PHP desanitize函数代码示例

 function __construct($_member = '')
 {
     parent::__construct();
     if (!empty($_member)) {
         $this->member = desanitize($_member);
     }
 }

 private function get_referred_jobs()
 {
     $criteria = array('columns' => "industries.industry, jobs.id, jobs.title, COUNT(referrals.id) AS num_referrals, \n                          DATE_FORMAT(jobs.expire_on, '%e %b, %Y') AS formatted_expire_on, \n                          jobs.description", 'joins' => 'jobs ON jobs.id = referrals.job, 
                     industries ON industries.id = jobs.industry', 'match' => "jobs.employer = '" . $this->employer->getId() . "' AND \n                        need_approval = 'N' AND \n                        (referrals.referee_acknowledged_on IS NOT NULL AND referrals.referee_acknowledged_on <> '0000-00-00 00:00:00') AND \n                        (referrals.member_confirmed_on IS NOT NULL AND referrals.member_confirmed_on <> '0000-00-00 00:00:00') AND \n                        referrals.employer_removed_on IS NULL AND \n                        (referrals.replacement_authorized_on IS NULL OR referrals.replacement_authorized_on = '0000-00-00 00:00:00')", 'group' => 'referrals.job', 'order' => 'num_referrals DESC');
     $referral = new Referral();
     $result = $referral->find($criteria);
     if ($result === false || is_null($result) || empty($result)) {
         return false;
     }
     foreach ($result as $i => $row) {
         $result[$i]['description'] = htmlspecialchars_decode(desanitize($row['description']));
         $result[$i]['new_referrals_count'] = '0';
     }
     $criteria = array('columns' => 'jobs.id, COUNT(referrals.id) AS num_new_referrals', 'joins' => 'jobs ON jobs.id = referrals.job, 
                     resumes ON resumes.id = referrals.resume', 'match' => "jobs.employer = '" . $this->employer->getId() . "' AND \n                        (resumes.deleted = 'N' AND resumes.private = 'N') AND \n                        (referrals.employer_agreed_terms_on IS NULL OR referrals.employer_agreed_terms_on = '0000-00-00 00:00:00') AND \n                        (referrals.referee_acknowledged_on IS NOT NULL AND referrals.referee_acknowledged_on <> '0000-00-00 00:00:00') AND \n                        (referrals.member_confirmed_on IS NOT NULL AND referrals.member_confirmed_on <> '0000-00-00 00:00:00') AND \n                        (referrals.employed_on IS NULL OR referrals.employed_on = '0000-00-00 00:00:00') AND \n                        referrals.employer_removed_on IS NULL AND \n                        (referrals.replacement_authorized_on IS NULL OR referrals.replacement_authorized_on = '0000-00-00 00:00:00')", 'group' => 'referrals.job');
     $new_referrals = $referral->find($criteria);
     if ($new_referrals === false) {
         return false;
     }
     foreach ($new_referrals as $new_referral) {
         foreach ($result as $i => $row) {
             if ($row['id'] == $new_referral['id']) {
                 $result[$i]['new_referrals_count'] = $new_referral['num_new_referrals'];
                 break;
             }
         }
     }
     return $result;
 }

 public static function getSymbolFromCountryCode($_country_code)
 {
     $_country_code = strtoupper(trim(sanitize($_country_code)));
     $query = "SELECT symbol FROM currencies WHERE country_code = '" . $_country_code . "' LIMIT 1";
     $mysqli = Database::connect();
     if ($result = $mysqli->query($query)) {
         return trim(desanitize($result[0]['symbol']));
     }
     return "MYR";
 }

function desanitize($_in = '', $_is_htmlize = false)
{
    $out = '';
    if (is_array($_in)) {
        foreach ($_in as $key => $data) {
            $_in[$key] = desanitize($data, $_is_htmlize);
        }
        $out = $_in;
    } else {
        $out = stripslashes($_in);
        if ($_is_htmlize) {
            $out = htmlspecialchars_decode($out);
        }
    }
    return $out;
}

