($xmlelement, "EVENT\tSYSTEM") <> false && strstr($name, "SYSTEM") <> false) {
		sql_addmeta ($emeta, $edataarray);
		$edataarray = array();
		$emata = new EventMeta();
	}
	if (strstr($xmlelement, "EVENT\tEVENTDATA\tDATA") <> false && strstr($name, "DATA") <> false) {
		printf ("******************* %s    %s    %s\n", $name, $edataelement->name, $edataelement->value); 
		$edataarray[$edataelement->name] = $edataelement->value;
	}

	$pos = strrpos ($xmlelement, "\t");
	if ($pos == false) $xmlelement = "";
	else $xmlelement = substr($xmlelement, 0, $pos);
};


function filterunsafetext($text) {
	$tmp = "";
	$i = 0;
	for ($i = 0; $i < strlen($text); $i++) {
		if ($text[$i] == " " && strlen($tmp) > 0) $tmp = $tmp.$text[$i];
		else if ($text[$i] == "\n") $tmp = $tmp . " ";
		else if (($text[$i] >= "a" && $text[$i] <= "z") || 
				 ($text[$i] >= "A" && $text[$i] <= "Z") ||
				 ($text[$i] >= "0" && $text[$i] <= "9") ||
				  $text[$i] == "&" || $text[$i] == "%" ||  $text[$i] == "/" ||
				  $text[$i] == "{" || $text[$i] == "}" ||  $text[$i] == "#" ||
			 	  $text[$i] == "." || $text[$i] == "," ||  $text[$i] == "\\" ||
			 	  $text[$i] == "_" || $text[$i] == "*" ||  $text[$i] == ":" ||
				  $text[$i] == "&" || $text[$i] == "%" ||  $text[$i] == "@" ||
				  $text[$i] == "+" || $text[$i] == "-" ) $tmp = $tmp.$text[$i];
	}
	return $tmp;
};



function xmldefaulthandler($parser, $data) {
	global $emeta;
	global $edataelement;
	global $edataelement;
	global $xmlelement;
	
	if (strstr($xmlelement, "EVENT\tEVENTDATA\tDATA") <> false) {
		$edataelement->eventrecordid = $emeta->eventrecordid;
		$edataelement->value = $edataelement->value.filterunsafetext($data);
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tEVENTID") <> false) {
		$emeta->eventid = $data;
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tEVENTRECORDID") <> false) {
		$emeta->eventrecordid = $data;
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tKEYWORDS") <> false) {
		$emeta->keywords = $data;
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tLEVEL") <> false) {
		$emeta->level = $data;
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tCOMPUTER") <> false) {
		$emeta->computer = $data;
	} else if (strstr($xmlelement, "EVENT\tSYSTEM\tTASK") <> false) {
		$emeta->task = $data;
	}
};


function errorexit($text) {
	printf ("%s", $text);
	exit;
};


if (isset ($argv) && isset ($argc)) {
	global $infile;

	$i = 0;

	for ($i = 0; $i < count($argv); $i++) {
		if (strstr($argv[$i], "-in") <> false) {
			$i++;
			if ($i >= $argc) ErrorExit ("filename missing\n");
			$infile = $argv[$i];
		}
	}
};

if ($infile == "") {
	printf ("Parameters:\n");
	printf ("  -in INPUTFILE\n");

    exit;
}

$stream = fopen($infile, 'r');
$parser = xml_parser_create();
xml_set_element_handler($parser, "xmlstarthandler", "xmlendhandler");
xml_set_default_handler($parser, "xmldefaulthandler");
while (($data = fread($stream, 16384))) {
    xml_parse($parser, $data); // parse the current chunk
}
xml_parse($parser, '', true); // finalize parsing
xml_parser_free($parser);
fclose($stream);