PHP remove_magic_quotes函数代码示例

/**
 * @access private
 * @param string $array 
 * @return array
 */
function remove_magic_quotes($array)
{
    foreach ($array as $k => $v) {
        $array[$k] = is_array($v) ? remove_magic_quotes($v) : stripslashes($v);
    }
    return $array;
}

 function remove_magic_quotes(&$array)
 {
     foreach ($array as $key => $val) {
         if (is_array($val)) {
             remove_magic_quotes($array[$key]);
         } elseif (is_string($val)) {
             $array[$key] = str_replace(array('\\\\', '\\\\"', "\\'"), array('\\', '\\"', "'"), $val);
         }
     }
 }

function remove_magic_quotes(&$array)
{
    foreach (array_keys($array) as $key) {
        if (is_array($array[$key])) {
            remove_magic_quotes($array[$key]);
        } else {
            $array[$key] = stripslashes($array[$key]);
        }
    }
}

function remove_magic_quotes($array)
{
    foreach ($array as $k => $v) {
        if (is_array($v)) {
            $array[$k] = remove_magic_quotes($v);
        } else {
            $array[$k] = stripslashes($v);
        }
    }
    return $array;
}

 *
 * Moved all session functions into one file, 
 * include this where session starting might be required
 *
 * @package Core
 * @author  Andreas Goetz <cpuidle@gmx.de>
 * @version $Id: session.php,v 1.13 2008/02/28 20:01:17 andig2 Exp $
 */
// start session
session_start();
require_once './core/functions.php';
// needed for remove_magic_quotes
// get rid of magic quotes
if (get_magic_quotes_gpc()) {
    if (isset($_SESSION)) {
        remove_magic_quotes($_SESSION);
    }
}
/**
 * Get session value or specified default
 */
function session_get($varname, $default = null)
{
    return $_SESSION['vdb'][$varname] ? $_SESSION['vdb'][$varname] : $default;
}
/**
 * Set session value or specified default
 */
function session_set($varname, $value)
{
    $_SESSION['vdb'][$varname] = $value;

define(__NAMESPACE__ . '\\LIB', SYSTEM . '/libraries');
/**
 *
 * Other variables
 *
 */
define(__NAMESPACE__ . '\\PLUGIN_NAME', 'STSCore');
require FUNCTIONS . '/core.php';
start_timer();
//register_globals off
unregister_globals();
if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
    $_POST = remove_magic_quotes($_POST);
    $_GET = remove_magic_quotes($_GET);
    $_COOKIE = remove_magic_quotes($_COOKIE);
    $_SERVER = remove_magic_quotes($_SERVER);
}
register_shutdown_function(__NAMESPACE__ . '\\shutdown');
spl_autoload_register(__NAMESPACE__ . '\\class_auto_load');
require FUNCTIONS . '/html.php';
$error =& singleton::get(__NAMESPACE__ . '\\error');
try {
    if (!file_exists(SETTINGS . '/config.php')) {
        throw new \Exception('The config file could not be found.');
    } else {
        require SETTINGS . '/config.php';
    }
} catch (\Exception $e) {
    echo 'The config file "user/settings/config.php" could not be found. Please run the <a href="install/">installer</a>.';
    $error->create(array('type' => 'file_not_found', 'message' => $e->getMessage()));
}

} else {
    function strtoupper_utf($str)
    {
        return strtoupper($str);
    }
    function strtolower_utf($str)
    {
        return strtolower($str);
    }
    function strlen_utf($str)
    {
        return strlen($str);
    }
    function substr_utf($str, $from, $to)
    {
        return substr($str, $from, $to);
    }
}
///
///
/// main
///
///
error_reporting(E_ALL);
ini_set('display_errors', 'on');
remove_magic_quotes();
init_session();
init_default_languages();
process_action(get('action'));
# phpFolding plugin _most_ recommended, http://www.vim.org/scripts/script.php?script_id=1623
# vim: set tw=120 ts=4 sts=4 sw=4 et : #