    //             }
    //             $i++;
    //         }
    //     }
    //
    //     if (!$mysqli->execute($query)) {
    //         echo 'ko';
    //         exit();
    //     }
    // }
    $position = '- ' . $job['job'] . ' at ' . $job['employer'];
    $lines = file(dirname(__FILE__) . '/../private/mail/privileged_member_referred.txt');
    $message = '';
    foreach ($lines as $line) {
        $message .= $line;
    }
    $message = str_replace('%member_name%', htmlspecialchars_decode(desanitize($employee->get_name())), $message);
    $message = str_replace('%member_email_addr%', $employee->email_address(), $message);
    $message = str_replace('%protocol%', $GLOBALS['protocol'], $message);
    $message = str_replace('%root%', $GLOBALS['root'], $message);
    $message = str_replace('%position%', $position, $message);
    $subject = htmlspecialchars_decode(desanitize($employee->get_name())) . " has screened and submitted your resume for the " . htmlspecialchars_decode($job['job']) . " position";
    $headers = 'From: ' . str_replace(',', '', htmlspecialchars_decode(desanitize($employee->get_name()))) . ' <' . $employee->email_address() . '>' . "\n";
    mail($_POST['referee'], $subject, $message, $headers);
    // $handle = fopen('/tmp/ref_email_to_'. $_POST['referee']. '.txt', 'w');
    // fwrite($handle, 'Subject: '. $subject. "\n\n");
    // fwrite($handle, $message);
    // fclose($handle);
    echo '0';
    exit;
}

 function sql_fetchrow($sql_id = 0, $desanitize = false)
 {
     if (!$sql_id) {
         $sql_id = $this->query_result;
     }
     if ($sql_id) {
         $this->row[$sql_id] = @mysql_fetch_array($sql_id);
         if ($this->row[$sql_id] != false) {
             if ($desanitize) {
                 return desanitize($this->row[$sql_id]);
             } else {
                 return $this->row[$sql_id];
             }
         } else {
             return false;
         }
     } else {
         return false;
     }
 }

    if (isset($_POST['order_by'])) {
        $order_by = $_POST['order_by'];
    }
    $mysqli = Database::connect();
    $query = "SELECT members.email_addr, members.phone_num, members.added_by, \n              CONCAT(members.firstname, ', ', members.lastname) AS candidate_name, \n              DATE_FORMAT(members.joined_on, '%e %b, %Y') AS formatted_joined_on \n              FROM candidate_email_manifests \n              LEFT JOIN members ON members.email_addr = candidate_email_manifests.email_addr \n              WHERE candidate_email_manifests.mailing_list = " . $_POST['id'] . " \n              ORDER BY " . $order_by;
    $result = $mysqli->query($query);
    if (count($result) <= 0 || is_null($result)) {
        echo '0';
        exit;
    }
    if (!$result) {
        echo 'ko';
        exit;
    }
    foreach ($result as $i => $row) {
        $result[$i]['candidate_name'] = htmlspecialchars_decode(html_entity_decode(stripslashes(desanitize($row['candidate_name']))));
    }
    $response = array('candidates' => array('candidate' => $result));
    header('Content-type: text/xml');
    echo $xml_dom->get_xml_from_array($response);
    exit;
}
if ($_POST['action'] == 'remove_candidate') {
    $mysqli = Database::connect();
    $query = "DELETE FROM candidate_email_manifests \n              WHERE mailing_list = " . $_POST['id'] . " AND \n              email_addr = '" . $_POST['candidate'] . "'";
    if ($mysqli->execute($query)) {
        echo '0';
    } else {
        echo 'ko';
    }
    exit;

 function emoticon($match, $state)
 {
     $this->formatter->output .= $this->emoticons[desanitize($match)];
     return true;
 }

    public function show()
    {
        $this->begin();
        $this->support($this->employer->getId());
        $this->top('Company Profile');
        $this->menu('employer', 'profile');
        $branch = $this->employer->getAssociatedBranch();
        $profile = desanitize($this->employer->get());
        ?>
        <div id="div_status" class="status">
            <span id="span_status" class="status"></span>
        </div>
        
        <div class="change_instructions">
            Please <a href="mailto: sales.<?php 
        echo strtolower($branch[0]['country']);
        ?>
@yellowelevator.com">let us know</a> if either the Business Registration No., the Business Name, or both needs to be updated.
        </div>
        
