PHP check_input函数代码示例

function register()
{
    global $globals, $mysql, $theme, $done, $error;
    global $user;
    global $l;
    $theme['name'] = 'register';
    $theme['call_theme_func'] = 'register';
    loadlang();
    fheader($title = 'Registration');
    if (isset($_POST['sub_register'])) {
        // special characters, etc not allowed
        // only AlphaNumeric and _ (underscore) charachters allowed
        $username = mandff($_POST['username'], $l['user_req']);
        $password = mandff($_POST['password'], $l['pass_req']);
        $email = mandff($_POST['email'], $l['email_req']);
        $url = $_POST['url'];
        if ($error) {
            return false;
        }
        // cleanup of $_POST not happening.
        // now cleanup of POST happening
        foreach ($_POST as $k => $v) {
            $v = check_input($v);
        }
        $username = $username;
        $password = $password;
        $email = $email;
        $url = $url;
        $salt = 'abc';
        // by default the level of user & privileges are minimum, level=1
        $group = 1;
        // Password & Salt getting md5()'d
        $password = md5($password . $salt);
        $q1 = "SELECT `email` FROM `users` WHERE `email` = '{$email}'";
        $qq1 = mysql_query($q1);
        if (mysql_num_rows($qq1) > 0) {
            $error['email_exists'] = $l['email_exists'];
            return false;
        }
        // $q = "INSERT INTO `users`(`username`, `password`, `email`, `url`, `salt`) VALUES('$username', '$password', '$email', '$url', '$salt') ";
        $q[1] = "INSERT INTO `users`(`username`, `password`, `email`, `url`, `salt`, `group`) VALUES('{$username}', '{$password}', '{$email}', '{$url}', '{$salt}', '{$group}')";
        $qu[1] = mysql_query($q[1]);
        //$ins_id = mysql_insert_id($qu[1]);
        $ins_id = mysql_insert_id();
        //echo "ins_id = " . $ins_id;
        // an insert id goes in here, which becomes the user[uid]
        $q[2] = "INSERT INTO `profile` (`users_uid`) VALUES('{$ins_id}')";
        $qu[2] = mysql_query($q[2]);
        $q[3] = "INSERT INTO `ai_actions_taken` (`users_uid`) VALUES('{$ins_id}')";
        $qu[3] = mysql_query($q[3]);
        if ($qu[1]) {
            $done = true;
        } else {
            $errors = 'faltugiri';
        }
    }
}

function ban($userId = null)
{
    global $themedir, $l;
    global $globals, $mysql, $theme, $done, $errors;
    global $user, $notice, $reqPrivs;
    global $qu;
    $theme['name'] = 'bannedList';
    $theme['call_theme_func'] = 'ban';
    loadlang();
    //printrr( $reqPrivs );
    fheader('Ban/Unban');
    /*
    //if ( $notLogged )
    if ( !userUidSet() )
    {
    	$notice['login'] = "Please login <a href='index.php?action=login'>here</a>, you will need to login before proceeding.";
    	return false;
    }
    */
    // Check this line again, y putting 0 in last?
    // $uid = ( isset($_GET['uid'] ) ? (int) check_input( $_GET['uid'] ) : 0 );
    // For banning, a user[uid] has to be present in the URL,
    // it its not, then it has to be passed in the function,
    // still if its not, then take it as null, or just return with an error[user_id_empty]
    $uid = isset($_GET['uid']) ? (int) check_input($_GET['uid']) : $userId;
    if (isset($_GET['action']) && $_GET['action'] == 'unban') {
        $q = "DELETE FROM `banned` WHERE `ban_uid`={$uid}";
        $qu = mysql_query($q);
        if ($qu) {
            $notice['unbanned'] = 'User unbanned successfully.';
        } else {
            $error['unbanning_error'] = 'Error while unbanning the user, please try again.';
        }
        return;
    }
    // $q = "SELECT * FROM `banned` b left join `users` u on b.ban_uid = u.uid";
    $q = "SELECT * FROM `banned` WHERE `ban_uid`={$uid}";
    $qu = mysql_query($q);
    // mysql num rows is zero, so user is not banned, so show ban link & ban him
    // fire an INSERT query
    if (mysql_num_rows($qu) == 0) {
        $qI1 = "INSERT INTO `banned`(`ban_uid`, `banned`) VALUES({$uid}, 1)";
        $qI1_e = db_query($qI1);
        $qU1 = "UPDATE `users` set `is_banned`=1 WHERE `uid`='{$uid}'";
        $qU1_e = db_query($qU1);
        if ($qI1_e && $qU1_e) {
            $notice['banned'] = 'User banned successfully!!!';
        } else {
            $error['cudnt_ban'] = 'Couldn\'t ban the user, please try again.';
        }
    } else {
        // user already exists in ban list, so show unban link, and unban him
        $notice['banned'] = 'User already exists in ban list!!!';
    }
}

