PHP purify函数代码示例

/**
 * @brief  Process resource actions
 * @global type $tool_content
 * @global type $id
 * @global type $langResourceCourseUnitDeleted
 * @global type $langResourceUnitModified
 * @global type $course_id
 * @global type $course_code
 * @return string
 */
function process_actions()
{
    global $tool_content, $id, $langResourceCourseUnitDeleted, $langResourceUnitModified, $course_id, $course_code, $webDir;
    // update index and refresh course metadata
    require_once 'modules/search/indexer.class.php';
    require_once 'modules/course_metadata/CourseXML.php';
    if (isset($_REQUEST['edit'])) {
        $res_id = intval($_GET['edit']);
        if ($id = check_admin_unit_resource($res_id)) {
            return edit_res($res_id);
        }
    } elseif (isset($_REQUEST['edit_res_submit'])) {
        // edit resource
        $res_id = intval($_REQUEST['resource_id']);
        if ($id = check_admin_unit_resource($res_id)) {
            @($restitle = $_REQUEST['restitle']);
            $rescomments = purify($_REQUEST['rescomments']);
            $result = Database::get()->query("UPDATE course_weekly_view_activities SET\n                                        title = ?s,\n                                        comments = ?s\n                                        WHERE course_weekly_view_id = ?d AND id = ?d", $restitle, $rescomments, $id, $res_id);
            Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_UNITRESOURCE, $res_id);
            Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_COURSE, $course_id);
            CourseXMLElement::refreshCourse($course_id, $course_code);
        }
        $tool_content .= "<div class='alert alert-success'>{$langResourceUnitModified}</div>";
    } elseif (isset($_REQUEST['del'])) {
        // delete resource from course unit
        $res_id = intval($_GET['del']);
        if ($id = check_admin_unit_resource($res_id)) {
            Database::get()->query("DELETE FROM course_weekly_view_activities WHERE id = ?d", $res_id);
            Indexer::queueAsync(Indexer::REQUEST_REMOVE, Indexer::RESOURCE_UNITRESOURCE, $res_id);
            Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_COURSE, $course_id);
            CourseXMLElement::refreshCourse($course_id, $course_code);
            $tool_content .= "<div class='alert alert-success'>{$langResourceCourseUnitDeleted}</div>";
        }
    } elseif (isset($_REQUEST['vis'])) {
        // modify visibility in text resources only
        $res_id = intval($_REQUEST['vis']);
        if ($id = check_admin_unit_resource($res_id)) {
            $vis = Database::get()->querySingle("SELECT `visible` FROM course_weekly_view_activities WHERE id = ?d", $res_id)->visible;
            $newvis = $vis == 1 ? 0 : 1;
            Database::get()->query("UPDATE course_weekly_view_activities SET visible = '{$newvis}' WHERE id = ?d", $res_id);
            Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_UNITRESOURCE, $res_id);
            Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_COURSE, $course_id);
            CourseXMLElement::refreshCourse($course_id, $course_code);
        }
    } elseif (isset($_REQUEST['down'])) {
        // change order down
        $res_id = intval($_REQUEST['down']);
        if ($id = check_admin_unit_resource($res_id)) {
            move_order('course_weekly_view_activities', 'id', $res_id, 'order', 'down', "course_weekly_view_id={$id}");
        }
    } elseif (isset($_REQUEST['up'])) {
        // change order up
        $res_id = intval($_REQUEST['up']);
        if ($id = check_admin_unit_resource($res_id)) {
            move_order('course_weekly_view_activities', 'id', $res_id, 'order', 'up', "course_weekly_view_id={$id}");
        }
    }
    return '';
}

