PHP safeString函数代码示例

 public function addOrEdit()
 {
     if (empty($_POST['web_name'])) {
         showMessage('网站名称不能为空！', 'admin_csystem_mweb_base_info.html');
     } else {
         $web_name = safeString($_POST['web_name']);
     }
     if (empty($_POST['web_extension'])) {
         showMessage('网站扩展名不能为空！', 'admin_csystem_mweb_base_info.html');
     } else {
         $web_extension = safeString($_POST['web_extension']);
     }
     $content = safeString($_POST['content']);
     $type = safeString($_POST['type']);
     //实例化syste模型类
     $web_base_info_m = M('system');
     $action = $web_base_info_m->judge();
     if ($action) {
         //如果$action不为空,则表示为更新操作
         $this->update_base($web_base_info_m, $action, $web_name, $web_extension, $content, $type);
     } else {
         //如果为空，则表示为添加操作
         $this->insert_base($web_base_info_m, $action, $web_name, $web_extension, $content, $type);
     }
 }

function insertComment($username, $text) {
   //  if were not connected, connect.
    global $isConnected;
    if (isset($isConnected) == false)
    connectDb ();

//Escape all strings and use the strip_tags() to be more safe
    
   $safe_strings = TRUE;

   function safeString($string){
    $string = mysql_real_escape_string(strip_tags($string));
    return $string;
   }
   
   $username = safeString($username);
   $text = safeString($text);
  
//$username = mysql_real_escape_string($username);
  //$ $text = mysql_real_escape_string($text);
    
// date and time
    $date = getCurrentDate();
    
//Inserts a comment dB. 
    mysql_query("INSERT INTO comment (`username`, `text`, `date`) VALUES ('$username' , '$text', '$date')")
    or die("Something went wrong with the insert query" . mysql_error());
}

 /**
  * 删除留言逻辑操作
  * @return  
  */
 public function message_delete()
 {
     $id = intval(safeString($_GET['id']));
     $message_m = M('message');
     if ($message_m->message_delete($id)) {
         showMessage('留言删除成功！', "admin_cmessage_mmessage_list.html");
     } else {
         showMessage('留言删除失败！', "admin_cmessage_mmessage_list.html");
     }
 }

function uploadSoaps($filePath)
{
    $file = fopen($filePath, "r");
    $lineCount = 1;
    $index = '';
    $timeStart = '';
    $frameStart = '';
    $timeEnd = '';
    $frameEnd = '';
    $text = '';
    while (!feof($file)) {
        $line = safeString(fgets($file));
        if ($lineCount == 1) {
            $index = $line;
        } else {
            if ($lineCount == 2) {
                $line = explode(' ', $line);
                $timeStart = safeString(explode(',', $line[0])[0]);
                $frameStart = safeString(explode(',', $line[0])[1]);
                $timeEnd = safeString(explode(',', $line[2])[0]);
                $frameEnd = safeString(explode(',', $line[2])[1]);
            } else {
                $text .= ' ' . $line;
            }
        }
        $lineCount++;
        if ($line == '') {
            addSubtitle(1, 1, $index, $timeStart, $frameStart, $timeEnd, $frameEnd, $text);
            $index = '';
            $timeStart = '';
            $frameStart = '';
            $timeEnd = '';
            $frameEnd = '';
            $text = '';
            $lineCount = 1;
        }
    }
    fclose($file);
}

<?php

include_once "session.php";
$ime = safeString($_POST['ime']);
$surname = safeString($_POST['surname']);
$mail = safeString($_POST['mail']);
$pass = safeString($_POST['pass']);
$passCheck = safeString($_POST['passCheck']);
$date = date("Y-m-d");
$slika = "./photos/defaultProfile.png";
$admin = 0;
if (!empty($ime) && !empty($surname) && !empty($mail) && !empty($pass) && !empty($passCheck)) {
    if ($pass == $passCheck) {
        $passHash = password_hash($pass, PASSWORD_DEFAULT);
        $arr = array('ime' => $ime, 'priimek' => $surname, 'pass' => $passHash, 'mail' => $mail, 'slika' => $slika, 'dat' => $date);
        $query = "INSERT INTO uporabniki (ime, priimek, pass, mail, slika, reg_date) VALUES(:ime, :priimek, :pass, :mail, :slika, :dat)";
        Db::execute($query, $arr);
        /*   Db::ArrayBinder($query,$arr);
             $query->execute();*/
        echo "Success";
    } else {
        echo "PassNoMatch";
    }
} else {
    echo "Fail";
}