/**
 * tarski_output_navbarinclude() - Adds $navbarInclude variable from constants.php to navbar.
 * 
 * @since 1.5
 * @param array $input
 * @global string $navbarInclude
 * @return array $navbarInclude
 */
function tarski_output_navbarinclude($navbar)
{
    global $navbarInclude;
    if (!check_input($navbar, 'array')) {
        $navbar = array();
    }
    if ($navbarInclude) {
        $navbar['navbarinclude'] = $navbarInclude;
    }
    return $navbar;
}

function ssm_send_email()
{
    add_filter('wp_mail_content_type', 'ssm_set_html_content_type');
    function ssm_set_html_content_type()
    {
        return 'text/html';
    }
    //$attachments =  array( WP_CONTENT_DIR . '/uploads/2015/07/04_The-Make-Up.mp3' );
    $headers = 'From: ' . get_option('ssm_email_newsletter_from_name') . ' <' . get_option('ssm_email_newsletter_from_email') . '>' . "\r\n";
    $to = check_input($_REQUEST['sm_email']);
    $subject = get_option('ssm_email_newsletter_subject');
    $message = get_option('ssm_email_newsletter');
    wp_mail($to, $subject, $message, $headers);
    remove_filter('wp_mail_content_type', 'ssm_set_html_content_type');
}

function lookItUp($username, $password)
{
    $con = mysql_connect("newer.cwglba5cwihw.us-east-1.rds.amazonaws.com/UserInfo", "bob", "james123");
    if (!$con) {
        die('Could not connect: ' . mysql_error());
    }
    $user = $username;
    $pwd = $password;
    // Make a safe SQL
    $user = check_input($_POST['user']);
    $pwd = check_input($_POST['pwd']);
    $sql = "SELECT * FROM users WHERE\nuser={$user} AND password={$pwd}";
    return mysql_query($sql);
    mysql_close($con);
}

 private function set_page()
 {
     if (check_input('number', $_GET['page'])) {
         if ($_GET['page'] > 0) {
             if ($_GET['page'] > $this->mPageCount) {
                 return $this->mPageCount;
             } else {
                 return $_GET['page'];
             }
         } else {
             return 1;
         }
     } else {
         return 1;
     }
 }

function permissions()
{
    global $globals, $mysql, $theme, $done, $error;
    global $user;
    global $l;
    $theme['name'] = 'permissions';
    $theme['call_theme_func'] = 'permissions';
    loadlang();
    fheader($title = 'Permissions');
    if (isset($_POST['sub_register'])) {
        $email = mandff($_POST['email'], $l['user_email_req']);
        $password = mandff($_POST['password'], $l['pass_req']);
        if ($error) {
            return false;
        }
        // cleanup of $_POST not happening.
        // now cleanup of POST happening
        foreach ($_POST as $k => $v) {
            $v = check_input($v);
        }
        $email = $email;
        $password = $password;
        $salt = 'abc';
        // Password & Salt getting md5()'d
        $password = md5($password . $salt);
        /*
         * Select only 1 column from email or username
        $q1 = "SELECT * FROM `users` WHERE 
        ( 
        ( `email` = '$email' OR username = '$email' ) 
        AND 
        `password` = '$password' 
        ) ";
        */
        $q1 = "SELECT * FROM `users` WHERE \n\t\t`email` = '{$email}' AND `password` = '{$password}' \n\t\tOR \n\t\tusername = '{$email}' AND `password` = '{$password}' \n\t\t";
        $qq1 = db_query($q1);
        if (mysql_num_rows($qq1) > 0) {
            $done = true;
            // if successful login, redirect to index.php
            header("Location: index.php");
        } else {
            $error[] = 'Username/Email not valid';
        }
    }
}