 public static function renderViewRows($rows, Apartment $model)
 {
     if (!$rows) {
         return '';
     }
     foreach ($rows as $row) {
         if (!$model->canShowInView($row['field'])) {
             continue;
         }
         if ($row['standard_type'] != FormDesigner::STANDARD_TYPE_NEW && file_exists(ROOT_PATH . '/protected/views/common/apartments/fields/' . $row['field'] . '.php')) {
             //
             Yii::app()->controller->renderPartial('//../views/common/apartments/fields/' . $row['field'], array('data' => $model));
             continue;
         }
         if ($row->type == FormDesigner::TYPE_REFERENCE) {
             $sql = "SELECT title_" . Yii::app()->language . " FROM {{apartment_reference_values}} WHERE id=" . $model->{$row}['field'];
             $value = CHtml::encode(Yii::app()->db->createCommand($sql)->queryScalar());
         } else {
             $value = is_string($model->{$row}['field']) ? CHtml::encode($model->{$row}['field']) : '???';
             if ($row->type == FormDesigner::TYPE_TEXT_AREA_WS) {
                 $value = purify($model->{$row}['field']);
             }
         }
         if ($row->type == FormDesigner::TYPE_INT && $row->measure_unit) {
             $value .= ' ' . CHtml::encode($row->measure_unit);
         }
         if ($value) {
             if ($row['standard_type'] > 0) {
                 echo '<dt>' . CHtml::encode($model->getAttributeLabel($row['field'])) . ':</dt>';
             } else {
                 echo '<dt>' . CHtml::encode($row['label_' . Yii::app()->language]) . ':</dt>';
             }
             if ($row->field == 'phone') {
                 if (issetModule('tariffPlans') && issetModule('paidservices') && $model->owner_id != Yii::app()->user->id) {
                     if (Yii::app()->user->isGuest) {
                         $defaultTariffInfo = TariffPlans::getFullTariffInfoById(TariffPlans::DEFAULT_TARIFF_PLAN_ID);
                         if (!$defaultTariffInfo['showPhones']) {
                             echo '<dd>' . Yii::t('module_tariffPlans', 'Please <a href="{n}">login</a> to view', Yii::app()->controller->createUrl('/site/login')) . '</dd>';
                         } else {
                             echo '<dd><span id="owner-phone">' . CHtml::link(tc('Show phone'), 'javascript: void(0);', array('onclick' => 'generatePhone();')) . '</span>' . '</dd>';
                         }
                     } else {
                         if (TariffPlans::checkAllowShowPhone()) {
                             echo '<dd>' . $value . '</dd>';
                         } else {
                             echo '<dd>' . Yii::t('module_tariffPlans', 'Please <a href="{n}">change the tariff plan</a> to view', Yii::app()->controller->createUrl('/tariffPlans/main/index')) . '</dd>';
                         }
                     }
                 } else {
                     echo '<dd><span id="owner-phone">' . CHtml::link(tc('Show phone'), 'javascript: void(0);', array('onclick' => 'generatePhone();')) . '</span>' . '</dd>';
                 }
             } else {
                 echo '<dd>' . $value . '</dd>';
             }
         }
     }
 }

/**
 * All comments are run through here before they're saved
 *
 * @param string
 */
function _process_post($content)
{
    // We cant use the dom because any dom parser is going to throw away
    // the code inside the code tags, this will currently break for nested
    // code tags and code with [[> in it
    $content = str_replace('<code>', '<pre class="prettyprint linenums"><![CDATA[', $content);
    $content = str_replace('</code>', ']]></pre>', $content);
    _format_lists($content);
    _format_pinkies($content);
    $content = purify($content);
    return $content;
}

 public function printPoster($file)
 {
     $file = purify($file);
     if (file_exists('pics/' . $file . '.jpg')) {
         return 'pics/' . $file . '.jpg';
     } else {
         if (file_exists('/pics/' . $file . '.gif')) {
             return 'pics/' . $file . '.gif';
         } else {
             if (file_exists('/pics/' . $file . '.png')) {
                 return 'pics/' . $file . '.png';
             } else {
                 if (file_exists('/pics/' . $file . '.bmp')) {
                     return 'pics/' . $file . '.bmp';
                 } else {
                     return 'includes/img/unavailable.jpg';
                 }
             }
         }
     }
 }

/**
 * Purify HTML code using HTMLPurifier
 *
 * @param string|array $html : The html to purify
 * @return string|array
 */
function purify($html)
{
    if (empty($html) || trim((string) $html) === '') {
        log_message('error', 'htmlpurifier_pi::purify : The html you sent to the HTML Purifier is empty...I wonder how is that possible...');
        return FALSE;
    }
    if (is_array($html)) {
        foreach ($html as $key => $value) {
            $html[$key] = purify($value);
        }
        return $html;
    } else {
        require_once APPPATH . 'plugins/htmlpurifier/HTMLPurifier.standalone.php';
        $allowed_tags = 'p,em,i,strong,b,a[href],ul,ol,li,code,pre,blockquote';
        $config = HTMLPurifier_Config::createDefault();
        $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
        $config->set('HTML.Allowed', $allowed_tags);
        $config->set('HTML.TidyLevel', 'heavy');
        $config->set('AutoFormat.Linkify', 'true');
        $htmlpurifier = new HTMLPurifier($config);
        return $htmlpurifier->purify($html);
    }
}