        <div class="profile">
            <form onSubmit="return false;">
            <table class="profile_form">
                <tr>
                    <td class="label">Company/Business Registration No.:</td>
                    <td class="field"><?php 
        echo $profile[0]['license_num'];
        ?>
</td>
                </tr>
                <tr>
                    <td class="label"><label for="name">Company/Business Name:</label></td>
                    <td class="field"><?php 
        echo $profile[0]['name'];
        ?>
</td>
                </tr>
                <tr>
                    <td class="title" colspan="2">Sign In Details</td>
                </tr>
                <tr>
                    <td class="label">User ID:</td>
                    <td class="field">
                        <?php 
        echo $profile[0]['id'];
        ?>
                    </td>
                </tr>
                <tr>
                    <td class="label"><label for="password">Password:</label></td>
                    <td class="field"><input type="password" id="password" value="" /></td>
                </tr>
                <tr>
                    <td class="label"><label for="password2">Password Again:</label></td>
                    <td class="field">
                        <input type="password" id="password2" value="" />
                        <input type="button" value="Save Password" onClick="save_password();" />
                    </td>
                </tr>
                <tr>
                    <td class="title" colspan="2">Contact Details<br/><span class="note">Fields marked with * indicates cannot be left empty.</span></td>
                </tr>
                <tr>
                    <td class="label"><label for="email">* HR Contact Emails:</label></td>
                    <td class="field">
                        <input type="text" id="email_addr" class="field" value="<?php 
        echo $profile[0]['email_addr'];
        ?>
" />
                    </td>
                </tr>
                <tr>
                    <td class="label"><label for="contact_person">* HR Contacts:</label></td>
                    <td class="field">
                        <input type="text" id="contact_person" class="field" value="<?php 
        echo $profile[0]['contact_person'];
        ?>
" />
                    </td>
                </tr>
                <tr>
                    <td class="label"><label for="phone_num">* HR Contact Numbers:</label></td>
                    <td class="field">
                        <input type="text" id="phone_num" class="field" value="<?php 
        echo $profile[0]['phone_num'];
        ?>
" />
                    </td>
                </tr>
                <tr>
                    <td class="label"><label for="fax_num">Fax Number:</label></td>
                    <td class="field">
                        <input type="text" id="fax_num" class="field" value="<?php 
        echo $profile[0]['fax_num'];
        ?>
" />
                    </td>
                </tr>
                <tr>
                    <td class="label"><label for="address">Mailing Address:</label></td>
//.........这里部分代码省略.........

    ?>
 &amp; <?php 
    echo $this->esoTalk->user["name"];
    ?>
<br/><span class='label private'><?php 
    echo $language["labels"]["private"];
    ?>
</span></label> <div><a href='<?php 
    echo makeLink("search", "?q2=private+%2B+contributor:" . urlencode(desanitize($this->member["name"])));
    ?>
'><?php 
    printf($language["See the private conversations I've had"], $this->member["name"]);
    ?>
</a><br/>
<a href='<?php 
    echo makeLink("new", "?member=" . urlencode(desanitize($this->member["name"])));
    ?>
'><?php 
    printf($language["Start a private conversation"], $this->member["name"]);
    ?>
</a></div></li>
<?php 
}
?>

</ul>
</div>
</div>

<?php 
ksort($this->sections);

function sendEmail($to, $subject, $body)
{
    global $config, $language;
    if (!preg_match("/^[A-Z0-9._%-+]+@[A-Z0-9.-]+.[A-Z]{2,4}\$/i", $to)) {
        return false;
    }
    return mail(sanitizeForHTTP($to), sanitizeForHTTP(desanitize($subject)), desanitize($body), "From: " . sanitizeForHTTP(desanitize($config["forumTitle"]) . " <{$config["emailFrom"]}>") . "\nContent-Type: text/plain; charset={$language["charset"]}; format=flowed");
}