    $values['tags'] = $tag_string;
    // Output to view
    $smarty->assign('values', $values);
}
if (isset($_POST['experiment_create'])) {
    $eid = (int) safeString($_POST['id']);
    $values = array('name' => safeString($_POST['experiment_name']), 'description' => safeString($_POST['experiment_description']));
    updateExperiment($eid, $values);
    // Something busted here, also need to account for checkboxes
    $tags = getTagsForExperiment($eid);
    $tag_list = array();
    $new_tags = array();
    foreach ($tags as $tag) {
        $tag_list[] = $tag['tag'];
    }
    $tag_submit = safeString($_POST['experiment_tags']);
    $tag_submit = explode(",", $tag_submit);
    foreach ($tag_submit as $tag) {
        if (!in_array($tag, $tag_list) && !in_array($tag, $tag_list)) {
            $new_tags[] = array('value' => $tag, 'weight' => 2);
        }
    }
    addTagsToExperiment($eid, $new_tags);
    $created = true;
    $title = "Successfully Edited Experiment";
}
$smarty->assign('eid', $eid);
$smarty->assign('created', $created);
$smarty->assign('user', $session->getUser());
$smarty->assign('title', 'Edit Experiment');
$smarty->assign('content', $smarty->fetch('experiment-edit.tpl'));

 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
require_once 'includes/config.php';
$data = array();
$error = false;
$title = 'Could Not Find Article';
$id = -1;
if (isset($_GET['id'])) {
    $id = (int) safeString($_GET['id']);
    $data = getArticle($id);
    $title = 'News: ' . ucwords($data[0]['title']);
}
if ($id == -1 || $id == "") {
    $error = true;
}
$smarty->assign('error', $error);
$smarty->assign('data', $data[0]);
$smarty->assign('user', $session->getUser());
$smarty->assign('title', $title);
$smarty->assign('content', $smarty->fetch('news.tpl'));
$smarty->display('skeleton.tpl');

 protected function createFormFields(FormBuilder $form, array $fields, $forceRequired = false)
 {
     foreach ($fields as $name => $field) {
         $options = array();
         if (!empty($field['label'])) {
             $options['label'] = $field['label'];
         }
         if (!empty($field['placeholder'])) {
             $options['attr']['placeholder'] = $field['placeholder'];
         }
         if (!empty($field['class'])) {
             $options['attr']['class'] = $field['class'];
         }
         if ($forceRequired || !empty($field['required']) && $field['required'] == true) {
             $options['required'] = true;
             $options['constraints'][] = new Assert\NotBlank();
         } else {
             $options['required'] = false;
         }
         if (!empty($field['choices']) && is_array($field['choices'])) {
             // Make the keys more sensible.
             $options['choices'] = array();
             foreach ($field['choices'] as $option) {
                 $options['choices'][safeString($option)] = $option;
             }
         }
         if (!empty($field['expanded'])) {
             $options['expanded'] = $field['expanded'];
         }
         if (!empty($field['multiple'])) {
             $options['multiple'] = $field['multiple'];
         }
         // Make sure $field has a type, or the form will break.
         if (empty($field['type'])) {
             $field['type'] = "text";
         } elseif ($field['type'] == "email") {
             $options['constraints'][] = new Assert\Email();
         }
         $form->add($name, $field['type'], $options);
     }
     return $form;
 }

<?php

require_once "praveenlib.php";
require_once "applib.php";
$keys = array("eventId");
$respjson = array("status" => "unprocessed", "errorCode" => 1);
if (checkGET($keys)) {
    $conn = connectSQL();
    if ($conn) {
        $eventId = safeString($conn, $_GET['eventId']);
        $sql = "select userId,userName,ticketId from eventregistration where eventId={$eventId} and status=1";
        if ($export = $conn->query($sql)) {
            $header = '';
            $data = '';
            while ($fieldinfo = mysqli_fetch_field($export)) {
                $header .= $fieldinfo->name . "\t";
            }
            while ($row = mysqli_fetch_row($export)) {
                $line = '';
                foreach ($row as $value) {
                    if (!isset($value) || $value == "") {
                        $value = "\t";
                    } else {
                        $value = str_replace('"', '""', $value);
                        $value = '"' . $value . '"' . "\t";
                    }
                    $line .= $value;
                }
                $data .= trim($line) . "\n";
            }
            $data = str_replace("\r", "", $data);

 /**
  * Get the next record. ('next' is defined as 'first one published after this one')
  */
 public function next($field = "datepublish", $where = array())
 {
     $field = safeString($field);
     $params = array($field => '<' . $this->values[$field], 'limit' => 1, 'order' => $field . ' DESC', 'returnsingle' => true);
     $next = $this->app['storage']->getContent($this->contenttype['singular_slug'], $params, $dummy, $where);
     return $next;
 }