function purify($dirty_html)
{
    if (is_array($dirty_html)) {
        foreach ($dirty_html as $key => $val) {
            $dirty_html[$key] = purify($val);
        }
        return $dirty_html;
    }
    if (trim($dirty_html) === '') {
        return $dirty_html;
    }
    $config = HTMLPurifier_Config::createDefault();
    $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
    $config->set('AutoFormat.Linkify', true);
    $config->set('CSS.Trusted', true);
    $config->set('CSS.AllowTricky', true);
    $config->set('Filter.YouTube', true);
    $config->set('HTML.SafeObject', true);
    $config->set('Output.FlashCompat', true);
    $config->set('Output.Newline', '<br />');
    $def = $config->getHTMLDefinition(true);
    $def->addElement('spoiler', 'Block', 'Flow', 'Common', array());
    return HTMLPurifier($dirty_html, $config);
}

    $new_position = isset($_GET['moveUp']) ? $position - 1 : $position + 1;
    $trade_position_pqid = Database::get()->querySingle("SELECT pqid FROM `poll_question`\r\n\t\t\t\t  WHERE pid = ?d AND q_position = ?d", $pid, $new_position)->pqid;
    Database::get()->query("UPDATE poll_question SET q_position = ?d WHERE pid = ?d AND pqid= ?d", $new_position, $pid, $pqid);
    Database::get()->query("UPDATE poll_question SET q_position = ?d WHERE pid = ?d AND pqid = ?d", $position, $pid, $trade_position_pqid);
    redirect_to_home_page("modules/questionnaire/admin.php?course={$course_code}&pid={$pid}");
}
if (isset($_POST['submitPoll'])) {
    $v = new Valitron\Validator($_POST);
    $v->rule('required', array('PollName'));
    $v->labels(array('PollName' => "{$langTheField} {$langTitle}"));
    if ($v->validate()) {
        $PollName = $_POST['PollName'];
        $PollStart = date('Y-m-d H:i', strtotime($_POST['PollStart']));
        $PollEnd = date('Y-m-d H:i', strtotime($_POST['PollEnd']));
        $PollDescription = purify($_POST['PollDescription']);
        $PollEndMessage = purify($_POST['PollEndMessage']);
        $PollAnonymized = isset($_POST['PollAnonymized']) ? $_POST['PollAnonymized'] : 0;
        if (isset($_GET['pid'])) {
            $pid = intval($_GET['pid']);
            Database::get()->query("UPDATE poll SET name = ?s,\r\n                    start_date = ?t, end_date = ?t, description = ?s, end_message = ?s, anonymized = ?d WHERE course_id = ?d AND pid = ?d", $PollName, $PollStart, $PollEnd, $PollDescription, $PollEndMessage, $PollAnonymized, $course_id, $pid);
            Session::Messages($langPollEdited, 'alert-success');
        } else {
            $PollActive = 1;
            $pid = Database::get()->query("INSERT INTO poll\r\n                        (course_id, creator_id, name, creation_date, start_date, end_date, active, description, end_message, anonymized)\r\n                        VALUES (?d, ?d, ?s, NOW(), ?t, ?t, ?d, ?s, ?s, ?d)", $course_id, $uid, $PollName, $PollStart, $PollEnd, $PollActive, $PollDescription, $PollEndMessage, $PollAnonymized)->lastInsertID;
            Session::Messages($langPollCreated, 'alert-success');
        }
        redirect_to_home_page("modules/questionnaire/admin.php?course={$course_code}&pid={$pid}");
    } else {
        // Errors
        Session::flashPost()->Messages($langFormErrors)->Errors($v->errors());
        if (isset($_GET['pid'])) {

                                format='txt',
                                date = NOW(),
                                date_modified = NOW()", $course_id, $subsystem, $chat_filename, $saveIn);
            $fchat = fopen($fileChatName, 'a');
            fwrite($fchat, $timeNow." ---- ".$langSaveMessage . " ---- !@#$ systemMsgSave\n");
            fclose($fchat);
        } else {
        }
        @unlink($exportFileChat);
        redirect_to_home_page("modules/conference/messageList.php?course=$course_code");
    }
  
