PHP cleanData函数代码示例

 function login($email, $password, $remember_me = false)
 {
     $email = cleanData($email);
     if ($userData = $this->checkUser($email, $password)) {
         $this->loginUser($userData, $remember_me);
         return true;
     }
     return false;
 }

function updateQuery($table, $data, $where)
{
    $count = 0;
    foreach ($data as $field => $value) {
        $count > 0 ? $update .= ', ' : ($update = '');
        $update .= $value === 'NOW()' ? $field . "= NOW()" : $field . '="' . cleanData($value) . '"';
        $count++;
    }
    if (mysql_query('UPDATE ' . $table . ' SET ' . $update . ' WHERE ' . $where . ' LIMIT 1')) {
        return true;
    } else {
        return false;
    }
}

/**
 * Clean form data 
 * 
 * Strips tags and removes/replaces certain characters from post data
 * 
 * @param array $p Post data from a form
 * @return array $p
 */
function cleanData($p)
{
    $returnArray = array();
    foreach ($p as $key => $value) {
        //if value is an array recursively apply this function
        if (is_array($value)) {
            $returnArray[$key] = cleanData($value);
        } else {
            //arrays with strings to find and replace
            $find = array("<?php", "?>");
            $replace = array("", "");
            //trips possible tags (excluding links, bold, italic, lists, paragraphs) first, then removes certain forbidden strings, then removes backslashes, removes the first pargraph tag, removes the first closing paragraph tag, then converts remaining special characters to htmlentities
            $returnArray[$key] = htmlspecialchars(preg_replace('~<p>(.*?)</p>~is', '$1', stripslashes(str_replace($find, $replace, strip_tags($value, "<a><i><b><strong><em><li><ul><ol><br><p><iframe>"))), 1), ENT_QUOTES);
        }
    }
    //return the cleaned array
    return $returnArray;
}

        }
    } else {
        $errors .= $er2;
    }
    return $errors;
}
// When the submit button is pressed Validates and Sanitizes the data
if (isset($submit)) {
    // Checking Date
    $error = cleanData($date, $dateEr1, $dateEr2);
    $errors .= $error;
    // Checking Location
    $error = cleanData($location, $locationEr1, $locationEr2);
    $errors .= $error;
    // Checking Description
    $error = cleanData($desc, $msgEr, $msgEr);
    $errors .= $error;
    // Check to see if there is errors
    if (!$errors) {
        //Insert data in mysql database;
        $sql = "INSERT INTO `blazing`.`vacation` (`id`, `date`, `location`, `desc`) VALUES (NULL, '{$date}', '{$location}', '{$desc}')";
        if (!mysql_query($sql)) {
            echo "<br /> Didn't work";
        } else {
            echo "Saved Results:<br>";
            echo $date . " | " . $location . " | " . $desc . "<br><br>";
            echo '<h1 style="color:green; margin-left:35%; margin-right:50%;">Vacation SUCCESSFULLY CREATED</h1>';
        }
        echo "You have successfully submitted data!<br><br>";
    } else {
        echo $errors;

<?php

require "admin_login.php";
$product = "NailAccessories";
$typenum = '7';
//need to change h2 at line 116
//change num at 89
//change path in 33
//change path at 101
//change num at 102
if (isset($_POST['submit'])) {
    $name = cleanData($_POST['name']);
    $code = cleanData($_POST['code']);
    $price = cleanData($_POST['price']);
    $description = cleanData($_POST['description']);
    //print "Data cleaned";
    addData($name, $code, $price, $description);
} else {
    printform();
}
function cleanData($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    $data = strip_tags($data);
    return $data;
}
function checkPicture()
{
    if (isset($_FILES['picture'])) {

            echo $errors;
        }
    } else {
        $errors .= $er2;
    }
    return $errors;
}
// When the submit button is pressed Validates and Santizes the data
if (isset($submit)) {
    // Checking User Name
    $error = cleanData($user_name, $nameEr1, $nameEr2);
    $errors .= $error;
    // Checking User Email
    $error = cleanData($user_email, $emailEr1, $emailEr2);
    $errors .= $error;
    // Checking Message
    $error = cleanData($msg, $msgEr, $msgEr);
    $errors .= $error;
    // Check to see if there is erros
    if (!$errors) {
        $mail_to = 'wesleegalloway@gmail.com';
        $header = 'From: ' . $_POST['user_name'];
        $subject = 'New Mail from Business website Form Submission';
        $message = 'From: ' . $_POST['user_name'] . "\n" . 'Email: ' . $_POST['user_email'] . "\n" . 'Message:\\n' . $_POST['msg'] . "\n\n";
        mail($mail_to, $subject, $message, $header);
        //echo $message;
        echo "Thank you for your email!<br><br>";
    } else {
        echo $errors;
    }
}