require_once './core/compatibility.php';
require_once './lib/smarty/SmartyBC.class.php';
/* --------------------------------------------------------------------*/
// exception handling beyond this point
set_exception_handler('exception_handler');
// Set up some defaults
error_reporting($config['debug'] ? E_ALL ^ E_NOTICE : E_ERROR + E_PARSE);
// Remove environment variables from global scope- ensures clean namespace
foreach (array_keys($_ENV) as $key) {
    unset($GLOBALS[$key]);
}
// force magic quotes off
ini_set('magic_quotes_runtime', 0);
if (get_magic_quotes_gpc()) {
    if (!empty($_REQUEST)) {
        remove_magic_quotes($_REQUEST);
    }
    ini_set('magic_quotes_gpc', 0);
}
// register_globals off? Well I like it...
extract($_REQUEST);
// security check
if ($id) {
    validate_input($id);
}
if ($ajax_update) {
    validate_input($ajax_update);
}
// Smarty setup
$smarty = new SmartyBC();
$smarty->compile_dir = './cache/smarty';

//.........这里部分代码省略.........
    $source = param('source', 'string', $params['source'] . ' login form');
    $Form->hidden('source', $source);
    $Form->hidden('redirect_to', $redirect_to);
    if ($inskin) {
        // inskin login form
        $Form->hidden('inskin', true);
        $separator = '<br />';
    } else {
        // standard login form
        $Form->hidden('validate_required', $params['validate_required']);
        if (isset($params['action'], $params['reqID'], $params['sessID']) && $params['action'] == 'validatemail') {
            // the user clicked the link from the "validate your account" email, but has not been logged in; pass on the relevant data:
            $Form->hidden('action', 'validatemail');
            $Form->hidden('reqID', $params['reqID']);
            $Form->hidden('sessID', $params['sessID']);
        }
        $separator = '';
    }
    // check if should transmit hashed password
    if ($params['transmit_hashed_password']) {
        // used by JS-password encryption/hashing:
        $pwd_salt = $Session->get('core.pwd_salt');
        if (empty($pwd_salt)) {
            // Do not regenerate if already set because we want to reuse the previous salt on login screen reloads
            // fp> Question: the comment implies that the salt is reset even on failed login attemps. Why that? I would only have reset it on successful login. Do experts recommend it this way?
            // but if you kill the session you get a new salt anyway, so it's no big deal.
            // At that point, why not reset the salt at every reload? (it may be good to keep it, but I think the reason should be documented here)
            $pwd_salt = generate_random_key(64);
            $Session->set('core.pwd_salt', $pwd_salt, 86400);
            $Session->dbsave();
            // save now, in case there's an error later, and not saving it would prevent the user from logging in.
        }
        $Form->hidden('pwd_salt', $pwd_salt);
        $Form->hidden('pwd_hashed', '');
        // gets filled by JS
    }
    $Form->begin_field();
    $Form->text_input($dummy_fields['login'], $params['login'], 18, T_('Login'), $separator . T_('Enter your username (or email address).'), array('maxlength' => 255, 'class' => 'input_text', 'required' => true));
    $Form->end_field();
    if ($inskin) {
        $lost_password_url = regenerate_url('disp', 'disp=lostpassword');
    } else {
        $lost_password_url = $secure_htsrv_url . 'login.php?action=lostpassword&amp;redirect_to=' . rawurlencode(url_rel_to_same_host($redirect_to, $secure_htsrv_url));