// add new line
    if (isset($_POST['chatLine']) and trim($_POST['chatLine']) != '') {
        if (!isset($_POST['token']) || !validate_csrf_token($_POST['token'])) csrf_token_error();
        $chatLine = purify($_POST['chatLine']);
        $fchat = fopen($fileChatName, 'a');
        if ($is_editor) {
            $nick = "<b>".q($nick)."</b>";
        }
        fwrite($fchat, $timeNow . ' - ' . $nick . ' : ' . stripslashes($chatLine) . " !@#$ $uid       \n");
        fclose($fchat);
        redirect_to_home_page("modules/conference/messageList.php?course=$course_code");
    }
?>
<!DOCTYPE html>
<html>
<head>
    <base target="_parent">
    <meta http-equiv="refresh" content="30; url=<?php echo $_SERVER['SCRIPT_NAME']; ?>" />
    <title>Chat messages</title>

 $dates = array();
 if (isset($_POST['startdate_active']) and isset($_POST['startdate'])) {
     $start_sql = 'begin = ?s';
     $date_started = DateTime::createFromFormat("d-m-Y H:i", $_POST['startdate']);
     $dates[] = $date_started->format("Y-m-d H:i:s");
 } else {
     $start_sql = 'begin = NULL';
 }
 if (isset($_POST['enddate_active']) and isset($_POST['enddate'])) {
     $end_sql = 'end = ?s';
     $date_ended = DateTime::createFromFormat("d-m-Y H:i", $_POST['enddate']);
     $dates[] = $date_ended->format("Y-m-d H:i:s");
 } else {
     $end_sql = 'end = NULL';
 }
 $newContent = purify($newContent);
 if (isset($_POST['id'])) {
     // modify announcement
     $id = $_POST['id'];
     Database::get()->query("UPDATE admin_announcement
                     SET title = ?s, body = ?s, lang = ?s,
                         `date` = " . DBHelper::timeAfter() . ", $start_sql, $end_sql
                     WHERE id = ?d", $title, $newContent, $lang_admin_ann, $dates, $id);
     $message = $langAdminAnnModify;
 } else {
     // add new announcement
     // order
     $orderMax = Database::get()->querySingle("SELECT MAX(`order`) as max FROM admin_announcement")->max;
     $order = $orderMax + 1;
     Database::get()->query("INSERT INTO admin_announcement
                     SET title = ?s, 

                                                      url = ?s,
                                                      notes = ?s,
                                                      category_id = ?d,
                                                      datestamp = NOW(),
                                                      course_id = ?d,
                                                      `order` = ?d"
                        , $_POST['term'], $_POST['definition'], $url, purify($_POST['notes']), $category_id, $course_id, findorder($course_id));
                $log_action = LOG_INSERT;
                $success_message = $langGlossaryAdded;
            }
            $id = $q->lastInsertID;
            Log::record($course_id, MODULE_ID_GLOSSARY, $log_action, array('id' => $id,
                'term' => $_POST['term'],
                'definition' => $_POST['definition'],
                'url' => $url,
                'notes' => purify($_POST['notes'])));

            if ($q and $q->affectedRows) {
                invalidate_glossary_cache();
                Session::Messages($success_message, 'alert-success');
            }
            redirect_to_home_page("modules/glossary/index.php?course=$course_code");
        } else {
            $new_or_modify = isset($_POST['id']) ? "&edit=$_POST[id]" : "&add=1";
            Session::flashPost()->Messages($langFormErrors)->Errors($v->errors());
            redirect_to_home_page("modules/glossary/index.php?course=$course_code$new_or_modify");
        }
    }

    if (isset($_GET['delete'])) {
        $id = getDirectReference($_GET['delete']);

/** Walks recursively through an array and trims whitespace.
 *  Compresses multiple spaces into 1
 * @param array $data
 */
function purifyArray(array &$data)
{
    foreach ($data as $key => &$value) {
        trim($key);
        if (is_array($value)) {
            purify($value);
        } else {
            $value = trim(preg_replace('/\\s+/', ' ', $value));
        }
    }
}

 function getLink()
 {
     return "<a href=\"" . $this->getUrl() . "\">" . purify($this->getName()) . "</a>";
 }