function submit_preview($subject, $abstract, $article, $section)
{
    global $allowed_html, $theme, $user;
    include "includes/story.inc";
    $output .= "<FORM ACTION=\"submit.php\" METHOD=\"post\">\n";
    $output .= "<B>" . t("Your name") . ":</B><BR>\n";
    $output .= format_username($user->userid) . "<P>";
    $output .= "<B>" . t("Subject") . ":</B><BR>\n";
    $output .= "<INPUT TYPE=\"text\" NAME=\"subject\" SIZE=\"50\" MAXLENGTH=\"60\" VALUE=\"" . check_textfield($subject) . "\"><P>\n";
    $output .= "<B>" . t("Section") . ":</B><BR>\n";
    foreach ($sections = section_get() as $value) {
        $options .= "  <OPTION VALUE=\"{$value}\"" . ($section == $value ? " SELECTED" : "") . ">{$value}</OPTION>\n";
    }
    $output .= "<SELECT NAME=\"section\">{$options}</SELECT><P>\n";
    $output .= "<B>" . t("Abstract") . ":</B><BR>\n";
    $output .= "<TEXTAREA WRAP=\"virtual\" COLS=\"50\" ROWS=\"10\" NAME=\"abstract\">" . check_textarea($abstract) . "</TEXTAREA><BR>\n";
    $output .= "<SMALL><I>" . t("Allowed HTML tags") . ": " . htmlspecialchars($allowed_html) . ".</I></SMALL><P>\n";
    $output .= "<B>" . t("Extended story") . ":</B><BR>\n";
    $output .= "<TEXTAREA WRAP=\"virtual\" COLS=\"50\" ROWS=\"15\" NAME=\"article\">" . check_textarea($article) . "</TEXTAREA><BR>\n";
    $output .= "<SMALL><I>" . t("Allowed HTML tags") . ": " . htmlspecialchars($allowed_html) . ".</I></SMALL><P>\n";
    $duplicate = db_result(db_query("SELECT COUNT(id) FROM stories WHERE subject = '" . check_input($subject) . "'"));
    if (empty($subject)) {
        $output .= "<FONT COLOR=\"red\">" . t("Warning: you did not supply a subject.") . "</FONT><P>\n";
        $output .= "<INPUT TYPE=\"submit\" NAME=\"op\" VALUE=\"" . t("Preview submission") . "\">\n";
    } else {
        if (empty($abstract)) {
            $output .= "<FONT COLOR=\"red\">" . t("Warning: you did not supply an abstract.") . "</FONT><P>\n";
            $output .= "<INPUT TYPE=\"submit\" NAME=\"op\" VALUE=\"" . t("Preview submission") . "\">\n";
        } else {
            if ($duplicate) {
                $output .= "<FONT COLOR=\"red\">" . t("Warning: there is already a story with that subject.") . "</FONT><P>\n";
                $output .= "<INPUT TYPE=\"submit\" NAME=\"op\" VALUE=\"" . t("Preview submission") . "\">\n";
            } else {
                $output .= "<INPUT TYPE=\"submit\" NAME=\"op\" VALUE=\"" . t("Preview submission") . "\">\n";
                $output .= "<INPUT TYPE=\"submit\" NAME=\"op\" VALUE=\"" . t("Submit submission") . "\">\n";
            }
        }
    }
    $output .= "</FORM>\n";
    $theme->header();
    $theme->story(new Story($user->userid, $subject, $abstract, $article, $section, time()), "[ " . t("reply to this story") . " ]");
    $theme->box(t("Submit a story"), $output);
    $theme->footer();
}

/**
 * implode_proper() - Implodes an array and adds a final conjuction.
 * 
 * Given the array <code>array('John', 'Paul', 'George', 'Ringo')</code> it will
 * return the string <code>'John, Paul, George and Ringo'</code>.
 * @since 2.0
 * @param $array array
 * @param $glue string
 * @param $last_connective string
 * @return string
 */
function implode_proper($array, $glue = NULL, $last_connective = NULL)
{
    if (!check_input($array, 'array') || count($array) == 0) {
        return;
    }
    if ($glue == NULL) {
        $glue = __(', ', 'tarski');
    }
    if ($last_connective == NULL) {
        $last_connective = __('and', 'tarski');
    }
    $last_value = array_pop($array);
    if (count($array)) {
        $output = implode($glue, $array) . " {$last_connective} {$last_value}";
    } else {
        $output = $last_value;
    }
    return $output;
}