    }
    if (!empty($login)) {
        $lost_password_url .= '&amp;' . $dummy_fields['login'] . '=' . rawurlencode($login);
    }
    $pwd_note = $pwd_note = '<a href="' . $lost_password_url . '">' . T_('Lost password ?') . '</a>';
    $Form->begin_field();
    $Form->password_input($dummy_fields['pwd'], '', 18, T_('Password'), array('note' => $pwd_note, 'maxlength' => 70, 'class' => 'input_text', 'required' => true));
    $Form->end_field();
    // Allow a plugin to add fields/payload
    $Plugins->trigger_event('DisplayLoginFormFieldset', array('Form' => &$Form));
    // Submit button(s):
    $submit_buttons = array(array('name' => 'login_action[login]', 'value' => T_('Log in!'), 'class' => 'search', 'style' => 'font-size: 120%'));
    if (!$inskin && strpos($redirect_to, $admin_url) !== 0 && strpos($ReqHost . $redirect_to, $admin_url) !== 0 && !is_admin_page()) {
        // provide button to log straight into backoffice, if we would not go there anyway
        $submit_buttons[] = array('name' => 'login_action[redirect_to_backoffice]', 'value' => T_('Log into backoffice!'), 'class' => 'search');
    }
    $Form->buttons_input($submit_buttons);
    if ($inskin) {
        $before_register_link = '<strong>';
        $after_register_link = '</strong>';
        $register_link_style = 'text-align:right; margin: 1em 0 1ex';
    } else {
        echo '<div class="center notes" style="margin: 1em 0">' . T_('You will have to accept cookies in order to log in.') . '</div>';
        // Passthrough REQUEST data (when login is required after having POSTed something)
        // (Exclusion of 'login_action', 'login', and 'action' has been removed. This should get handled via detection in Form (included_input_field_names),
        //  and "action" is protected via crumbs)
        $Form->hiddens_by_key(remove_magic_quotes($_REQUEST));
        $before_register_link = '';
        $after_register_link = '';
        $register_link_style = 'text-align:right';
    }
    echo '<div class="login_actions" style="' . $register_link_style . '">';
    echo get_user_register_link($before_register_link, $after_register_link, T_('No account yet? Register here') . ' &raquo;', '#', true, $redirect_to, $source);
    echo '</div>';
    $Form->end_form();
    echo '<script type="text/javascript">';
    // Autoselect login text input or pwd input, if there\'s a login already:
    echo 'var login = document.getElementById("' . $dummy_fields['login'] . '");
		if( login.value.length > 0 )
		{	// Focus on the password field:
			document.getElementById("' . $dummy_fields['pwd'] . '").focus();
		}
		else
		{	// Focus on the login field:
			login.focus();
		}';
    if ($params['transmit_hashed_password']) {
        // Hash the password onsubmit and clear the original pwd field
        // TODO: dh> it would be nice to disable the clicked/used submit button. That's how it has been when the submit was attached to the submit button(s)
        echo 'addEvent( document.getElementById("login_form"), "submit", function(){' . 'var form = document.getElementById("login_form");' . 'if( form.pwd_hashed && form.' . $dummy_fields['pwd'] . ' && form.pwd_salt && typeof hex_sha1 != "undefined" && typeof hex_md5 != "undefined" )
				{' . 'form.pwd_hashed.value = hex_sha1( hex_md5(form.' . $dummy_fields['pwd'] . '.value) + form.pwd_salt.value );
					form.' . $dummy_fields['pwd'] . '.value = "padding_padding_padding_padding_padding_padding_hashed_' . $Session->ID . '";' . '}
				return true;
			}, false );';
    }
    echo '</script>';
}