    public function customAjax($id, $data)
    {
        global $dbh;
        global $SETTINGS;
        global $TYPES;
        $return = ['status' => 'success'];
        if ($data['subAction'] == 'list') {
            //list subAction
            $return['options'] = [];
            if ($data['subType'] == 'preDiscount') {
                //list all products and services on the order, plus an order line
                $sth = $dbh->prepare('SELECT CONCAT("P", orderProductID) AS id, name, recurringID, parentRecurringID, date
						FROM products, orders_products
						WHERE orderID = 1 AND products.productID = orders_products.productID
						UNION
						SELECT CONCAT("S", orderServiceID) AS id, name, recurringID, parentRecurringID, date
						FROM services, orders_services
						WHERE orderID = 1 AND services.serviceID = orders_services.serviceID');
                $sth->execute([':orderID' => $id]);
                $return['options'][] = ['value' => 'O', 'text' => 'Order'];
                while ($row = $sth->fetch()) {
                    if ($row['recurringID'] !== null) {
                        $text = 'Recurring: ' . $row['name'];
                    } elseif ($row['parentRecurringID'] !== null) {
                        $text = formatDate($row['date']) . ': ' . $row['name'];
                    } else {
                        $text = $row['name'];
                    }
                    $return['options'][] = ['value' => $row['id'], 'text' => htmlspecialchars($text, ENT_QUOTES | ENT_HTML5, 'UTF-8')];
                }
            } else {
                $discounts = [];
                if ($data['subType'] == 'discount') {
                    //get the list of discounts applied to the item already so we don't apply the same discount twice to the same item
                    $temp = [substr($data['subID'], 0, 1), substr($data['subID'], 1)];
                    $sth = $dbh->prepare('SELECT discountID
							FROM orders_discounts
							WHERE orderID = :orderID AND appliesToType = :appliesToType AND appliesToID = :appliesToID');
                    $sth->execute([':orderID' => $id, ':appliesToType' => $temp[0], ':appliesToID' => $temp[1]]);
                    while ($row = $sth->fetch()) {
                        $discounts[] = $row['discountID'];
                    }
                }
                $sth = $dbh->prepare('SELECT ' . $TYPES[$data['subType']]['idName'] . ', name
						FROM ' . $TYPES[$data['subType']]['pluralName'] . '
						WHERE active = 1');
                $sth->execute();
                while ($row = $sth->fetch()) {
                    if ($data['subType'] != 'discount' || !in_array($row[0], $discounts)) {
                        $return['options'][] = ['value' => $row[0], 'text' => htmlspecialchars($row[1], ENT_QUOTES | ENT_HTML5, 'UTF-8')];
                    }
                }
            }
        } elseif ($data['subAction'] == 'getDefaultPrice') {
            //getDefaultPrice subAction
            $sth = $dbh->prepare('SELECT defaultPrice
					FROM ' . $TYPES[$data['subType']]['pluralName'] . '
					WHERE ' . $TYPES[$data['subType']]['idName'] . ' = :subID');
            $sth->execute([':subID' => $data['subID']]);
            $row = $sth->fetch();
            $return['defaultPrice'] = formatNumber($row['defaultPrice']);
        } elseif ($data['subAction'] == 'add') {
            //add subAction
            $return['status'] = 'fail';
            $subType = $data['subType'];
            unset($data['subAction']);
            unset($data['subType']);
            if ($subType == 'discount') {
                //for discounts, subID contains a one letter indication of the type of item (O = order, P = product, S = service), and the unique subID
                $itemType = substr($data['subID'], 0, 1);
                $uniqueID = substr($data['subID'], 1);
                if ($itemType == 'O') {
                    $itemTypeFull = 'order';
                    $subType = 'discountOrder';
                } elseif ($itemType == 'P') {
                    $itemTypeFull = 'product';
                    $subType = 'discountProduct';
                } elseif ($itemType == 'S') {
                    $itemTypeFull = 'service';
                    $subType = 'discountService';
                }
                if ($itemType == 'O') {
                    $data['subID'] = 0;
                } else {
                    $sth = $dbh->prepare('SELECT ' . $TYPES[$itemTypeFull]['idName'] . '
							FROM orders_' . $TYPES[$itemTypeFull]['pluralName'] . '
							WHERE order' . $TYPES[$itemTypeFull]['formalName'] . 'ID = :uniqueID');
                    $sth->execute([':uniqueID' => $uniqueID]);
                    $row = $sth->fetch();
                    $data['subID'] = $row[0];
                }
            }
            $data = cleanData('order', $subType, $data);
            $return = verifyData('order', $subType, $data);
            if ($return['status'] != 'fail') {
                if ($subType == 'payment') {
                    $dateTS = DateTime::createFromFormat($SETTINGS['dateFormat'] . '|', $data['date'])->getTimestamp();
                    $sth = $dbh->prepare('INSERT INTO orderPayments (orderID, date, paymentType, paymentAmount)
							VALUES(:orderID, :date, :paymentType, :paymentAmount)');
                    $sth->execute([':orderID' => $id, ':date' => $dateTS, ':paymentType' => $data['paymentType'], ':paymentAmount' => $data['paymentAmount']]);
//.........这里部分代码省略.........

