PHP check_url函数代码示例

function tpl_function_qishi_news_show($params, &$smarty)
{
    global $db, $_CFG;
    $arr = explode(',', $params['set']);
    foreach ($arr as $str) {
        $a = explode(':', $str);
        switch ($a[0]) {
            case "资讯ID":
                $aset['id'] = $a[1];
                break;
            case "列表名":
                $aset['listname'] = $a[1];
                break;
        }
    }
    $aset = array_map("get_smarty_request", $aset);
    $aset['id'] = $aset['id'] ? intval($aset['id']) : 0;
    $aset['listname'] = $aset['listname'] ? $aset['listname'] : "list";
    unset($arr, $str, $a, $params);
    $sql = "select id,subsite_id,content,title,seo_keywords,seo_description,type_id,addtime from " . table('article') . " WHERE  id=" . intval($aset['id']) . " AND  is_display=1 LIMIT 1";
    $val = $db->getone($sql);
    if (empty($val)) {
        header("HTTP/1.1 404 Not Found");
        $smarty->display("404.htm");
        exit;
    }
    check_url($val['subsite_id'], $smarty, $_CFG['news_url']);
    $val['content'] = htmlspecialchars_decode($val['content'], ENT_QUOTES);
    if ($val['seo_keywords'] == "") {
        $val['keywords'] = $val['title'];
    } else {
        $val['keywords'] = $val['seo_keywords'];
    }
    if ($val['seo_description'] == "") {
        $val['description'] = cut_str(strip_tags($val['content']), 60, 0, "");
    } else {
        $val['description'] = $val['seo_description'];
    }
    if (intval($_CFG['subsite_id']) > 0) {
        $other_wheresql = " AND subsite_id=" . intval($_CFG['subsite_id']) . " ";
    }
    $prev = $db->getone("select id,subsite_id,title from " . table('article') . " where id<" . $val['id'] . " and type_id=" . $val['type_id'] . $other_wheresql . " order by id desc limit 1");
    if (!$prev) {
        $val['prev'] = 0;
    } else {
        $val['prev'] = 1;
        $val['prev_title'] = $prev['title'];
        $val['prev_url'] = url_rewrite("QS_newsshow", array('id' => $prev['id']), 1, $prev['subsite_id']);
    }
    $next = $db->getone("select id,subsite_id,title from " . table('article') . " where id>" . $val['id'] . " and type_id=" . $val['type_id'] . $other_wheresql . " limit 1");
    if (!$next) {
        $val['next'] = "没有了";
    } else {
        $val['next'] = 1;
        $val['next_title'] = $next['title'];
        $val['next_url'] = url_rewrite("QS_newsshow", array('id' => $next['id']), 1, $next['subsite_id']);
    }
    $smarty->assign($aset['listname'], $val);
}

/**
 *  Customize RSS feed icon
 *
 * @param $url
 *   URL for RSS icon to link to
 * @param $title
 *   Title for RSS icon
 * @return a string containing the RSS icon output.
 */
function txtconnect_theme_feed_icon($url, $title)
{
    if ($image = theme('image', '/misc/feed.png', t('RSS Feed'), $title)) {
        $output = '<div id="top-feed-container"><a href="' . check_url($url) . '" class="feed-icon">' . $image . '</a> ';
        $output .= '<a href="' . check_url($url) . '" class="feed-icon">RSS Feed</a></div>';
        return $output;
    }
}

function build_url($url)
{
    if (check_url($url)) {
        return $url;
    } else {
        return config::standard_protocol . $url;
    }
}