/**
 * remove magic quotes recursivly
 *
 * @author Andreas Gohr <andi@splitbrain.org>
 */
function remove_magic_quotes(&$array)
{
    foreach (array_keys($array) as $key) {
        // handle magic quotes in keynames (breaks order)
        $sk = stripslashes($key);
        if ($sk != $key) {
            $array[$sk] = $array[$key];
            unset($array[$key]);
            $key = $sk;
        }
        // do recursion if needed
        if (is_array($array[$key])) {
            remove_magic_quotes($array[$key]);
        } else {
            $array[$key] = stripslashes($array[$key]);
        }
    }
}

 function init_param($para_types, $var, $type = '', $default = NO_DEFAULT_PARAM, $must_exist = false, $set_global = true, $global_override = true)
 {
     if (!is_array($para_types)) {
         if ($para_types) {
             $para_tmp = $para_types;
             $para_types = array();
             $para_types[] = $para_tmp;
         } else {
             $para_types = array('POST', 'GET');
         }
     }
     $para_found = false;
     foreach ($para_types as $para_type) {
         switch (strtoupper($para_type)) {
             case 'POST':
                 if (isset($_POST[$var])) {
                     $para_value = remove_magic_quotes($_POST[$var]);
                     $para_found = true;
                 }
                 break;
             case 'GET':
                 if (isset($_GET[$var])) {
                     $para_value = remove_magic_quotes($_GET[$var]);
                     $para_found = true;
                 }
                 break;
             case 'COOKIE':
                 if (isset($_COOKIE[$var])) {
                     $para_value = remove_magic_quotes($_COOKIE[$var]);
                     $para_found = true;
                 }
                 break;
             case 'SESSION':
                 if (isset($_SESSION[$var])) {
                     $para_value = $_SESSION[$var];
                     $para_found = true;
                 }
                 break;
             default:
         }
         if ($para_found) {
             break;
         }
     }
     if ($must_exist && !$para_found) {
         redirect_header("", 5, "Required parameter isn't set. [" . $var . "]");
     }
     if (!$para_found) {
         if ($default !== NO_DEFAULT_PARAM) {
             $para_value = $default;
         } elseif ($type == 'string-yn') {
             $para_value = 'N';
         } elseif ($type == 'check-01') {
             $para_value = '0';
         }
     }
     if (isset($para_value)) {
         if (!empty($type)) {
             // Force the type
             switch ($type) {
                 case 'html':
                     // do nothing
                     break;
                 case 'clean-html':
                     $para_value = trim(clean_html($para_value));
                     break;
                 case 'string':
                     $para_value = trim(strip_tags($para_value));
                     break;
                 case 'string-yn':
                     $para_value = $para_value == 'Y' ? 'Y' : 'N';
                     break;
                 case 'check-01':
                     $para_value = $para_value == '1' ? '1' : '0';
                     break;
                 case 'array-int':
                     settype($para_value, 'array');
                     array_walk($para_value, '_array_int_callback');
                     break;
                 default:
                     settype($para_value, $type);
             }
         }
         set_param($var, $para_value);
     }
     if ($set_global) {
         if ($global_override || empty($GLOBALS[$var])) {
             if (!empty($GLOBALS[$var])) {
                 unset($GLOBALS[$var]);
             }
             if (!empty($para_value)) {
                 $GLOBALS[$var] = $para_value;
             }
         }
     }
     if (!empty($para_value)) {
         return $para_value;
     } else {
         return false;
     }
//.........这里部分代码省略.........

 case "update":
     $standalone = 0;
     wp_refcheck("/wp-admin");
     $any_changed = 0;
     // iterate through the list of options in this group
     // pull the vars from the post
     // validate ranges etc.
     // update the values
     $options = $wpdb->get_results("SELECT " . wp_table('options') . ".option_id, option_name, option_type, option_value, option_admin_level " . "FROM " . wp_table('options') . " " . "LEFT JOIN " . wp_table('optiongroup_options') . " ON " . wp_table('options') . ".option_id = " . wp_table('optiongroup_options') . ".option_id " . "WHERE group_id = {$option_group_id} " . "ORDER BY seq");
     if ($options) {
         foreach ($options as $option) {
             // should we even bother checking?
             if ($user_level >= $option->option_admin_level) {
                 $this_name = $option->option_name;
                 $old_val = $option->option_value;
                 $new_val = remove_magic_quotes($_POST[$this_name]);
                 if ($new_val != $old_val) {
                     // get type and validate
                     $msg = validate_option($option, $this_name, $new_val);
                     if ($msg == '') {
                         //no error message
                         $result = $wpdb->query("UPDATE " . wp_table('options') . " SET option_value = '" . addslashes($new_val) . "' WHERE option_id = {$option->option_id}");
                         if (!$result) {
                             $db_errors .= " SQL error while saving {$this_name}. ";
                         } else {
                             ++$any_changed;
                         }
                     } else {
                         $validation_message .= $msg;
                     }
                 }