function viewProfile()
{
    global $themedir;
    global $globals, $mysql, $theme, $done, $errors, $notice;
    global $l;
    global $time;
    global $user, $reqPrivs;
    global $q, $qu;
    $theme['name'] = 'viewProfile';
    $theme['call_theme_func'] = 'viewProfile';
    loadlang();
    // fheader($title = 'View Profile');
    fheader("View Profile");
    // if NOT logged in, then redirect to "index.php?action=login" , ONLY for the moment
    // if from Admin Board Settings table, loginReq column is 1, then, login is required to view
    // so redirect him to login page
    if ($reqPrivs['board']['loginReq']) {
        if (!userUidSet()) {
            redirect("{$globals['boardurl']}{$globals['only_ind']}action=login");
        }
    }
    // Base64encode for everything coming from URL
    // Checking input, checking everything coming from $_GET url,
    // sanitizing it, and casting it into an (int) datatype
    $uid = isset($_GET["uid"]) ? (int) check_input($_GET["uid"]) : $user["uid"];
    // Add if $user['uid'] != $_GET['uid'] , then, see if he is Admin or Editor
    // Else, Not allowed to access this area, permission denied & return false
    // ---Permission stuff here---
    // or probably uid=$_GET[id] to see other's profile
    // $q  = "SELECT * FROM `users` `u` RIGHT JOIN `profile` `p` ON u.uid=p.users_uid WHERE `users_uid`=$uid";
    // Working
    // $q  = "SELECT * FROM `users` `u` RIGHT JOIN `profile` `p` ON u.uid=p.users_uid WHERE `u`.`uid`=$uid";
    $qu = array();
    // $q  = "SELECT * FROM `users` `u` RIGHT JOIN `profile` `p` ON `u`.`uid`=`p`.`users_uid` JOIN `banned` `b` on `u`.`uid`=`b`.`ban_uid` WHERE `u`.`uid`=$uid";
    $q1 = "SELECT * FROM `users` `u` RIGHT JOIN `profile` `p` ON `u`.`uid`=`p`.`users_uid` WHERE `u`.`uid`={$uid}";
    // JOIN `banned` `b` on `u`.`uid`=`b`.`ban_uid`
    $qu[1] = db_query($q1);
    $q2 = "SELECT * FROM `banned` `b` WHERE  `ban_uid`={$uid}";
    $qu[2] = db_query($q2);
}

function func_add_student($login, $option, $db)
{
    $col_students = $db->students;
    if ($login == "") {
        echo "Usage: ./etna_movies.php add_student <login_l>\n";
    } else {
        if ($col_students->find(array('login' => $login))->count() == 0) {
            $nom = my_readline("Name ?\n> ");
            $age = my_readline("Age ?\n> ");
            $email = my_readline("Email ?\n> ");
            $phone = my_readline("Phone number ?\n> ");
            if (check_input($login, $nom, $age, $email, $phone)) {
                $student = array("login" => $login, "name" => $nom, "age" => $age, "email" => $email, "phone" => $phone, "rented_movies" => []);
                $col_students->insert($student);
                echo "User registered !\n";
            } else {
                echo "Incorrect input\n";
            }
        } else {
            echo "Login already used\n";
        }
    }
}