function tpl_function_qishi_curriculum_show($params, &$smarty)
{
    global $db, $timestamp, $_CFG;
    $arr = explode(',', $params['set']);
    foreach ($arr as $str) {
        $a = explode(':', $str);
        switch ($a[0]) {
            case "¿Î³ÌID":
                $aset['id'] = $a[1];
                break;
            case "ÁбíÃû":
                $aset['listname'] = $a[1];
                break;
            case "ÃèÊö³¤¶È":
                $aset['brieflylen'] = $a[1];
                break;
            case "Ìî²¹×Ö·û":
                $aset['dot'] = $a[1];
                break;
        }
    }
    $aset = array_map("get_smarty_request", $aset);
    $aset['id'] = $aset['id'] ? intval($aset['id']) : 0;
    $aset['brieflylen'] = isset($aset['brieflylen']) ? intval($aset['brieflylen']) : 0;
    $aset['listname'] = $aset['listname'] ? $aset['listname'] : "list";
    $wheresql = " WHERE id={$aset['id']} ";
    $sql = "select id,subsite_id,uid,setmeal_deadline,add_mode,train_id,contents,refreshtime,teacher_id,teacher_cn,trainname,course_name,addtime,click,favour_expenses,train_expenses,classhour,category_cn,starttime,classtype_cn,district_cn,train_object,train_certificate from " . table('course') . $wheresql . " LIMIT 1";
    $val = $db->getone($sql);
    if (empty($val)) {
        header("HTTP/1.1 404 Not Found");
        $smarty->display("404.htm");
        exit;
    } else {
        check_url($val['subsite_id'], $smarty, $_CFG['train_url']);
        if ($val['setmeal_deadline'] < time() && $val['setmeal_deadline'] != "0" && $val['add_mode'] == "2") {
            $val['deadline'] = $val['setmeal_deadline'];
        }
        $val['course_url'] = url_rewrite('QS_courseshow', array('id' => $val['id']), 1, $val['subsite_id']);
        $profile = GetTainProfile($val['train_id']);
        $val['train'] = $profile;
        $val['expire'] = sub_day($val['deadline'], time());
        $val['countapply'] = $db->get_total("SELECT COUNT(*) AS num FROM " . table('personal_course_apply') . " WHERE course_id= '{$val['id']}'");
        if ($aset['brieflylen'] > 0) {
            $val['briefly'] = cut_str(strip_tags($val['contents']), $aset['brieflylen'], 0, $aset['dot']);
        } else {
            $val['briefly'] = strip_tags($val['contents']);
        }
        $val['refreshtime_cn'] = daterange(time(), $val['refreshtime'], 'Y-m-d', "#FF3300");
        $val['train_url'] = url_rewrite('QS_train_agencyshow', array('id' => $val['train_id']));
        $val['teacher_url'] = url_rewrite('QS_train_lecturershow', array('id' => $val['teacher_id']));
        if ($val['train']['logo']) {
            $val['train']['logo'] = $_CFG['site_dir'] . "data/train_logo/" . $val['train']['logo'];
        } else {
            $val['train']['logo'] = $_CFG['site_dir'] . "data/train_logo/no_logo.gif";
        }
    }
    $smarty->assign($aset['listname'], $val);
}

 /**
  * Checks that harmful protocols are stripped.
  */
 function testBadProtocolStripping()
 {
     // Ensure that check_url() strips out harmful protocols, and encodes for
     // HTML.
     // Ensure \Drupal\Component\Utility\UrlHelper::stripDangerousProtocols() can
     // be used to return a plain-text string stripped of harmful protocols.
     $url = 'javascript:http://www.example.com/?x=1&y=2';
     $expected_plain = 'http://www.example.com/?x=1&y=2';
     $expected_html = 'http://www.example.com/?x=1&y=2';
     $this->assertIdentical(check_url($url), $expected_html, 'check_url() filters a URL and encodes it for HTML.');
     $this->assertIdentical(UrlHelper::stripDangerousProtocols($url), $expected_plain, '\\Drupal\\Component\\Utility\\Url::stripDangerousProtocols() filters a URL and returns plain text.');
 }

 /**
  * Confirms that invalid URLs are filtered in link generating functions.
  */
 function testLinkXSS()
 {
     // Test \Drupal::l().
     $text = $this->randomMachineName();
     $path = "<SCRIPT>alert('XSS')</SCRIPT>";
     $link = \Drupal::l($text, Url::fromUserInput('/' . $path));
     $sanitized_path = check_url(Url::fromUri('base:' . $path)->toString());
     $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by _l().', array('@path' => $path)));
     // Test \Drupal\Core\Url.
     $link = Url::fromUri('base:' . $path)->toString();
     $sanitized_path = check_url(Url::fromUri('base:' . $path)->toString());
     $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', ['@path' => $path]));
 }

 /**
  * Confirms that invalid URLs are filtered in link generating functions.
  */
 function testLinkXSS()
 {
     // Test _l().
     $text = $this->randomMachineName();
     $path = "<SCRIPT>alert('XSS')</SCRIPT>";
     $link = _l($text, $path);
     $sanitized_path = check_url(_url($path));
     $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by _l().', array('@path' => $path)));
     // Test _url().
     $link = _url($path);
     $sanitized_path = check_url(_url($path));
     $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', ['@path' => $path]));
 }

function sci_aggregator_block_item($item, $feed = 0)
{
    global $user;
    $output = '';
    if ($user->uid && module_exists('post') && user_access('create post entries')) {
        if ($image = theme('image', 'misc/blog.png', t('post it'), t('post it'))) {
            $output .= '<div class="icon">' . l($image, 'node/add/post', array('attributes' => array('title' => t('Comment on this news item in your personal postings.'), 'class' => 'post-it'), 'query' => "iid={$item->iid}", 'html' => TRUE)) . '</div>';
        }
    }
    // Display the external link to the item.
    $output .= '<a href="' . check_url($item->link) . '">' . check_plain($item->title) . "</a>\n";
    return $output;
}

