PHP cleanInput函数代码示例

/**
* Functions for checking if user exists
*/
function checkingIfUserExists()
{
    include_once 'validate.php';
    include_once 'functions.php';
    if (isset($_POST['email']) && isset($_POST['password'])) {
        $email = cleanInput($_POST['email']);
        $password = cleanInput($_POST['password']);
    }
    if (empty($email) || empty($password)) {
        echo "All fields are required. Please fill in all the fields.";
        exit;
    } else {
        /*checking correctness of form input*/
        $email = filter_var($email, FILTER_SANITIZE_EMAIL);
        if (validateEmail($email) == false) {
            echo "E-mail should be in the format of name@example.com";
            exit;
        }
        if (validateLength($password, 6) == false) {
            echo "Password should contain not less than 6 symbols";
            exit;
        }
        //$password_hash=password_hash($password, PASSWORD_DEFAULT); //PHP 5 >= 5.5.0
        $password_hash = md5($password);
        /*checking if user already exists*/
        if (checkLoggedUserInFile($email, $password_hash) == true) {
            //echo "Hello! You have logged in as ".$_SESSION['user_name'].".";
            header('Location:products.php');
            exit;
        } else {
            echo "No such user, or wrong password.<br>";
            //exit;
        }
    }
}

 private function insertValue($key, $value)
 {
     // insert $value into $foundValues
     if ($this->cleanInput == true) {
         $this->foundValues[$key] = cleanInput($value);
     } else {
         $this->foundValues[$key] = $value;
     }
 }

function getVar($var) {
	$return = 0;
	
	if(isset($_GET[$var]))
		$return = cleanInput($_GET[$var]);
		
	if(isset($_POST[$var]))
		$return = cleanInput($_POST[$var]);
		
	return $return;
}

	function sanitize($input) {
		if (is_array($input)) {
			foreach($input as $var=>$val) {
				$output[$var] = sanitize($val);
			}
		} else {
			if (get_magic_quotes_gpc()) {
				$input = stripslashes($input);
			}
			$input  = cleanInput($input);
			$output = mysql_real_escape_string($input);
		}
		return $output;
	}

/**
 * Second half of the sanitize function
 * This one stripslashes() and escapes the input
 * 
 * @param type $input
 * @return type
 */
function sanitize($input)
{
    if (is_array($input)) {
        foreach ($input as $var => $val) {
            $output[$var] = $this->sanitize($val);
        }
    } else {
        if (get_magic_quotes_gpc()) {
            $input = stripslashes($input);
        }
        $output = cleanInput($input);
    }
    return $output;
}

 public function check_userid()
 {
     if (isAjaX()) {
         $data = array();
         $username = cleanInput($_POST['userid']);
         if (checkVar($username) && !$this->model->username_exists($username)) {
             $data['result'] = "<div class='message success'>Great! You found a username not in use</div>";
             $data['inuse'] = TRUE;
         } else {
             $data['result'] = "<div class='message warning'>That username is already in use. (Usernames take 2 minutes without use to expire)</div>";
             $data['inuse'] = FALSE;
         }
         $this->view->json($data);
     }
 }

function sanitize($input)
{
    $invalid_characters = array("\$", "1À", "1'", "=", "!", "%", "#", "<", ">", "[", "]", "{", "}", "/", "'", ";", ",", "|");
    if (is_array($input)) {
        foreach ($input as $var => $val) {
            $output[$var] = sanitize($val);
        }
    } else {
        if (get_magic_quotes_gpc()) {
            $input = stripslashes($input);
        }
        $input = cleanInput($input);
        $output = str_ireplace($invalid_characters, '', $input);
    }
    return $output;
}

function sanitize($input)
{
    if (is_array($input)) {
        foreach ($input as $var => $val) {
            $output[$var] = sanitize($val);
        }
    } else {
        if (get_magic_quotes_gpc()) {
            $input = stripslashes($input);
        }
        $input = cleanInput($input);
        $link = mysqli_connect('localhost', 'root', '8PaHucre');
        $output = $link->real_escape_string($input);
    }
    return $output;
}

function sanitize($input)
{
    if (is_array($input)) {
        foreach ($input as $var => $val) {
            $output[$var] = sanitize($val);
        }
    } else {
        if (get_magic_quotes_gpc()) {
            $input = stripslashes($input);
        }
        //$input  = cleanInput($input);
        //$output = mysql_real_escape_string($input);
        $output = cleanInput($input);
    }
    return $output;
    // USAGE: good_string = sanitize($bad_string);
    // Anti Hacking END
}

