PHP kses函数代码示例

 function comment_save(&$page)
 {
     // check if we need to save a comment
     if (!isset($_POST['comment'])) {
         return;
     }
     global $__FROG_CONN__;
     if ($page->comment_status != Comment::OPEN) {
         return;
     }
     $data = $_POST['comment'];
     if (is_null($data)) {
         return;
     }
     if (!isset($data['author_name']) or trim($data['author_name']) == '') {
         return;
     }
     if (!isset($data['author_email']) or trim($data['author_email']) == '') {
         return;
     }
     if (!isset($data['body']) or trim($data['body']) == '') {
         return;
     }
     use_helper('Kses');
     $allowed_tags = array('a' => array('href' => array(), 'title' => array()), 'abbr' => array('title' => array()), 'acronym' => array('title' => array()), 'b' => array(), 'blockquote' => array('cite' => array()), 'br' => array(), 'code' => array(), 'em' => array(), 'i' => array(), 'p' => array(), 'strike' => array(), 'strong' => array());
     // get the setting for comments moderations
     //$sql = 'SELECT value FROM '.TABLE_PREFIX.'setting WHERE name=\'auto_approve_comment\'';
     //$stmt = $__FROG_CONN__->prepare($sql);
     //$stmt->execute();
     //$auto_approve_comment = (int) $stmt->fetchColumn();
     $auto_approve_comment = 1;
     $sql = 'INSERT INTO ' . TABLE_PREFIX . 'comment (page_id, author_name, author_email, author_link, body, is_approved, created_on) VALUES (' . '\'' . $page->id . '\', ' . $__FROG_CONN__->quote(strip_tags($data['author_name'])) . ', ' . $__FROG_CONN__->quote(strip_tags($data['author_email'])) . ', ' . $__FROG_CONN__->quote(strip_tags($data['author_link'])) . ', ' . $__FROG_CONN__->quote(kses($data['body'], $allowed_tags)) . ', ' . $__FROG_CONN__->quote($auto_approve_comment) . ', ' . $__FROG_CONN__->quote(date('Y-m-d H:i:s')) . ')';
     $__FROG_CONN__->exec($sql);
     Observer::notify('comment_after_add');
 }

 public function update_event()
 {
     if (!isset($_POST['save'])) {
         Flash::set('error', __('Could not update this event!'));
     } else {
         use_helper('Kses');
         /* Prepare the data */
         $data = $_POST['event'];
         if (isset($data['id'])) {
             $data['id'] = kses(trim($data['id']), array());
         }
         $event = new CalendarEvent();
         if (isset($data['id'])) {
             $event->id = $data['id'];
             $event->created_by_id = $data['created_by_id'];
         }
         $event->title = $data['title'];
         $event->date_from = $data['date_from'];
         $event->date_to = $data['date_to'];
         $event->description = $data['description'];
         /* Check data and, if correct, save to DB */
         if ($event->checkData() && $event->save()) {
             if (isset($data['id'])) {
                 Flash::set('success', __('The event has been updated.'));
             } else {
                 Flash::set('success', __('A new event has been created.'));
             }
             redirect(get_url('plugin/calendar/events'));
         } else {
             Flash::setNow('error', __('There are errors in the form.'));
             $this->display(CALENDAR_VIEWS . '/update', array('event' => $event));
         }
     }
 }

 /**
  * Saves the settings.
  */
 private final function _save()
 {
     $data = $_POST['setting'];
     // CSRF checks
     if (isset($_POST['csrf_token'])) {
         $csrf_token = $_POST['csrf_token'];
         if (!SecureToken::validateToken($csrf_token, BASE_URL . 'setting')) {
             Flash::set('error', __('Invalid CSRF token found!'));
             Observer::notify('csrf_token_invalid', AuthUser::getUserName());
             redirect(get_url('setting'));
         }
     } else {
         Flash::set('error', __('No CSRF token found!'));
         Observer::notify('csrf_token_not_found', AuthUser::getUserName());
         redirect(get_url('setting'));
     }
     if (!isset($data['allow_html_title'])) {
         $data['allow_html_title'] = 'off';
     }
     use_helper('Kses');
     $allowed = array('img' => array('src' => array()), 'abbr' => array('title' => array()), 'acronym' => array('title' => array()), 'b' => array(), 'blockquote' => array('cite' => array()), 'br' => array(), 'code' => array(), 'em' => array(), 'i' => array(), 'p' => array(), 'strike' => array(), 'strong' => array());
     $data['admin_title'] = kses(trim($data['admin_title']), $allowed);
     Setting::saveFromData($data);
     Flash::set('success', __('Settings have been saved!'));
     redirect(get_url('setting'));
 }