 /**
  * Confirms that invalid URLs are filtered in link generating functions.
  */
 function testLinkXSS()
 {
     // Test l().
     $text = $this->randomMachineName();
     $path = "<SCRIPT>alert('XSS')</SCRIPT>";
     $link = l($text, $path);
     $sanitized_path = check_url(url($path));
     $this->assertTrue(strpos($link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by l().', array('@path' => $path)));
     // Test #type 'link'.
     $link_array = array('#type' => 'link', '#title' => $this->randomMachineName(), '#href' => $path);
     $type_link = drupal_render($link_array);
     $sanitized_path = check_url(url($path));
     $this->assertTrue(strpos($type_link, $sanitized_path) !== FALSE, format_string('XSS attack @path was filtered by #theme', array('@path' => $path)));
 }

function admin_user_edit($id)
{
    global $db;
    if (isset($_POST['submit'])) {
        if ($db->result(DB_PRE . 'ecp_user', 'COUNT(ID)', 'username = \'' . strsave(htmlspecialchars($_POST['username'])) . '\' AND ID != ' . $id) or $_POST['username'] == '') {
            $_POST['username'] = $db->result(DB_PRE . 'ecp_user', 'username', 'ID = ' . $id);
            table(ERROR, ACCOUNT_ALLREADY_EXIST);
        }
        if ($db->result(DB_PRE . 'ecp_user', 'COUNT(ID)', 'email = \'' . strsave($_POST['username']) . '\' AND ID != ' . $id) or !check_email($_POST['email'])) {
            $_POST['email'] = $db->result(DB_PRE . 'ecp_user', 'email', 'ID = ' . $id);
            if (!check_email($_POST['email'])) {
                table(ERROR, WRONG_EMAIL);
            } else {
                table(ERROR, EMAIL_ALLREADY_EXIST);
            }
        }
        $geburtstag = explode('.', $_POST['birthday']);
        $sql = sprintf('UPDATE ' . DB_PRE . 'ecp_user SET
						username = \'%s\',email = \'%s\',country = \'%s\',
						sex = \'%s\',signatur = \'%s\',realname = \'%s\',
						geburtstag = \'%s\',homepage = \'%s\',icq = \'%s\',
						msn = \'%s\',yahoo = \'%s\',skype = \'%s\',xfire = \'%s\',
						clanname = \'%s\',clanirc = \'%s\',clanhomepage = \'%s\',
						clanhistory = \'%s\',cpu = \'%s\',mainboard = \'%s\',
						ram = \'%s\',gkarte = \'%s\',skarte = \'%s\',
						monitor = \'%s\',maus = \'%s\',tastatur = \'%s\',
						mauspad = \'%s\',internet = \'%s\',festplatte = \'%s\',
						headset = \'%s\',aboutme = \'%s\', wohnort = \'%s\', aim = \'%s\'  
					WHERE ID = ' . $id, strsave(htmlspecialchars(@$_POST['username'])), strsave(@$_POST['email']), strsave(@$_POST['country']), @$_POST['sex'] == 'male' ? 'male' : 'female', strsave(comment_save(@$_POST['signatur'])), strsave(htmlspecialchars(@$_POST['realname'])), (int) @$geburtstag[2] . '-' . (int) @$geburtstag[1] . '-' . (int) @$geburtstag[0], strsave(htmlspecialchars(check_url(@$_POST['homepage']))), strsave(htmlspecialchars(@$_POST['icq'])), strsave(htmlspecialchars(@$_POST['msn'])), strsave(htmlspecialchars(@$_POST['yahoo'])), strsave(htmlspecialchars(@$_POST['skype'])), strsave(htmlspecialchars(@$_POST['xfire'])), strsave(htmlspecialchars(@$_POST['clanname'])), strsave(htmlspecialchars(@$_POST['clanirc'])), strsave(htmlspecialchars(check_url(@$_POST['clanhomepage']))), strsave(htmlspecialchars(@$_POST['clanhistory'])), strsave(htmlspecialchars(@$_POST['cpu'])), strsave(htmlspecialchars(@$_POST['mainboard'])), strsave(htmlspecialchars(@$_POST['ram'])), strsave(htmlspecialchars(@$_POST['gkarte'])), strsave(htmlspecialchars(@$_POST['skarte'])), strsave(htmlspecialchars(@$_POST['monitor'])), strsave(htmlspecialchars(@$_POST['maus'])), strsave(htmlspecialchars(@$_POST['tastatur'])), strsave(htmlspecialchars(@$_POST['mauspad'])), strsave(htmlspecialchars(@$_POST['internet'])), strsave(htmlspecialchars(@$_POST['festplatte'])), strsave(htmlspecialchars(@$_POST['headset'])), strsave(comment_save(@$_POST['aboutme'])), strsave(htmlspecialchars(@$_POST['wohnort'])), strsave(htmlspecialchars(@$_POST['aim'])));
        if ($db->query($sql) and $db->query('UPDATE ' . DB_PRE . 'ecp_user_stats SET comments = ' . (int) $_POST['comments'] . ', money = ' . (double) $_POST['money'] . ' WHERE userID = ' . $id)) {
            header1('?section=admin&site=user');
        }
    } else {
        $tpl = new smarty();
        $row = $db->fetch_assoc('SELECT `username`, `email`, `country`, `sex`, `signatur`, `realname`, `wohnort`, `geburtstag`, `homepage`, `icq`, `msn`, `yahoo`, `skype`, `xfire`, 
											`clanname`, `clanirc`, `clanhomepage`, `clanhistory`, `cpu`, `mainboard`, `ram`, `gkarte`, `skarte`, `monitor`, `maus`, `tastatur`, `mauspad`, 
											`internet`, `festplatte`, `headset`, `aboutme`, `ondelete`, aim, money, comments FROM ' . DB_PRE . 'ecp_user LEFT JOIN ' . DB_PRE . 'ecp_user_stats ON (userID = ID) WHERE ID = ' . $id);
        $row['birthday'] = date('d.m.Y', strtotime($row['geburtstag']));
        foreach ($row as $key => $value) {
            $tpl->assign($key, $value);
        }
        ob_start();
        $tpl->assign('countries', form_country($row['country']));
        $tpl->display(DESIGN . '/tpl/admin/user_edit.html');
        $content = ob_get_contents();
        ob_end_clean();
        main_content(ACCOUNT_EDIT, $content, '', 1);
    }
}

