PHP escape_tags函数代码示例

function appman_post(&$a)
{
    if (!local_user()) {
        return;
    }
    if ($_POST['url']) {
        $arr = array('uid' => intval($_REQUEST['uid']), 'url' => escape_tags($_REQUEST['url']), 'guid' => escape_tags($_REQUEST['guid']), 'author' => escape_tags($_REQUEST['author']), 'addr' => escape_tags($_REQUEST['addr']), 'name' => escape_tags($_REQUEST['name']), 'desc' => escape_tags($_REQUEST['desc']), 'photo' => escape_tags($_REQUEST['photo']), 'version' => escape_tags($_REQUEST['version']), 'price' => escape_tags($_REQUEST['price']), 'sig' => escape_tags($_REQUEST['sig']));
        $_REQUEST['appid'] = app_install(local_user(), $arr);
        if (app_installed(local_user(), $arr)) {
            info(t('App installed.') . EOL);
        }
        return;
    }
    $papp = app_decode($_POST['papp']);
    if (!is_array($papp)) {
        notice(t('Malformed app.') . EOL);
        return;
    }
    if ($_POST['install']) {
        app_install(local_user(), $papp);
        if (app_installed(local_user(), $papp)) {
            info(t('App installed.') . EOL);
        }
    }
    if ($_POST['delete']) {
        app_destroy(local_user(), $papp);
    }
    if ($_POST['edit']) {
        return;
    }
    if ($_SESSION['return_url']) {
        goaway(z_root() . '/' . $_SESSION['return_url']);
    }
    goaway(z_root() . '/apps/personal');
}

function feed_init(&$a)
{
    $params = array();
    $params['begin'] = x($_REQUEST, 'date_begin') ? $_REQUEST['date_begin'] : NULL_DATE;
    $params['end'] = x($_REQUEST, 'date_end') ? $_REQUEST['date_end'] : '';
    $params['type'] = stristr(argv(0), 'json') ? 'json' : 'xml';
    $params['pages'] = x($_REQUEST, 'pages') ? intval($_REQUEST['pages']) : 0;
    $params['top'] = x($_REQUEST, 'top') ? intval($_REQUEST['top']) : 0;
    $params['start'] = x($params, 'start') ? intval($params['start']) : 0;
    $params['records'] = x($params, 'records') ? intval($params['records']) : 40;
    $params['direction'] = x($params, 'direction') ? dbesc($params['direction']) : 'desc';
    $params['cat'] = x($_REQUEST, 'cat') ? escape_tags($_REQUEST['cat']) : '';
    $channel = '';
    if (argc() > 1) {
        $r = q("select * from channel left join xchan on channel_hash = xchan_hash where channel_address = '%s' limit 1", dbesc(argv(1)));
        if (!($r && count($r))) {
            killme();
        }
        $channel = $r[0];
        if (intval(get_config('system', 'block_public')) && !get_account_id()) {
            killme();
        }
        logger('mod_feed: public feed request from ' . $_SERVER['REMOTE_ADDR'] . ' for ' . $channel['channel_address']);
        echo get_public_feed($channel, $params);
        killme();
    }
}

function wallmessage_content(&$a)
{
    if (!get_my_url()) {
        notice(t('Permission denied.') . EOL);
        return;
    }
    $recipient = $a->argc > 1 ? $a->argv[1] : '';
    if (!$recipient) {
        notice(t('No recipient.') . EOL);
        return;
    }
    $r = q("select * from user where nickname = '%s' limit 1", dbesc($recipient));
    if (!count($r)) {
        notice(t('No recipient.') . EOL);
        logger('wallmessage: no recipient');
        return;
    }
    $user = $r[0];
    if (!intval($user['unkmail'])) {
        notice(t('Permission denied.') . EOL);
        return;
    }
    $r = q("select count(*) as total from mail where uid = %d and created > UTC_TIMESTAMP() - INTERVAL 1 day and unknown = 1", intval($user['uid']));
    if ($r[0]['total'] > $user['cntunkmail']) {
        notice(sprintf(t('Number of daily wall messages for %s exceeded. Message failed.', $user['username'])));
        return;
    }
    $tpl = get_markup_template('wallmsg-header.tpl');
    $a->page['htmlhead'] .= replace_macros($tpl, array('$baseurl' => $a->get_baseurl(true), '$editselect' => '/(profile-jot-text|prvmail-text)/', '$nickname' => $user['nickname'], '$linkurl' => t('Please enter a link URL:')));
    $tpl = get_markup_template('wallmessage.tpl');
    $o .= replace_macros($tpl, array('$header' => t('Send Private Message'), '$subheader' => sprintf(t('If you wish for %s to respond, please check that the privacy settings on your site allow private mail from unknown senders.'), $user['username']), '$to' => t('To:'), '$subject' => t('Subject:'), '$recipname' => $user['username'], '$nickname' => $user['nickname'], '$subjtxt' => x($_REQUEST, 'subject') ? strip_tags($_REQUEST['subject']) : '', '$text' => x($_REQUEST, 'body') ? escape_tags(htmlspecialchars($_REQUEST['body'])) : '', '$readonly' => '', '$yourmessage' => t('Your message:'), '$select' => $select, '$parent' => '', '$upload' => t('Upload photo'), '$insert' => t('Insert web link'), '$wait' => t('Please wait')));
    return $o;
}