function __mobile_strip_images($i)
{
    static $allowed;
    if (!$allowed) {
        $allowed = getConfig('rss.input.allowed');
        if (isset($allowed['img'])) {
            unset($allowed['img']);
        }
    }
    $i->description = kses($i->description, $allowed);
    return $i;
}

function onetest($htmlbefore, $htmlafter, &$score, &$max, $allowed)
{
    $max++;
    $htmlkses = kses($htmlbefore, $allowed);
    #  echo "htmlkses --".htmlspecialchars($htmlkses)."--<br>\n";
    if ($htmlkses == $htmlafter) {
        echo 'OK';
        $score++;
    } else {
        echo 'not OK';
    }
    echo "<br>\n";
}

 function ConvertToPlain_UTF8(&$html)
 {
     //$string = strip_tags($html);
     // replace numeric entities
     //$string = preg_replace('~&#x([0-9a-f]+);~ei', 'chr(hexdec("\\1"))', $string);
     //$string = preg_replace('~&#([0-9]+);~e', 'chr("\\1")', $string);
     // replace literal entities
     //return strtr($string, $this->utf8_trans_tbl);
     $tags = array();
     $res = kses($html, $tags);
     // strip all tags
     $res = str_replace('&', '&', $res);
     return $res;
 }

function kses_filter($text, $hook)
{
    $allowed_html = array('b' => array(), 'i' => array(), 'a' => array('href' => array('maxlen' => 100), 'title' => 1), 'p' => array('align' => 1), 'font' => array('size' => array('maxval' => 20)), 'br' => array());
    if (get_magic_quotes_gpc()) {
        $text = stripslashes($text);
    }
    if ($text != "gettags") {
        return kses($text, $allowed_html);
    } else {
        foreach ($allowed_html as $tag => $null) {
            $kses_printtags .= "<{$tag}>, ";
        }
        return $kses_printtags;
    }
}

function smarty_modifier_kses($in, $allowedtags = FALSE)
{
    if ($allowedtags == 'nolinks') {
        /* need some way to specify a multi dimentional array via a smarty modifer paramater. e.g. {$var|kses:"a(href,title),b,i,blockquote(cite)"}. How to do that?
        
                $tags = array(explode(',',$allowedtags));
                $allowed_html = array();
                foreach($tags as $tag) {
                                $allowed_html[] = array($tag=>array());
                }
        
                .. for the mean time we'll just have a 'safe' list of things for unapproved comments
                */
        $allowed_html = array('b' => array(), 'i' => array(), 'strong' => array(), 'code' => array(), 'acronym' => array('title'), 'abbr' => array('title'), 'blockquote' => array('cite' => array()));
    } else {
        $allowed_html = array('b' => array(), 'i' => array(), 'strong' => array(), 'code' => array(), 'acronym' => array('title'), 'abbr' => array('title'), 'a' => array('href' => array('maxlen' => 300), 'title', 'rel' => array('minlen' => 3, 'maxlen' => 250)), 'blockquote' => array('cite' => array()));
    }
    return kses($in, $allowed_html, array('http', 'https', 'ftp', 'mailto'));
}

/**
 * Kses filtering of tags, called on a plugin hook
 *
 * @param mixed $var Variable to filter
 * @return mixed
 */
function kses_filter_tags($hook, $entity_type, $returnvalue, $params)
{
    $return = $returnvalue;
    $var = $returnvalue;
    if (@(include_once dirname(dirname(dirname(__FILE__))) . "/vendors/kses/kses.php")) {
        global $CONFIG;
        $allowedtags = $CONFIG->allowedtags;
        $allowedprotocols = $CONFIG->allowedprotocols;
        if (!is_array($var)) {
            $return = "";
            $return = kses($var, $allowedtags, $allowedprotocols);
        } else {
            $return = array();
            foreach ($var as $key => $el) {
                $return[$key] = kses($el, $allowedtags, $allowedprotocols);
            }
        }
    }
    return $return;
}