function main($gj_config)
{
    $data = explode('|', $_POST['content']);
    array_remove_empty($data);
    $url_num = count($data);
    $post_data = '';
    foreach ($data as $info) {
        $tmp = explode('^', $info);
        if (empty($tmp[0])) {
            continue;
        }
        $post_data .= 'urlinfo=' . urlencode(base64_encode('url=' . urlencode($tmp[0]) . '&urlSeq=' . $tmp[1])) . '&';
    }
    echo 'gj_plugin_function.gettype_callback_a(' . check_url($gj_config, $post_data, $url_num) . ')';
}

 function admin_settings()
 {
     global $db, $countries;
     if (isset($_POST['submit'])) {
         unset($_POST['submit']);
         $_POST['SITE_URL'] = strrpos($_POST['SITE_URL'], '/') !== strlen($_POST['SITE_URL']) - 1 ? check_url($_POST['SITE_URL'] . '/') : check_url($_POST['SITE_URL']);
         $sql = 'UPDATE ' . DB_PRE . 'ecp_settings SET ';
         foreach ($_POST as $key => $value) {
             $sql .= $key . ' = "' . strsave($value) . '", ';
         }
         $sql = substr($sql, 0, strlen($sql) - 2);
         if ($db->query($sql)) {
             header('Location: ?section=admin&site=settings');
         }
     } else {
         $dir = scan_dir('templates', true);
         $designs = '';
         foreach ($dir as $value) {
             if (is_dir('templates/' . $value)) {
                 $designs .= '<option ' . ($value == DESIGN ? 'selected="selected"' : '') . ' value="' . $value . '">' . $value . '</option>';
             }
         }
         $tpl = new smarty();
         $tpl->assign('designs', $designs);
         $tpl->assign('langs', get_languages());
         $dir = scan_dir('module', true);
         $start = '';
         foreach ($dir as $value) {
             if (is_dir('module/' . $value)) {
                 $start .= '<option ' . ('modul|' . $value == STARTSEITE ? 'selected="selected"' : '') . ' value="modul|' . $value . '">' . $value . '</option>';
             }
         }
         $start .= '<option value="">-----' . OWN_SITES . '----</option>';
         $db->query('SELECT headline, cmsID FROM ' . DB_PRE . 'ecp_cms ORDER BY headline ASC');
         while ($row = $db->fetch_assoc()) {
             $title = json_decode($row['headline'], true);
             isset($title[LANGUAGE]) ? $title = $title[LANGUAGE] : ($title = $title[DEFAULT_LANG]);
             $start .= '<option ' . ('cms|' . $row['cmsID'] == STARTSEITE ? 'selected="selected"' : '') . ' value="cms|' . $row['cmsID'] . '">' . $title . '</option>';
         }
         $tpl->assign('startseite', $start);
         ob_start();
         $tpl->display(DESIGN . '/tpl/admin/settings.html');
         $content = ob_get_contents();
         ob_end_clean();
         main_content(SETTINGS, $content, '', 1);
     }
 }