/**
* Functions for checking & validating form
*/
function checkingFormAndSaveNewUser()
{
    include_once 'validate.php';
    if (isset($_POST['username']) && isset($_POST['email']) && isset($_POST['password']) && isset($_POST['confirm_password']) && isset($_POST['agree'])) {
        $username = cleanInput($_POST['username']);
        $email = cleanInput($_POST['email']);
        $password = cleanInput($_POST['password']);
        $confirm_password = cleanInput($_POST['confirm_password']);
        $agree = $_POST['agree'];
        if (validateUsername($username) == false) {
            echo "Name should contain capitals and lower case, not less than 2 symbols";
            exit;
        }
        $email = filter_var($email, FILTER_SANITIZE_EMAIL);
        if (validateEmail($email) == false) {
            echo "E-mail should be in the format of name@example.com";
            exit;
        }
        if (validateLength($password, 6) == false) {
            echo "Password should contain not less than 6 symbols";
            exit;
        }
        if (validateConfirm($password, $confirm_password) == false) {
            echo "Passwords do not match";
            exit;
        }
        //$password_hash=password_hash($password, PASSWORD_DEFAULT); //PHP 5 >= 5.5.0
        $password_hash = md5($password);
        $dir_for_saved_users = "./user/";
        if (!is_dir($dir_for_saved_users)) {
            mkdir($dir_for_saved_users, 0777, true);
        }
        chmod('./user/', 0777);
        $filename = $dir_for_saved_users . "user_info";
        $new_user_info = $username . ":" . $email . ":" . $password_hash . "\n";
        file_put_contents($filename, $new_user_info, FILE_APPEND);
        //$_SESSION['name'] = $username;
        echo "You have signed up successfully! <a href='index.php'>Log in</a>";
    } else {
        echo "All fields are required. Please fill in all the fields.";
        exit;
    }
}

 public function register()
 {
     $data = array();
     if (isset($_POST['register'])) {
         $openid = $_POST['identity'];
         $username = cleanInput($_POST['username']);
         $email = cleanInput($_POST['email']);
         $fullname = cleanInput($_POST['fullname']);
         $gender = cleanInput($_POST['gender']);
         $country = cleanInput($_POST['country']);
         $postcode = cleanInput($_POST['postcode']);
         $language = cleanInput($_POST['language']);
         $timezone = cleanInput($_POST['timezone']);
         $errors = array();
         if (is_numeric($_POST['dob-year'])) {
             $dob = $_POST['dob-month'] . '/' . $_POST['dob-day'] . '/' . $_POST['dob-year'];
         } else {
             $errors[] = array('title' => 'Invalid Input', 'text' => 'Year must be numeric');
             $data['errors'] = $errors;
             $this->view->load('auth/register', $data);
             return;
         }
         $identity = $this->model->create_userprofile($username, $email, $fullname, $dob, $gender, $postcode, $country, $language, $timezone);
         if (!$identity) {
             $errors[] = array('title' => 'Error', 'text' => 'Could not generate user profile');
             $data['errors'] = $errors;
             $this->view->load('auth/register', $data);
             return;
         }
         if ($this->model->register_openid($identity, $openid)) {
             if ($this->model->login_user($identity)) {
                 redirect('dashboard');
             }
             $errors[] = array('title' => 'Error', 'text' => 'Could not login user');
         } else {
             $errors[] = array('title' => 'Error', 'text' => 'Could not register openid');
         }
     }
     if (!empty($errors)) {
         $data['errors'] = $errors;
     }
     $this->view->load('auth/register', $data);
 }