/** @file */
function notes_init(&$a)
{
    if (!local_channel()) {
        return;
    }
    $ret = array('success' => true);
    if (array_key_exists('note_text', $_REQUEST)) {
        $body = escape_tags($_REQUEST['note_text']);
        // I've had my notes vanish into thin air twice in four years.
        // Provide a backup copy if there were contents previously
        // and there are none being saved now.
        if (!$body) {
            $old_text = get_pconfig(local_channel(), 'notes', 'text');
            if ($old_text) {
                set_pconfig(local_channel(), 'notes', 'text.bak', $old_text);
            }
        }
        set_pconfig(local_channel(), 'notes', 'text', $body);
    }
    // push updates to channel clones
    if (argc() > 1 && argv(1) === 'sync') {
        require_once 'include/zot.php';
        build_sync_packet();
    }
    logger('notes saved.', LOGGER_DEBUG);
    json_return_and_die($ret);
}

 function get()
 {
     if (argc() == 2 && argv(1) == 'edit') {
         $mode = 'edit';
     } else {
         $mode = 'list';
     }
     $_SESSION['return_url'] = \App::$cmd;
     $apps = array();
     if (local_channel()) {
         import_system_apps();
         $syslist = array();
         $list = app_list(local_channel(), false, $_GET['cat']);
         if ($list) {
             foreach ($list as $x) {
                 $syslist[] = app_encode($x);
             }
         }
         translate_system_apps($syslist);
     } else {
         $syslist = get_system_apps(true);
     }
     usort($syslist, 'app_name_compare');
     //	logger('apps: ' . print_r($syslist,true));
     foreach ($syslist as $app) {
         $apps[] = app_render($app, $mode);
     }
     return replace_macros(get_markup_template('myapps.tpl'), array('$sitename' => get_config('system', 'sitename'), '$cat' => array_key_exists('cat', $_GET) && $_GET['cat'] ? ' - ' . escape_tags($_GET['cat']) : '', '$title' => t('Apps'), '$apps' => $apps));
 }

 function post()
 {
     if (!local_channel()) {
         return;
     }
     if ($_POST['url']) {
         $arr = array('uid' => intval($_REQUEST['uid']), 'url' => escape_tags($_REQUEST['url']), 'guid' => escape_tags($_REQUEST['guid']), 'author' => escape_tags($_REQUEST['author']), 'addr' => escape_tags($_REQUEST['addr']), 'name' => escape_tags($_REQUEST['name']), 'desc' => escape_tags($_REQUEST['desc']), 'photo' => escape_tags($_REQUEST['photo']), 'version' => escape_tags($_REQUEST['version']), 'price' => escape_tags($_REQUEST['price']), 'requires' => escape_tags($_REQUEST['requires']), 'system' => intval($_REQUEST['system']), 'sig' => escape_tags($_REQUEST['sig']), 'categories' => escape_tags($_REQUEST['categories']));
         $_REQUEST['appid'] = Zlib\Apps::app_install(local_channel(), $arr);
         if (Zlib\Apps::app_installed(local_channel(), $arr)) {
             info(t('App installed.') . EOL);
         }
         return;
     }
     $papp = Zlib\Apps::app_decode($_POST['papp']);
     if (!is_array($papp)) {
         notice(t('Malformed app.') . EOL);
         return;
     }
     if ($_POST['install']) {
         Zlib\Apps::app_install(local_channel(), $papp);
         if (Zlib\Apps::app_installed(local_channel(), $papp)) {
             info(t('App installed.') . EOL);
         }
     }
     if ($_POST['delete']) {
         Zlib\Apps::app_destroy(local_channel(), $papp);
     }
     if ($_POST['edit']) {
         return;
     }
     if ($_SESSION['return_url']) {
         goaway(z_root() . '/' . $_SESSION['return_url']);
     }
     goaway(z_root() . '/apps');
 }