	}
	.error {
		color: red;
	}
	</style>
	
</head>

<body>

<?php 
$iderror = $passworderror = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    // Clean data
    $id = cleanData($_POST["id"]);
    $password = cleanData($_POST["password"]);
    if (empty($id)) {
        $iderror = "* Student ID is a required field";
    } else {
        if (!is_numeric($id)) {
            $iderror = "* Student ID is a number";
        }
    }
    if (empty($password)) {
        $passworderror = "* Password is a required field";
        //return;
    }
    // Check for errors
    if (empty($iderror) && empty($passworderror)) {
        // Check user data with database
        // If valid go to next page with sessionID

</a></td>
        <td width="15%" align="center" height="12" class="menutable"><?php 
echo strtoupper($msg_showblogs8);
?>
</td>
        <td width="5%" align="center" height="12" class="menutable"><input type="checkbox" name="log" onclick="selectAll();"></td>
    </tr>
    </table>
    <?php 
$q_blogs = mysql_query("SELECT * FROM " . $database['prefix'] . "blogs \n                            {$sql_order} \n                            LIMIT {$limitvalue}, {$SETTINGS->total}\n                            ") or die(mysql_error());
while ($BLOGS = mysql_fetch_object($q_blogs)) {
    ?>
    <table cellpadding="0" cellspacing="1" width="100%" align="center" style="margin-top:3px;border: 1px solid #64798E">
    <tr>
        <td width="50%" align="left" height="15" valign="middle" style="padding-left:5px"><?php 
    echo strlen($BLOGS->title) > 25 ? substr(cleanData($BLOGS->title), 0, 25) . "..." : cleanData($BLOGS->title);
    ?>
</td>
        <td width="30%" align="left" height="15" valign="middle"><?php 
    echo $BLOGS->rawpostdate;
    ?>
</td>
        <td width="15%" align="center" height="15" valign="middle" style="padding:5px 3px 5px 0"><a href="index.php?cmd=edit&amp;id=<?php 
    echo $BLOGS->id;
    ?>
" title="<?php 
    echo $msg_showblogs8;
    ?>
"><img style="padding:2px" src="images/edit.gif" alt="<?php 
    echo $msg_showblogs8;
    ?>