function hasACL($name, $action, $level, $uid = false)
{
    if (!isLoggedIn(false)) {
        return false;
    }
    global $suid, $mysqli;
    $n = cleanInput('/[^a-zA-Z0-9_]/', strtolower($name));
    $a = strtolower($action);
    $l = strtoupper($level);
    $u = cleanInput('/[^0-9]/', strtolower($suid));
    if ($uid != false) {
        $u = cleanInput('/[^0-9]/', strtolower($uid));
    }
    $M_result = $mysqli->query("SELECT {$n} FROM acls WHERE user_id={$u};");
    if ($M_result == false) {
        return false;
    }
    $M_row = $M_result->fetch_assoc();
    $v = strtoupper($M_row[$n]);
    $s = -1;
    if ($a == 'read' || $a == 'r') {
        $s = 0;
    } else {
        if ($a == 'write' || $a == 'w') {
            $s = 1;
        }
    }
    if ($s == -1) {
        error_log("Invalid ACL action: {$a} / {$action}.");
        return false;
    }
    $g = substr($v, $s, 1);
    if ($g == $l || $g == 'E' && $l == 'S') {
        return true;
    } else {
        return false;
    }
}

function getClasses($uid)
{
    global $mysqli, $suid;
    $u = cleanInput('/[^0-9]/', strtolower($uid));
    $result = [];
    if (hasACL("teacher_panel", "R", "E")) {
        $M_result = $mysqli->query("SELECT name,id FROM class;");
        while ($M_row = $M_result->fetch_assoc()) {
            $result[] = ["id" => $M_row['id'], "name" => $M_row['name']];
        }
    } else {
        $M_result = $mysqli->query("SELECT class_id FROM class_acls WHERE user_id={$uid};");
        while ($M_row = $M_result->fetch_assoc()) {
            $M_result2 = $mysqli->query("SELECT name FROM class WHERE id=" . $M_row['class_id'] . ";");
            $n = "Unknown";
            if ($M_result2 != false) {
                $M_row2 = $M_result2->fetch_assoc();
                $n = $M_row2['name'];
            }
            $result[] = ["id" => $M_row['class_id'], "name" => $n];
        }
    }
    return $result;
}

$firstname = "";
$lastname = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (isset($_POST["create"])) {
        if (empty($_POST["create_email"])) {
            $create_email_error = "See väli on kohustuslik";
        } else {
            $create_email = cleanInput($_POST["create_email"]);
        }
        if (empty($_POST["create_password"])) {
            $create_password_error = "See väli on kohustuslik";
        } else {
            if (strlen($_POST["create_password"]) < 8) {
                $create_password_error = "Peab olema vähemalt 8 tähemärki pikk!";
            } else {
                $create_password = cleanInput($_POST["create_password"]);
            }
        }
        if (empty($_POST["firstname"])) {
            $firstname_error = "See väli on kohustuslik!";
        } else {
            $firstname = test_input($_POST["firstname"]);
        }
        if (empty($_POST["lastname"])) {
            $lastname_error = "See väli on kohustuslik!";
        } else {
            $lastname = test_input($_POST["lastname"]);
        }
        if ($create_email_error == "" && $create_password_error == "" && $firstname_error == "" && $lastname_error == "") {
            // räsi paroolist, mille salvestame ab'i
            $hash = hash("sha512", $create_password);

if (!isset($_SESSION["logged_in_user_id"])) {
    header("Location: login.php");
}
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    if (isset($_POST["create_team"])) {
        $GK = cleanInput($_POST["GK"]);
        $LB = cleanInput($_POST["LB"]);
        $CB1 = cleanInput($_POST["CB1"]);
        $CB2 = cleanInput($_POST["CB2"]);
        $RB = cleanInput($_POST["RB"]);
        $LM = cleanInput($_POST["LM"]);
        $CM1 = cleanInput($_POST["CM1"]);
        $CM2 = cleanInput($_POST["CM2"]);
        $RM = cleanInput($_POST["RM"]);
        $ST1 = cleanInput($_POST["ST1"]);
        $ST2 = cleanInput($_POST["ST2"]);
    }
    echo "Dreamteam edukalt lisatud!";
    createTeam($GK, $LB, $CB1, $CB2, $RB, $LM, $CM1, $CM2, $RM, $ST1, $ST2);
}
function cleanInput($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
function test_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);