    protected function top_prs($page_title)
    {
        ?>
        <div class="top">
            <table class="top">
                <tr>
                    <td rowspan="3" class="logo">
                        <a href="<?php 
        echo $GLOBALS['protocol'] . '://' . $GLOBALS['root'];
        ?>
/index.php">
                            <img name="logo" src="<?php 
        echo $GLOBALS['protocol'] . '://' . $GLOBALS['root'];
        ?>
/common/images/logos/top.jpg" />
                        </a>
                    </td>
                    <td><div class="page_title"><?php 
        echo desanitize($page_title);
        ?>
</div></td>
                </tr>
                <tr>
                    <td>
                        <form method="post" action="<?php 
        echo $GLOBALS['protocol'] . '://' . $GLOBALS['root'];
        ?>
/prs/search_resume.php" onSubmit="return prs_verify_mini();">
                            <div class="mini_search">
                                <span id="mini_industry_drop_down"></span>
                                &nbsp;
                                <input type="text" name="keywords" id="mini_keywords">
                                &nbsp;
                                <input id="mini_search_button" type="submit" value="Search Resumes">
                                &nbsp;
                                <!--input type="checkbox" name="use_exact" id="use_exact" value="1" /><label for="use_exact">Exact</label-->
                                <input type="radio" name="use_mode" id="or_mode" value="or" checked /><label for="or_mode">OR</label>
                                <input type="radio" name="use_mode" id="and_mode" value="and" /><label for="and_mode">AND</label>
                            </div>
                        </form>
                    </td>
                </tr>
            </table>
        </div>
        <?php 
    }

 //     } else {
 //         echo "ko";
 //     }
 //     exit();
 // }
 $total_results = $resume_search->total_results();
 $current_page = '1';
 if ($criteria['offset'] > 0) {
     $current_page = ceil($criteria['offset'] / $criteria['limit']) + 1;
 }
 $result[0]['changed_country_code'] = 0;
 if ($resume_search->country_code_changed()) {
     $result[0]['changed_country_code'] = 1;
 }
 foreach ($result as $i => $row) {
     $result[$i]['member'] = htmlspecialchars_decode(html_entity_decode(stripslashes(desanitize($row['member']))));
     $result[$i]['total_results'] = $total_results;
     $result[$i]['current_page'] = $current_page;
     // if ($criteria['use_exact']) {
     //     $result[$i]['use_exact'] = '1';
     // } else {
     //     $result[$i]['use_exact'] = '0';
     // }
     $result[$i]['use_mode'] = $criteria['use_mode'];
     if (is_null($result[$i]['added_by']) || empty($result[$i]['added_by'])) {
         $result[$i]['added_by'] = '-1';
     }
     if (is_null($result[$i]['zip']) || empty($result[$i]['zip'])) {
         $result[$i]['zip'] = '0';
     }
     if (is_null($result[$i]['prime_industry']) || empty($result[$i]['prime_industry'])) {

 }
 // 1. Count the latest jobs
 $query = "SELECT COUNT(jobs.id) AS job_count \n              FROM jobs\n              INNER JOIN employers ON employers.id = jobs.employer \n              INNER JOIN branches ON branches.id = employers.branch \n              WHERE jobs.created_on BETWEEN date_add(CURDATE(), INTERVAL -1 WEEK) AND CURDATE()";
 $result = $mysqli->query($query);
 $new_jobs_count = '(No new jobs this week.)';
 if ($result[0]['job_count'] > 0) {
     $new_jobs_count = $result[0]['job_count'];
 }
 // 2. List the new employers
 $query = "SELECT employers.id, employers.name \n              FROM employers \n              INNER JOIN branches ON branches.id = employers.branch \n              WHERE employers.joined_on BETWEEN DATE_ADD(CURDATE(), INTERVAL -1 WEEK) AND CURDATE() \n              LIMIT 3";
 $result = $mysqli->query($query);
 $new_employers_list = '(No new employers this week.)';
 if (!is_null($result) && !empty($result)) {
     $new_employers_list = '<ul>' . "\n";
     foreach ($result as $employer) {
         $new_employers_list .= '<li><a href="%protocol%://%root%/search.php?industry=0&employer=' . $employer['id'] . '&keywords=">' . htmlspecialchars_decode(desanitize($employer['name'])) . '</a></li>' . "\n";
     }
     $new_employers_list .= '</ul>' . "\n";
 }
 // 3. List the top 5 most lucrative
 $query = "SELECT jobs.id, jobs.title, employers.name AS employer, \n              branches.currency, jobs.salary, jobs.salary_end, jobs.potential_reward\n              FROM jobs \n              INNER JOIN employers ON employers.id = jobs.employer \n              INNER JOIN branches ON branches.id = employers.branch \n              WHERE jobs.closed = 'N' AND jobs.expire_on > CURDATE() \n              ORDER BY jobs.potential_reward DESC\n              LIMIT 5";
 $result = $mysqli->query($query);
 $top_five_lucrative_jobs = '';
 if (!is_null($result) && !empty($result)) {
     $i = 1;
     foreach ($result as $row) {
         if ($i % 2 != 0) {
             $top_five_lucrative_jobs .= '<tr bgcolor="#eeeeee">' . "\n";
         } else {
             $top_five_lucrative_jobs .= '<tr>' . "\n";
         }