 $estampa_large = imagecreatefrompng(FILES_PATH . 'logo_large.png');
 $estampa_medium = imagecreatefrompng(FILES_PATH . 'logo_medium.png');
 $estampa_thumbs = imagecreatefrompng(FILES_PATH . 'logo_thumbs.png');
 $rankImage = 1;
 // put file in DB, and place file in directory, if uploaded
 foreach ($file_image["name"] as $key => $name_file) {
     if ($name_file != "") {
         // insert the item into [news_images], and return photo_id
         $sql_fields = "sales_id, image, rank, date_created, date_modified";
         $sql_values = "'" . magicAddSlashes($item_id) . "', '', '" . $rankImage . "', NOW(), NOW()";
         $photo_id = insertRecord("sale_photos", $sql_fields, $sql_values, TRUE);
         $rankImage++;
         // clean up filenames
         $filename = $name_file;
         $filename = $item_id . "_" . $photo_id . "_" . $filename;
         $filename = cleanData($filename);
         /// include auto cropper, to limit photo filesize
         include_once $path_to_dynamik . "auto_cropper.inc.php";
         // full - save the new (cropped) image to the folder
         $crop = new autoCropper(imagecreatefromjpeg($file_image["tmp_name"][$key]), FILES_PATH . FILES_SALES_LARGE . $filename, IMG_SALES_LARGE_WIDTH, IMG_SALES_LARGE_HEIGHT, IMG_SALES_LARGE_FIXED, 100, array(255, 255, 255));
         $crop->processImage();
         // chmod the file
         @chmod(FILES_PATH . FILES_SALES_LARGE . $filename, 0777);
         // Watermark large
         $margen_dcho = 0;
         $margen_inf = 0;
         $sx = imagesx($estampa_large);
         $sy = imagesy($estampa_large);
         $im = imagecreatefromjpeg(FILES_PATH . FILES_SALES_LARGE . $filename);
         imagecopy($im, $estampa_large, imagesx($im) - $sx - $margen_dcho, imagesy($im) - $sy - $margen_inf, 0, 0, imagesx($estampa_large), imagesy($estampa_large));
         imagejpeg($im, FILES_PATH . FILES_SALES_LARGE . $filename);

        mysql_query("DELETE FROM starter WHERE `id`={$id}");
    }
    $form->setError('starter_success', 'Conversation(s) deleted successfully!');
    $form->return_msg_to('starters.php');
} else {
    if (isset($_POST['edit_starter']) && $_POST['edit_starter'] == 'EDIT') {
        $starter_id = $_POST['starter_id'];
        if (sizeof($starter_id) <= 0) {
            $form->setError('starter_error', 'Please select a conversation to edit!');
            $form->return_msg_to('starters.php');
        }
        $id = is_array($starter_id) ? $starter_id[0] : $starter_id;
        if (is_array($starter_id)) {
            $form->return_msg_to('edit-starter.php?id=' . $id);
        } else {
            $starter = cleanData($_POST['starter']);
            if ($starter == '') {
                $form->setError('starter_error', 'You cannot create empty conversation!');
                $form->return_msg_to('edit-starter.php?id=' . $id);
            }
            $result = mysql_query('UPDATE starter SET `starter`="' . $starter . '" WHERE id=' . $id);
            if (!$result) {
                $form->setError('starter_error', 'Conversation edit failed! Please try again.');
                $form->return_msg_to('edit-starter.php?id=' . $id);
            } else {
                $form->setError('starter_success', 'Conversation updated successfully!');
                $form->return_msg_to('starters.php');
            }
        }
    } else {
        $form->return_msg_to('starters.php');

        $Form->setError('error', 'Please write user password');
    }
    // Password
    if (!isset($_POST['phone']) || empty($_POST['phone'])) {
        $Form->setError('error', 'Please write user phone number');
    }
    /**
     * Error Found!
     * Redirect back to form page
     */
    if ($Form->num_errors > 0) {
        $Form->return_msg_to('add-a-administrator.php');
    }
    $first_name = cleanData($_POST['first_name']);
    $last_name = cleanData($_POST['last_name']);
    $email = cleanData($_POST['email']);
    $password = cleanData($_POST['password']);
    $phone = cleanData($_POST['phone']);
    $receive_email = cleanData($_POST['receive_email']);
    $userAdd = insertQuery(TBL_USER, array('type' => 'admin', 'first_name' => $first_name, 'last_name' => $last_name, 'email' => $email, 'password' => $password, 'phone_no' => $phone, 'receive_email' => $receive_email, 'create_date' => 'NOW()'));
    if (!$userAdd) {
        $Form->setError('error', 'Database error! Please try again.');
        $Form->return_msg_to('add-a-administrator.php');
    } else {
        $Form->setError('success', 'New admin added successfully');
        $Form->return_msg_to('add-a-administrator.php');
    }
} else {
    $Form->setError('error', 'Some error occured!');
    $Form->return_msg_to('add-a-administrator.php');
}