function message_post(&$a)
{
    if (!local_user()) {
        notice(t('Permission denied.') . EOL);
        return;
    }
    $replyto = x($_POST, 'replyto') ? notags(trim($_POST['replyto'])) : '';
    $subject = x($_POST, 'subject') ? notags(trim($_POST['subject'])) : '';
    $body = x($_POST, 'body') ? escape_tags(trim($_POST['body'])) : '';
    $recipient = x($_POST, 'messageto') ? intval($_POST['messageto']) : 0;
    $ret = send_message($recipient, $body, $subject, $replyto);
    switch ($ret) {
        case -1:
            notice(t('No recipient selected.') . EOL);
            break;
        case -2:
            notice(t('Unable to locate contact information.') . EOL);
            break;
        case -3:
            notice(t('Message could not be sent.') . EOL);
            break;
        case -4:
            notice(t('Message collection failure.') . EOL);
            break;
        default:
            info(t('Message sent.') . EOL);
    }
}

function lsearch_init(&$a)
{
    $perpage = $_REQUEST['n'] ? $_REQUEST['n'] : 80;
    $page = $_REQUEST['p'] ? intval($_REQUEST['p'] - 1) : 0;
    $startrec = ($page + 1) * $perpage - $perpage;
    $search = trim($_REQUEST['search']);
    if (!strlen($search)) {
        killme();
    }
    if ($search) {
        $search = dbesc(escape_tags($search));
    }
    $sql_extra = strlen($search) ? " AND ( `name` REGEXP '{$search}' OR `homepage` REGEXP '{$search}' OR `tags` REGEXP '{$search}' \n\t\tor `region` REGEXP '{$search}' or `country-name` regexp '{$search}' ) " : "";
    $r = q("SELECT COUNT(*) AS `total` FROM `profile` WHERE 1 {$sql_extra} ");
    if (count($r)) {
        $total = $r[0]['total'];
    }
    $r = q("SELECT * FROM `profile` WHERE 1 {$sql_extra} ORDER BY `name` ASC LIMIT %d, %d ", intval($startrec), intval($perpage));
    $results = array();
    if (count($r)) {
        foreach ($r as $rr) {
            $results[] = array('name' => $rr['name'], 'url' => $rr['homepage'], 'photo' => $a->get_baseurl() . '/photo/' . $rr['id'], 'tags' => $rr['tags']);
        }
    }
    $output = array('total' => $total, 'items_page' => $perpage, 'page' => $page + 1, 'results' => $results);
    echo json_encode($output);
    killme();
}

 /**
  * @brief Logs admin page.
  *
  * @return string
  */
 function get()
 {
     $log_choices = array(LOGGER_NORMAL => 'Normal', LOGGER_TRACE => 'Trace', LOGGER_DEBUG => 'Debug', LOGGER_DATA => 'Data', LOGGER_ALL => 'All');
     $t = get_markup_template('admin_logs.tpl');
     $f = get_config('system', 'logfile');
     $data = '';
     if (!file_exists($f)) {
         $data = t("Error trying to open <strong>{$f}</strong> log file.\r\n<br/>Check to see if file {$f} exist and is \n\treadable.");
     } else {
         $fp = fopen($f, 'r');
         if (!$fp) {
             $data = t("Couldn't open <strong>{$f}</strong> log file.\r\n<br/>Check to see if file {$f} is readable.");
         } else {
             $fstat = fstat($fp);
             $size = $fstat['size'];
             if ($size != 0) {
                 if ($size > 5000000 || $size < 0) {
                     $size = 5000000;
                 }
                 $seek = fseek($fp, 0 - $size, SEEK_END);
                 if ($seek === 0) {
                     $data = escape_tags(fread($fp, $size));
                     while (!feof($fp)) {
                         $data .= escape_tags(fread($fp, 4096));
                     }
                 }
             }
             fclose($fp);
         }
     }
     return replace_macros($t, array('$title' => t('Administration'), '$page' => t('Logs'), '$submit' => t('Submit'), '$clear' => t('Clear'), '$data' => $data, '$baseurl' => z_root(), '$logname' => get_config('system', 'logfile'), '$debugging' => array('debugging', t("Debugging"), get_config('system', 'debugging'), ""), '$logfile' => array('logfile', t("Log file"), get_config('system', 'logfile'), t("Must be writable by web server. Relative to your top-level webserver directory.")), '$loglevel' => array('loglevel', t("Log level"), get_config('system', 'loglevel'), "", $log_choices), '$form_security_token' => get_form_security_token('admin_logs')));
 }