//.........这里部分代码省略.........
                foreach ($mimeParser->warnings as $k => $v) {
                    pbm_msg('Warning: ' . $v . ' at position ' . $k);
                }
            }
        }
        unlink($tmpMIME);
        if (empty($html_body)) {
            // Plain text message
            pbm_msg('Message type: TEXT');
            pbm_msg('Message body: <pre style="font-size:10px">' . htmlspecialchars($strbody) . '</pre>');
            // Process body. First fix different line-endings (dos, mac, unix), remove double newlines
            $content = str_replace(array("\r", "\n\n"), "\n", trim($strbody));
            // First see if there's an <auth> tag with login and password
            if (($auth = pbm_get_auth_tag($content)) === false) {
                // No <auth> tag, let's detect legacy "username:password" on the first line
                $a_body = explode("\n", $content, 2);
                // tblue> splitting only into 2 parts allows colons in the user PW
                // Note: login and password cannot include '<' !
                $auth = explode(':', strip_tags($a_body[0]), 2);
                // Drop the first line with username and password
                $content = $a_body[1];
            }
        } else {
            // HTML message
            pbm_msg('Message type: HTML');
            if (($parsed_message = pbm_prepare_html_message($html_body)) === false) {
                // No 'auth' tag provided, skip to the next message
                rmdir_r($tmpDirMIME);
                continue;
            }
            list($auth, $content) = $parsed_message;
        }
        // TODO: dh> should the password really get trimmed here?!
        $user_pass = isset($auth[1]) ? trim(remove_magic_quotes($auth[1])) : NULL;
        $user_login = trim(evo_strtolower(remove_magic_quotes($auth[0])));
        if (empty($user_login) || empty($user_pass)) {
            pbm_msg(sprintf(T_('Please add username and password in message body in format %s.'), '"&lt;auth&gt;username:password&lt;/auth&gt;"'), true);
            rmdir_r($tmpDirMIME);
            continue;
        }
        // Authenticate user
        pbm_msg('Authenticating user: &laquo;' . $user_login . '&raquo;');
        $pbmUser =& pbm_validate_user_password($user_login, $user_pass);
        if (!$pbmUser) {
            pbm_msg(sprintf(T_('Authentication failed for user &laquo;%s&raquo;'), htmlspecialchars($user_login)), true);
            rmdir_r($tmpDirMIME);
            continue;
        }
        $pbmUser->get_Group();
        // Load group
        if (!empty($is_cron_mode)) {
            // Assign current User if we are in cron mode. This is needed in order to check user permissions
            global $current_User;
            $current_User = duplicate($pbmUser);
        }
        // Activate User's locale
        locale_activate($pbmUser->get('locale'));
        pbm_msg('<b class="green">Success</b>');
        if ($post_categories = xmlrpc_getpostcategories($content)) {
            $main_cat_ID = array_shift($post_categories);
            $extra_cat_IDs = $post_categories;
            pbm_msg('Extra categories: ' . implode(', ', $extra_cat_IDs));
        } else {
            $main_cat_ID = $Settings->get('eblog_default_category');
            $extra_cat_IDs = array();
        }

/**
 * Remove slashes if magic quotes are enabled
 *
 * @param mixed $mixed string or array to strip slashes from
 *
 * @return mixed cleaned string or array
 */
function remove_magic_quotes($mixed)
{
    if (get_magic_quotes_gpc()) {
        if (is_array($mixed)) {
            foreach ($mixed as $k => $v) {
                $mixed[$k] = remove_magic_quotes($v);
            }
        } else {
            $mixed = stripslashes($mixed);
        }
    }
    return $mixed;
}

 /**
  * Remove quotes from input.
  * This handles magic_quotes_gpc and magic_quotes_sybase PHP settings/variants.
  *
  * NOTE: you should not use it directly, but one of the param-functions!
  *
  * @param mixed string or array (function is recursive)
  * @return mixed Value, with magic quotes removed
  */
 function remove_magic_quotes($mixed)
 {
     if (is_array($mixed)) {
         foreach ($mixed as $k => $v) {
             $mixed[$k] = remove_magic_quotes($v);
         }
     } elseif (is_string($mixed)) {
         // echo 'Removing slashes ';
         $mixed = stripslashes($mixed);
     }
     return $mixed;
 }