         if (strlen($value) < $min && !$allowEmpty) {
             $error = "It is too short.";
         } else {
             if ($allowEmpty && strlen($value) > 0 && strlen($value) < $min) {
                 $error = "It is too short.";
             } else {
                 if (strlen($value) > $max) {
                     $error = "It is too long.";
                 }
             }
         }
     }
     return $error;
 }
 if (!empty($_POST)) {
     $data = cleanData($_POST);
     $errors['survey-name'] = checkData($data['survey-name'], 3, 50, 0);
     $errors['survey-description'] = checkData($data['survey-description'], 3, 250, 0);
     $errors['choice1'] = checkData($data['choice1'], 2, 50, 0);
     $errors['choice2'] = checkData($data['choice2'], 2, 50, 0);
     $errors['choice3'] = checkData($data['choice3'], 2, 50, 1);
     $errors['choice4'] = checkData($data['choice4'], 2, 50, 1);
     $errors['choice5'] = checkData($data['choice5'], 2, 50, 1);
     $req = $pdo->prepare('SELECT id, name FROM surveys WHERE name = :name');
     $req->bindvalue(':name', $data['survey-name'], PDO::PARAM_STR);
     $req->execute();
     if ($res = $req->fetch()) {
         $dataId = $res['id'];
         $errors['survey-name'] = 'This survey already exists';
         $disableForm = 'This survey already exists, <a href="survey-' . $dataId . '.html">please check it.</a>';
     }

     //==================
 //==================
 // Case : RSS Feed
 //==================
 case 'rss-feed':
     $rss_feed = '';
     $build_date = date('D, j M Y H:i:s') . ' GMT';
     $MW_FEED->path = $SETTINGS->w_path . '/themes/' . THEME;
     // Open channel..
     $rss_feed = $MW_FEED->open_channel();
     // Feed info..
     $rss_feed .= $MW_FEED->feed_info(str_replace("{website_name}", $SETTINGS->website, $msg_rss), $SETTINGS->modR ? $SETTINGS->w_path . '/index.html' : $SETTINGS->w_path . '/index.php', $build_date, str_replace("{website_name}", $SETTINGS->website, $msg_rss2), $SETTINGS->website);
     // Get latest posts..
     $query = mysql_query("SELECT * FROM " . $database['prefix'] . "blogs \n                         ORDER BY id DESC \n                         LIMIT " . $SETTINGS->rssfeeds . "\n                         ") or die(mysql_error());
     while ($RSS = mysql_fetch_object($query)) {
         $rss_feed .= $MW_FEED->add_item($msg_rss3 . $RSS->title, $SETTINGS->modR ? $SETTINGS->w_path . '/blog/' . $RSS->id . '/' . addTitleToUrl(cleanData($RSS->title)) . '.html' : $SETTINGS->w_path . '/index.php?cmd=blog&post=' . $RSS->id, $RSS->rss_date ? $RSS->rss_date : $build_date, $RSS->comments);
     }
     // Close channel..
     $rss_feed .= $MW_FEED->close_channel();
     // Display RSS feed..
     header('Content-Type: text/xml');
     echo get_magic_quotes_gpc() ? stripslashes(trim($rss_feed)) : trim($rss_feed);
     break;
     //==================
     // Case : Captcha
     //==================
 //==================
 // Case : Captcha
 //==================
 case 'captcha':
     $MWC = new PhpCaptcha();

        <option<?php 
    echo isset($area) && $area == 'comments' ? " selected " : " ";
    ?>
value="comments"><?php 
    echo $msg_search6;
    ?>
</option>
        </select></td>
    </tr>
    <tr>
        <td class="headbox" align="left"><?php 
    echo $msg_search2;
    ?>
:</td>
        <td align="left"><input class="formbox" type="text" name="keywords" size="30" maxlength="50" value="<?php 
    echo isset($keywords) ? cleanData($keywords) : '';
    ?>
"></td>
    </tr>
    <tr>
        <td class="headbox" align="left"><?php 
    echo $msg_search3;
    ?>
:</td>
        <td valign="top" align="left"><select name="from_day">
        <option selected value="0"> - </option>
        <?php 
    foreach ($days as $s_days) {
        echo '<option' . (isset($from_day) && $from_day == $s_days ? ' selected ' : ' ') . 'value="' . $s_days . '">' . $s_days . '</option>' . "\n";
    }
    ?>