 function post()
 {
     if (!local_channel()) {
         return;
     }
     if (\App::$argc != 2) {
         return;
     }
     $contact_id = intval(\App::$argv[1]);
     $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($contact_id), intval(local_channel()));
     if (!count($r)) {
         notice(t('Contact not found.') . EOL);
         return;
     }
     $contact = $r[0];
     $new_contact = intval($_POST['suggest']);
     $hash = random_string();
     $note = escape_tags(trim($_POST['note']));
     if ($new_contact) {
         $r = q("SELECT * FROM `contact` WHERE `id` = %d AND `uid` = %d LIMIT 1", intval($new_contact), intval(local_channel()));
         if (count($r)) {
             $x = q("INSERT INTO `fsuggest` ( `uid`,`cid`,`name`,`url`,`request`,`photo`,`note`,`created`)\n\t\t\t\t\tVALUES ( %d, %d, '%s','%s','%s','%s','%s','%s')", intval(local_channel()), intval($contact_id), dbesc($r[0]['name']), dbesc($r[0]['url']), dbesc($r[0]['request']), dbesc($r[0]['photo']), dbesc($hash), dbesc(datetime_convert()));
             $r = q("SELECT `id` FROM `fsuggest` WHERE `note` = '%s' AND `uid` = %d LIMIT 1", dbesc($hash), intval(local_channel()));
             if (count($r)) {
                 $fsuggest_id = $r[0]['id'];
                 q("UPDATE `fsuggest` SET `note` = '%s' WHERE `id` = %d AND `uid` = %d", dbesc($note), intval($fsuggest_id), intval(local_channel()));
                 proc_run('php', 'include/notifier.php', 'suggest', $fsuggest_id);
             }
             info(t('Friend suggestion sent.') . EOL);
         }
     }
 }

 /**
  * Pre-Ouput content
  *
  * @access 	public
  * @return 	string
  */
 public function pre_output($input, $params)
 {
     $parse_tags = !isset($params['allow_tags']) ? 'n' : $params['allow_tags'];
     $content_type = !isset($params['content_type']) ? 'html' : $params['content_type'];
     // If this is the admin, show only the source
     // @TODO This is hacky, there will be times when the admin wants to see a preview or something
     if (defined('ADMIN_THEME')) {
         return $input;
     }
     // If this isn't the admin and we want to allow tags,
     // let it through. Otherwise we will escape them.
     if ($parse_tags == 'y') {
         $content = $this->CI->parser->parse_string($input, array(), true);
     } else {
         $this->CI->load->helper('text');
         $content = escape_tags($input);
     }
     // Not that we know what content is there, what format should we treat is as?
     switch ($content_type) {
         case 'md':
             $this->CI->load->helper('markdown');
             return parse_markdown($content);
         case 'html':
             return $content;
         default:
             return strip_tags($content);
     }
 }

 /**
  * test, that tags are escaped
  */
 public function testEscapeTags()
 {
     $invalidstring = '<submit type="button" onclick="alert(\'failed!\');" />';
     $validstring = notags($invalidstring);
     $escapedString = escape_tags($invalidstring);
     $this->assertEquals('[submit type="button" onclick="alert(\'failed!\');" /]', $validstring);
     $this->assertEquals("&lt;submit type=&quot;button&quot; onclick=&quot;alert('failed!');&quot; /&gt;", $escapedString);
 }