function ad_request($data)
{
    global $request_settings;
    prepare_r_hash();
    if (!isset($data['rt'])) {
        $data['rt'] = '';
    }
    if (isset($data['p'])) {
        $request_settings['referer'] = $data['p'];
    } else {
        $request_settings['referer'] = '';
    }
    if (isset($data['longitude'])) {
        $request_settings['longitude'] = $data['longitude'];
    } else {
        $request_settings['longitude'] = '';
    }
    if (isset($data['latitude'])) {
        $request_settings['latitude'] = $data['latitude'];
    } else {
        $request_settings['latitude'] = '';
    }
    if (isset($data['iphone_osversion'])) {
        $request_settings['iphone_osversion'] = $data['iphone_osversion'];
    }
    if (!isset($data['sdk']) or $data['sdk'] != 'banner' && $data['sdk'] != 'vad') {
        $request_settings['sdk'] = 'banner';
    } else {
        $request_settings['sdk'] = $data['sdk'];
    }
    /*Identify Response Type*/
    switch ($data['rt']) {
        case 'javascript':
            $request_settings['response_type'] = 'json';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'json':
            $request_settings['response_type'] = 'json';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'iphone_app':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'android_app':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'ios_app':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'ipad_app':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'fetch';
            break;
        case 'xml':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'request';
            break;
        case 'api':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'request';
            break;
        case 'api-fetchip':
            $request_settings['response_type'] = 'xml';
            $request_settings['ip_origin'] = 'fetch';
            break;
        default:
            $request_settings['response_type'] = 'html';
            $request_settings['ip_origin'] = 'request';
            break;
    }
    if (MAD_MAINTENANCE) {
        noad();
    }
    if (!check_input($data)) {
        global $errormessage;
        print_error(1, $errormessage, $request_settings['sdk'], 1);
        return false;
    }
    global $zone_detail;
    $zone_detail = get_placement($data);
    if (!$zone_detail) {
        global $errormessage;
        print_error(1, $errormessage, $request_settings['sdk'], 1);
        return false;
    }
    $request_settings['adspace_width'] = $zone_detail['zone_width'];
    $request_settings['adspace_height'] = $zone_detail['zone_height'];
    $request_settings['channel'] = getchannel();
    update_last_request();
    set_geo($request_settings['ip_address']);
    set_device($request_settings['user_agent']);
    build_query();
    if ($campaign_query_result = launch_campaign_query($request_settings['campaign_query'])) {
        if (!process_campaignquery_result($campaign_query_result)) {
            launch_backfill();
        }
    } else {
//.........这里部分代码省略.........

        return false;
    }
    return true;
}
function check_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
if (isset($_POST['submit'])) {
    if (verifyFormToken('form1')) {
        $name = check_input($_POST["name"]);
        $email = check_input($_POST["emailaddress"]);
        $message = check_input($_POST["message"]);
        $ForwardTo = 'tonyr@constructionofhope.org';
        $details = 'Name: ' . $name . "\n" . 'Email: ' . $email . "\n" . 'Message: ' . $message . "\n";
        $data['success'] = true;
        $data['message'] = 'Success!';
        mail($ForwardTo, "Construction of Hope Contact", $details, "From:{$email}");
    } else {
        $data['success'] = false;
        $data['errors'] = $errors;
    }
    exit('
      <body>

    <div class="modal fade" tabindex="-1" role="dialog">
  <div class="modal-dialog">
    <div class="modal-content" style="top:4em">

        return $error;
    }
    if ($password_new != $password_conf) {
        $error = "<font color=\"red\">The passwords don't match!</font>";
        return $error;
    }
    if (!check_password($password_new) && $_COOKIE["security_level"] == "2") {
        $error = "<font color=\"red\">The new password is not valid!<br />Password policy: minimum 6 characters containing at least one uppercase letter, lowercase letter and number.";
        return $error;
    }
    return $error;
}
if (isset($_POST["action"])) {
    $password_new = $_REQUEST["password_new"];
    $password_conf = $_REQUEST["password_conf"];
    $message = check_input($password_new, $password_conf);
    // Debugging
    // echo "I was here!";
    if (!$message) {
        $login = $_SESSION["login"];
        $password_new = mysqli_real_escape_string($link, $password_new);
        $password_new = hash("sha1", $password_new, false);
        $password_curr = $_REQUEST["password_curr"];
        $password_curr = mysqli_real_escape_string($link, $password_curr);
        $password_curr = hash("sha1", $password_curr, false);
        $sql = "SELECT password FROM users WHERE login = '" . $login . "' AND password = '" . $password_curr . "'";
        // Debugging
        // echo $sql;
        $recordset = $link->query($sql);
        if (!$recordset) {
            die("Error: " . $link->error);

$page_type = "website";
// website or blog *トップページのみ記述
$page_ogimage = "";
// og:imageを個別に設定する場合パスを記述
function check_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
$name = check_input($_POST["name"]);
$tel = check_input($_POST["tel"]);
$email = check_input($_POST["email"]);
$company = check_input($_POST["company"]);
$text = check_input($_POST["text"]);
//入力チェック
$errormsg = array();
//名前
if ($name == null) {
    $errormsg[] = "NAMEを入力してください。";
}
if ($email == null) {
    $errormsg[] = "E-MAILを入力してください。";
}
$ret = preg_match("/^[a-zA-Z0-9_\\.\\-]+?@[A-Za-z0-9_\\.\\-]+\$/", $email);
if (!$ret) {
    $errormsg[] = "E-MAILを正しい形式で入力して下さい。";
}
//内容
if ($text == null) {