function get_sonmenu($son_key)
{
    global $menu;
    echo '<div class="left_nav">';
    //计算选中菜单
    /*$is_set=0;
      for($i=0;$i<count($menu['son_key']);$i++){
          $sonmenu=$menu[$i]['sonmenu'];
          for($j=0;$j<count($sonmenu);$j++){
              $show = check_url($sonmenu[$j]['url']);
              if($show){
                  $is_set=1;
                  $menu[$i]['selected'] = $show;
                  $menu[$i]['sonmenu'][$j]['selected']=$show;
              }
          }
      }
      if($is_set==0){
          $menu[1]['selected'] = 1;
          //$menu[0]['sonmenu'][0]['selected']=1;
      }*/
    //显示菜单
    echo '<ul>';
    foreach ($menu[$son_key]['sonmenu'] as $k => $a) {
        $select = check_url($a['url']);
        $selected = $select ? 'selected' : '';
        //验证权限
        //if(!check_admin_level($a['level']) && !check_group_level($a['level'])) continue;
        echo '<li>';
        if ($k == 0) {
            echo '<a href="" class="menu_1selected" style="background: url(' . $menu[$son_key]['bgimg'] . ') no-repeat">' . $menu[$son_key]['title'] . '</a>';
        }
        echo '<a href="' . $a['url'] . '" class="menu_2' . $selected . '">' . $a['title'] . '</a>';
        //获取子导航的第一个地址。给父导航显示连接地址
        /*foreach($a['sonmenu'] as $son){
              //验证权限
              //if(!check_admin_level($son['level']) && !check_group_level($son['level'])) continue;
              if(check_admin_level($son['level']) || check_group_level($son['level'])) {
                  echo('<a href="'.SITE_PATH.ADMIN_PATH.'/'.$son['url'].'" class="menu_1'.$selected.'" style="background:url('.SITE_PATH.ADMIN_PATH.'/'.$template."/".$a['bgimg'].') 12px 4px no-repeat;">'.$a['title'].'</a>');
                  break;
              }
          }*/
        echo '</li>';
    }
    echo '</ul>';
    echo '</div>';
}

function check_copyright($html)
{
    $html_lower = strtolower($html);
    $html_work = $html;
    $i = 0;
    while ($i < 1) {
        $anchor_url = "";
        $html_work = extract_first_anchor_url($html, $anchor_url, True);
        if ($html_work === False) {
            continue;
        }
        if (check_url($html, $anchor_url) == False) {
            return $anchor_url;
        }
        $i++;
    }
    return False;
}

function theme221_l($text, $path, $options = array())
{
    // Merge in defaults.
    $options += array('attributes' => array(), 'html' => TRUE);
    // Append active class.
    if ($path == $_GET['q'] || $path == '<front>' && drupal_is_front_page()) {
        if (isset($options['attributes']['class'])) {
            $options['attributes']['class'] .= ' active';
        } else {
            $options['attributes']['class'] = 'active';
        }
    }
    // Remove all HTML and PHP tags from a tooltip. For best performance, we act only
    // if a quick strpos() pre-check gave a suspicion (because strip_tags() is expensive).
    if (isset($options['attributes']['title']) && strpos($options['attributes']['title'], '<') !== FALSE) {
        $options['attributes']['title'] = strip_tags($options['attributes']['title']);
    }
    return '<a href="' . check_url(url($path, $options)) . '"' . drupal_attributes($options['attributes']) . '>' . ($options['html'] ? $text : check_plain($text)) . '</a>';
}