 /**
  * Process before outputting
  *
  * @access	public
  * @param	array
  * @return	string
  */
 public function pre_output($input)
 {
     $this->CI->load->library('encrypt');
     $out = $this->CI->encrypt->decode($input);
     // No PyroCMS tags in your ouput!
     $this->CI->load->helper('text');
     return escape_tags($out);
 }

/**
 * Function to display a comment
 * 
 * Reference is a actually an object reference, a.k.a. categorization of the comments table rows.
 * The reference id is a further categorization on this. (For example, for example for 
 *
 * @param	int		$ref_id		The id of the collection of the reference object of the comment (I guess?)
 * @param	bool	$reference	A module or other reference to pick comments for
 * @return	void
 */
function display_comments($ref_id = '', $reference = NULL)
{
	if ( ! (Settings::get('enable_comments') && $ref_id))
	{
		return;
	}

	$ci =& get_instance();
	
	// Set ref to module if none provided
	$reference OR $reference = $ci->router->fetch_module();

	$ci->lang->load('comments/comments');
	$ci->load->model('comments/comments_m');

	$comments	= $ci->comments_m->get_by_module_item($reference, $ref_id);
	
	// loop through the comments and escape {pyro} and html tags
	foreach ($comments as &$comment)
	{
		foreach ($comment as &$body)
		{
			$body = escape_tags($body);
		}
	}

	// set the data to send to the view
	$data['comments']	=	$comments;
	$data['module']		=	$reference;
	$data['id']			=	$ref_id;
	$data['comment']	=	$ci->session->flashdata('comment');

	/**
	 * The following allows us to load views
	 * without breaking theme overloading
	 **/
	$view = 'comments';
	
	if (file_exists($ci->template->get_views_path() . 'modules/comments/' . $view . (pathinfo($view, PATHINFO_EXTENSION) ? '' : EXT)))
	{
		// look in the theme for overloaded views
		$path = $ci->template->get_views_path() . 'modules/comments/';
	}
	else
	{
		// or look in the module
		list($path, $view) = Modules::find($view, 'comments', 'views/');
	}
	
	$save_path = $ci->load->_ci_view_path;
	$ci->load->_ci_view_path = $path;

	// output the comments html
	$comment_view = $ci->load->_ci_load(array('_ci_view' => $view, '_ci_vars' => ( $data )));

	// Put the path back
	$ci->load->_ci_view_path = $save_path;
}

function tasks_post(&$a)
{
    //	logger('post: ' . print_r($_POST,true));
    if (!local_channel()) {
        return;
    }
    $channel = App::get_channel();
    if (argc() > 2 && argv(1) === 'complete' && intval(argv(2))) {
        $ret = array('success' => false);
        $r = q("select * from event where `type` = 'task' and uid = %d and id = %d limit 1", intval(local_channel()), intval(argv(2)));
        if ($r) {
            $event = $r[0];
            if ($event['event_status'] === 'COMPLETED') {
                $event['event_status'] = 'IN-PROCESS';
                $event['event_status_date'] = NULL_DATE;
                $event['event_percent'] = 0;
                $event['event_sequence'] = $event['event_sequence'] + 1;
                $event['edited'] = datetime_convert();
            } else {
                $event['event_status'] = 'COMPLETED';
                $event['event_status_date'] = datetime_convert();
                $event['event_percent'] = 100;
                $event['event_sequence'] = $event['event_sequence'] + 1;
                $event['edited'] = datetime_convert();
            }
            $x = event_store_event($event);
            if ($x) {
                $ret['success'] = true;
            }
        }
        json_return_and_die($ret);
    }
    if (argc() == 2 && argv(1) === 'new') {
        $text = escape_tags(trim($_REQUEST['summary']));
        if (!$text) {
            return array('success' => false);
        }
        $event = array();
        $event['account'] = $channel['channel_account_id'];
        $event['uid'] = $channel['channel_id'];
        $event['event_xchan'] = $channel['channel_hash'];
        $event['type'] = 'task';
        $event['nofinish'] = true;
        $event['created'] = $event['edited'] = $event['start'] = datetime_convert();
        $event['adjust'] = 1;
        $event['allow_cid'] = '<' . $channel['channel_hash'] . '>';
        $event['summary'] = escape_tags($_REQUEST['summary']);
        $x = event_store_event($event);
        if ($x) {
            $x['success'] = true;
        } else {
            $x = array('success' => false);
        }
        json_return_and_die($x);
    }
}