 function doInstall()
 {
     // Make sure the base url has a trailing slash.
     if (substr($_SESSION["install"]["baseURL"], -1) != "/") {
         $_SESSION["install"]["baseURL"] .= "/";
     }
     global $config;
     // Prepare the config settings
     $config = array("mysqlHost" => desanitize($_SESSION["install"]["mysqlHost"]), "mysqlUser" => desanitize($_SESSION["install"]["mysqlUser"]), "mysqlPass" => desanitize($_SESSION["install"]["mysqlPass"]), "mysqlDB" => desanitize($_SESSION["install"]["mysqlDB"]), "tablePrefix" => desanitize($_SESSION["install"]["tablePrefix"]), "forumTitle" => $_SESSION["install"]["forumTitle"], "baseURL" => $_SESSION["install"]["baseURL"], "salt" => generateRandomString(rand(32, 64)), "emailFrom" => "do_not_reply@{$_SERVER["HTTP_HOST"]}", "cookieName" => preg_replace(array("/\\s+/", "/[^\\w]/"), array("_", ""), desanitize($_SESSION["install"]["forumTitle"])), "useFriendlyURLs" => !empty($_SESSION["install"]["friendlyURLs"]), "useModRewrite" => !empty($_SESSION["install"]["friendlyURLs"]) and function_exists("apache_get_modules") and in_array("mod_rewrite", apache_get_modules()));
     $this->connect($config["mysqlHost"], $config["mysqlUser"], $config["mysqlPass"], $config["mysqlDB"]);
     // Get the list of queries that we need to run and run them
     include "queries.php";
     foreach ($queries as $query) {
         if (!$this->query($query)) {
             return array(1 => "<code>" . sanitize($this->error()) . "</code><p><strong>The query that caused this error was</strong></p><pre>" . sanitize($query) . "</pre>");
         }
     }
     // Write the config file
     writeConfigFile("../config/config.php", '$config', $config);
     // Write the versions.php file
     include "../config.default.php";
     writeConfigFile("../config/versions.php", '$versions', array("esoTalk" => ESOTALK_VERSION));
     // Write a .htaccess file
     if ($config["useModRewrite"]) {
         $handle = fopen("../.htaccess", "w");
         fwrite($handle, "# Generated by esoTalk\n<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteCond %{REQUEST_FILENAME} !-f\nRewriteRule ^(.*)\$ index.php/\$1 [QSA,L]\n</IfModule>");
         fclose($handle);
     }
     // Write a robots.txt file
     $handle = fopen("../robots.txt", "w");
     fwrite($handle, "User-agent: *\nDisallow: /search/\nDisallow: /online/\nDisallow: /join/\nDisallow: /forgotPassword/\nDisallow: /conversation/new/\nSitemap: {$config["baseURL"]}sitemap.php");
     fclose($handle);
     // Prepare to log in the administrator
     // This won't actually log them in due to different session names. But we do that later.
     $_SESSION["user"] = array("memberId" => 1, "name" => $_SESSION["install"]["adminUser"], "account" => "Administrator", "color" => $color, "emailOnPrivateAdd" => false, "emailOnStar" => false, "language" => "English", "avatarAlignment" => "alternate", "avatarFormat" => "", "disableJSEffects" => false);
 }