$av = new AutoValidator("frm-register", $_POST);
if ($av->validate()) {
    if (isset($_POST['question']) && $_POST['question'] == "10") {
        $email = db_escape(purify(trim(Charset::Utf8ToDB($_POST['email']))));
        $creds = LoginUtils::HashToCredentials(db_escape($_POST['hash']));
        $username = db_escape(purify(trim(Charset::Utf8ToDB($creds['username']))));
        $password = db_escape(purify(trim(Charset::Utf8ToDB($creds['password']))));
        // Username libero?
        if (!DB::FindOne("SELECT 1 FROM users WHERE user = \"{$username}\"")) {
            // Legacy: Un timestamp sarebbe stato meglio, ma non dobbiamo fare nulla con questo dato, quindi va bene cosi'
            $data = date("d/m/Y G:i");
            $description = "Normal User";
            $md5 = LoginUtils::Md5FromCredentials($username, $password);
            // Tutto a posto
            exequery(sprintf('INSERT INTO users (user, mail, ip, os_browser, date, description, permission, verified, md5, last_login_timestamp, last_login_ip, newsletter)
                  VALUES ("%s", "%s", "%s", "%s", "%s", "%s", %s, %s, "%s", %s, "%s", %s)', $username, $email, get_ip(), db_escape(purify($_SERVER["HTTP_USER_AGENT"])), $data, $description, User::PERMISSION_USER, 1, $md5, time(), get_ip(), 1));
            // Logga l'utente
            $currentUser = UserFactory::CreateFromCredentials($username, $password);
            if ($currentUser->isLogged()) {
                $response->setSuccess(true);
                // Logga
                Log::Info(sprintf("%s si e' registrato", $currentUser['username']));
                $_SESSION['login_hash'] = $currentUser['md5'];
                setcookie('login_hash', $currentUser['md5'], time() + 60 * 60 * 24 * 7, '/');
            } else {
                // Questo non dovrebbe succedere
                $response->setError("E' successo un imprevisto durante la registrazione. Per favore segnala questo incidente ad un amministratore.");
            }
        } else {
            $response->setError("L'username e' stato gia' preso. Scegline un'altro.");
        }

    if (isset($_POST['submitBlogPost']) && $_POST['submitBlogPost'] == $langAdd) {
        if ($blog->permCreate($is_editor, $stud_allow_create, $uid)) {
            $post = new BlogPost();
            if ($post->create($_POST['blogPostTitle'], purify($_POST['newContent']), $uid, $course_id)) {
                Session::Messages($langBlogPostSaveSucc, 'alert-success');
            } else {
                Session::Messages($langBlogPostSaveFail);
            }
        } else {
            Session::Messages($langBlogPostNotAllowedCreate);
        }
    } elseif (isset($_POST['submitBlogPost']) && $_POST['submitBlogPost'] == $langModifBlogPost) {
        $post = new BlogPost();
        if ($post->loadFromDB($_POST['pId'])) {
            if ($post->permEdit($is_editor, $stud_allow_create, $uid)) {
                if ($post->edit($_POST['blogPostTitle'], purify($_POST['newContent']))) {
                    Session::Messages($langBlogPostSaveSucc, 'alert-success');
                } else {
                    Session::Messages($langBlogPostSaveFail);
                }
            } else {
                Session::Messages($langBlogPostNotAllowedEdit);
            }
        } else {
            Session::Messages($langBlogPostNotFound);
        }
    }
    redirect_to_home_page("modules/blog/index.php?course={$course_code}");
}
if (isset($message) && $message) {
    $tool_content .= $message . "<br/>";

    function updateFillInBlanksAnswerTypeValue(){
        $('input[name=answerType]#fill_in_blanks_selector').val($(this).val());
    }
 });
</script>
 ";
// the question form has been submitted
if (isset($_POST['submitQuestion'])) {
    $v = new Valitron\Validator($_POST);
    $v->rule('required', array('questionName'));
    $v->labels(array(
        'questionName' => "$langTheField $langQuestion"
    ));
    if($v->validate()) {
        $questionName = trim($questionName);
        $questionDescription = purify($questionDescription);
        // no name given
        if (empty($questionName)) {
            $msgErr = $langGiveQuestion;
        }
        if (isset($_GET['modifyQuestion'])) {
            $objQuestion->read($_GET['modifyQuestion']);
        }
        $objQuestion->updateTitle($questionName);
        $objQuestion->updateDescription($questionDescription);
        $objQuestion->updateType($answerType);
        $objQuestion->updateDifficulty($difficulty);
        $objQuestion->updateCategory($category);

        //If grade field set (only in Free text questions)
        if (isset($questionGrade)) {