 OpenTable();
 echo "<div align=center class=title>" . _ENTRYADDED . "</div><br><br>";
 echo "<div align=center> [ <a href=\"modules.php?name={$module_name}&file=edit\">" . _RETURNJOURNAL . "</a> ]</div>";
 CloseTable();
 $username = $cookie[1];
 $user = filter($user, "nohtml");
 $username = filter($username, "nohtml");
 $sitename = filter($sitename, "nohtml");
 $title = filter($title, "nohtml");
 $title = addslashes($title);
 if (isset($mood)) {
     $mood = filter($mood, "nohtml");
 } else {
     $mood = "";
 }
 $jbodytext = kses(ADVT_stripslashes($jbodytext), $allowed);
 $jbodytext = addslashes($jbodytext);
 $sql = "INSERT INTO " . $prefix . "_journal (jid,aid,title,bodytext,mood,pdate,ptime,status,mtime,mdate) VALUES (NULL,'{$username}','{$title}','{$jbodytext}','{$mood}','{$pdate}','{$ptime}','{$status}','{$mtime}','{$ndate}')";
 $db->sql_query($sql);
 update_points(1);
 $sql = "SELECT * FROM " . $prefix . "_journal_stats WHERE joid = '{$username}'";
 $result = $db->sql_query($sql);
 $row_count = $db->sql_numrows($result);
 if ($row_count == 0) {
     $query = "INSERT INTO " . $prefix . "_journal_stats (id,joid,nop,ldp,ltp,micro) VALUES ('','{$username}','1',now(),'{$mtime}',now())";
     $db->sql_query($query);
 } else {
     $row = $db->sql_fetchrow($result);
     $nnop = $row['nop'];
     $nnnop = $nnop + 1;
     $micro = date("U");

/**
 * Cleans HTML text filter
 * @param string $html			HTML to clean
 * @param int $mode (optional)
 * @return string				The cleaned HTML
 */
function html_filter($html, $mode = NO_HTML)
{
    $allowed_tags = HTML_QuickForm_Rule_HTML::get_allowed_tags($mode);
    $cleaned_html = kses($html, $allowed_tags);
    return $cleaned_html;
}

function rmsViewHistory($id, $pp, $lenght = 10, $offset = 0)
{
  global $sock;
  $result = array();

  $cmd = "HISTORY " . $id . "." . $pp . " " . $lenght . " " . $offset . "\r\n";
  sendData($cmd);

  $packet = socket_read($sock, 1024, PHP_NORMAL_READ);
  if (substr($packet, 0, 3) >= 400) {
    return false;
  }

  // kses input filtering
  $allowed = array('b' => array(),
      'i' => array(),
      'a' => array('href' => 1, 'title' => 1),
      'p' => array('align' => 1),
      'br' => array(),
      'font' => array('size' => 1, 'color' => 1, 'face' => 1)
      );

  while (!preg_match("/^231 /", $packet))
  {
    $msg = "";
    preg_match("/from (.*)/", $packet, $header);
    $from = $header[1];
    $packet = socket_read($sock, 1024, PHP_NORMAL_READ);
    $snttime = substr($packet, 12);

    $packet = socket_read($sock, 1024, PHP_NORMAL_READ);
    $packet = socket_read($sock, 1024, PHP_NORMAL_READ);

    while (!preg_match("/^223 /", $packet))
    {
      $msg .= (($msg!="")?"<br/>":"").$packet;
      $packet = socket_read($sock, 1024, PHP_NORMAL_READ);
    }

    if (get_magic_quotes_gpc())
      $msg = stripslashes($msg);

    $result[] = array('msg' => kses($msg, $allowed), 'time' => trim($snttime), 'from' => trim($from));

    $packet = socket_read($sock, 1024, PHP_NORMAL_READ);
  }
  return $result;
}

 private function _edit($id)
 {
     $data = $_POST['page'];
     $page = Record::findByIdFrom('Page', $id);
     $old_parts = PagePart::findByPageId($id);
     // need to do this because the use of a checkbox
     $data['is_protected'] = !empty($data['is_protected']) ? 1 : 0;
     /**
      * Make sure the title doesn't contain HTML
      *
      * @todo Replace this by HTML Purifier?
      */
     if (Setting::get('allow_html_title') == 'off') {
         use_helper('Kses');
         $data['title'] = kses(trim($data['title']), array());
     }
     $page->setFromData($data);
     if ($page->save()) {
         // update parts
         $page->parts = $_POST['part'];
         // save tags
         $page->setTags($_POST['page_tag']['tags']);
         Flash::set('success', __('Page has been saved!'));
     } else {
         Flash::set('error', __('Page has not been saved!'));
         redirect(get_url('page/edit/' . $id));
     }
     // save and quit or save and continue editing ?
     if (isset($_POST['commit'])) {
         redirect(get_url('page'));
     } else {
         redirect(get_url('page/edit/' . $id));
     }
 }

 public static function htmlize_comment_text($text)
 {
     global $ratatoeskr_settings;
     return kses(textprocessor_apply($text, $ratatoeskr_settings["comment_textprocessor"]), array("a" => array("href" => 1, "hreflang" => 1, "title" => 1, "rel" => 1, "rev" => 1), "b" => array(), "i" => array(), "u" => array(), "strong" => array(), "em" => array(), "p" => array("align" => 1), "br" => array(), "abbr" => array(), "acronym" => array(), "code" => array(), "pre" => array(), "blockquote" => array("cite" => 1), "h1" => array(), "h2" => array(), "h3" => array(), "h4" => array(), "h5" => array(), "h6" => array(), "img" => array("src" => 1, "alt" => 1, "width" => 1, "height" => 1), "s" => array(), "q" => array("cite" => 1), "samp" => array(), "ul" => array(), "ol" => array(), "li" => array(), "del" => array(), "ins" => array(), "dl" => array(), "dd" => array(), "dt" => array(), "dfn" => array(), "div" => array(), "dir" => array(), "kbd" => array("prompt" => 1), "strike" => array(), "sub" => array(), "sup" => array(), "table" => array("style" => 1), "tbody" => array(), "thead" => array(), "tfoot" => array(), "tr" => array(), "td" => array("colspan" => 1, "rowspan" => 1), "th" => array("colspan" => 1, "rowspan" => 1), "tt" => array(), "var" => array()));
 }

function update($id)
{
    $kses_allowed = getConfig('rss.input.allowed');
    //getAllowedTags();
    $updatedIds = array();
    $sql = "select id, url, title, mode from " . getTable("channels");
    if ($id != "" && is_numeric($id)) {
        $sql .= " where id={$id}";
        $sql .= " and not(mode & " . RSS_MODE_DELETED_STATE . ") ";
    } else {
        $sql .= " where not(mode & " . RSS_MODE_DELETED_STATE . ") ";
    }
    if (getConfig('rss.config.absoluteordering')) {
        $sql .= " order by parent, position";
    } else {
        $sql .= " order by parent, title";
    }
    $res = rss_query($sql);
    while (list($cid, $url, $title, $mode) = rss_fetch_row($res)) {
        // suppress warnings because Magpie is rather noisy
        $old_level = error_reporting(E_ERROR);
        $rss = fetch_rss($url);
        //reset
        error_reporting($old_level);
        if (!$rss && $id != "" && is_numeric($id)) {
            return array(magpie_error(), array());
        } elseif (!$rss || !($rss->rss_origin & MAGPIE_FEED_ORIGIN_HTTP_200)) {
            continue;
            // no need to do anything if we do not get a 200 OK from the feed
        }
        // base URL for items in this feed.
        if (array_key_exists('link', $rss->channel)) {
            $baseUrl = $rss->channel['link'];
        } else {
            $baseUrl = $url;
            // The feed is invalid
        }
        // Keep track of guids we've handled, because some feeds (hello,
        // Technorati!) have this insane habit of serving the same item
        // twice in the same feed.
        $guids = array();
        // Allow updates in this feed?
        $allowUpdates = getProperty($cid, 'rss.input.allowupdates');
        if ($allowUpdates === null) {
            $allowUpdates = getConfig('rss.input.allowupdates');
        }
        $itemIdsInFeed = array();
        // This variable will store the item id's of the elements in the feed
        foreach ($rss->items as $item) {
            $item = rss_plugin_hook('rss.plugins.rssitem', $item);
            // a plugin might delete this item
            if (!isset($item)) {
                continue;
            }
            // item title: strip out html tags
            $title = array_key_exists('title', $item) ? strip_tags($item['title']) : "";
            //$title = str_replace('& ', '& ', $title);
            $description = "";
            // item content, if any
            if (array_key_exists('content', $item) && is_array($item['content']) && array_key_exists('encoded', $item['content'])) {
                $description = $item['content']['encoded'];
            } elseif (array_key_exists('description', $item)) {
                $description = $item['description'];
            } elseif (array_key_exists('atom_content', $item)) {
                $description = $item['atom_content'];
            } elseif (array_key_exists('summary', $item)) {
                $description = $item['summary'];
            } else {
                $description = "";
            }
            $md5sum = "";
            $guid = "";
            if (array_key_exists('guid', $item) && $item['guid'] != "") {
                $guid = $item['guid'];
            } elseif (array_key_exists('id', $item) && $item['id'] != "") {
                $guid = $item['id'];
            }
            $guid = trim($guid);
            $guid = rss_real_escape_string($guid);
            // skip this one if it's an  in-feed-dupe
            if ($guid && isset($guids[$guid])) {
                continue;
            } elseif ($guid) {
                $guids[$guid] = true;
            }
            if ($description != "") {
                $md5sum = md5($description);
                $description = kses($description, $kses_allowed);
                // strip out tags
                if ($baseUrl != "") {
                    $description = relative_to_absolute($description, $baseUrl);
                }
            }
            // Now let plugins modify the description
            $description = rss_plugin_hook('rss.plugins.import.description', $description);
            // link
            if (array_key_exists('link', $item) && $item['link'] != "") {
                $url = $item['link'];
            } elseif (array_key_exists('guid', $item) && $item['guid'] != "") {
                $url = $item['guid'];
//.........这里部分代码省略.........