 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
require_once 'includes/config.php';
require_once 'includes/database.php';
$errors = array();
if (isset($_POST['email'])) {
    $email = safeString($_POST['email']);
    $tmp = $db->query('select * from users where email="' . $email . '"');
    if (isset($tmp[0])) {
        $auth = $tmp[0]['auth'];
        $subject = 'Password Reset Link';
        $message = 'It seems you\'ve forgotten your password. Click <a href="http://isense.cs.uml.edu/reset.php?auth=' . $auth . '"> here </a> to reset your password';
        $headers = "MIME-Version: 1.0" . "\r\n";
        $headers .= "Content-type:text/html;charset=iso-8859-1" . "\r\n";
        $headers .= 'From: admin@127.0.0.1';
        if (mail('"' . $email . '"', $subject, $message, $headers)) {
            $smarty->assign('success', 1);
        } else {
            $smarty->assign('success', 0);
        }
    } else {
        $smarty->assign('success', -1);

/**
 * Inserts a linked list to the the different weblogs.
 *
 * @param array $params
 * @param object $smarty
 * @return string
 */
function smarty_weblog_list($params, &$smarty)
{
    global $PIVOTX;
    $params = cleanParams($params);
    $aExclude = array();
    if (!empty($params['exclude'])) {
        $aExclude = explode(",", $params['exclude']);
        $aExclude = array_map("trim", $aExclude);
        $aExclude = array_map("safe_string", $aExclude);
    }
    $Current_weblog = $PIVOTX['weblogs']->getCurrent();
    $format = getDefault($params['format'], "<li %active%><a href='%link%' title='%payoff%'>%display%</a></li>");
    $active = getDefault($params['current'], "class='activepage'");
    $output = array();
    $weblogs = $PIVOTX['weblogs']->getWeblogs();
    //echo "<pre>\n"; print_r($weblogs); echo "</pre>";
    foreach ($weblogs as $key => $weblog) {
        if (in_array(safeString($weblog['name']), $aExclude)) {
            continue;
        }
        $this_output = $format;
        $this_output = str_replace("%link%", $weblog['link'], $this_output);
        $this_output = str_replace("%name%", $weblog['name'], $this_output);
        $this_output = str_replace("%display%", $weblog['name'], $this_output);
        $this_output = str_replace("%payoff%", cleanAttributes($weblog['payoff']), $this_output);
        $this_output = str_replace("%internal%", $key, $this_output);
        if ($Current_weblog == $key) {
            $this_output = str_replace("%active%", $active, $this_output);
        } else {
            $this_output = str_replace("%active%", "", $this_output);
        }
        $output[$weblog['name']] .= $this_output;
    }
    if ($params['sort'] == "title") {
        ksort($output);
    }
    return stripslashes(implode("\n", $output));
}

 /**
  * Load the configuration from the various YML files.
  */
 public function getConfig()
 {
     $config = array();
     // Read the config
     $config['general'] = array_merge($this->parseConfigYaml('config.yml'), $this->parseConfigYaml('config_local.yml'));
     $config['taxonomy'] = $this->parseConfigYaml('taxonomy.yml');
     $tempContentTypes = $this->parseConfigYaml('contenttypes.yml');
     $config['menu'] = $this->parseConfigYaml('menu.yml');
     $config['routing'] = $this->parseConfigYaml('routing.yml');
     $config['permissions'] = $this->parseConfigYaml('permissions.yml');
     $config['extensions'] = array();
     // fetch the theme config. requires special treatment due to the path
     $this->app['resources']->initializeConfig($config);
     $paths = $this->app['resources']->getPaths();
     $themeConfigFile = $paths['themepath'] . '/config.yml';
     $config['theme'] = $this->parseConfigYaml($themeConfigFile, array(), false);
     // @todo: If no config files can be found, get them from bolt.cm/files/default/
     $this->paths = $this->app['resources']->getPaths();
     $this->setDefaults();
     // Make sure old settings for 'contentsCss' are still picked up correctly
     if (isset($config['general']['wysiwyg']['ck']['contentsCss'])) {
         $config['general']['wysiwyg']['ck']['contentsCss'] = array(1 => $config['general']['wysiwyg']['ck']['contentsCss']);
     }
     // Make sure old settings for 'accept_file_types' are not still picked up. Before 1.5.4 we used to store them
     // as a regex-like string, and we switched to an array. If we find the old style, fall back to the defaults.
     if (isset($config['general']['accept_file_types']) && !is_array($config['general']['accept_file_types'])) {
         unset($config['general']['accept_file_types']);
     }
     // Merge the array with the defaults. Setting the required values that aren't already set.
     $config['general'] = array_merge_recursive_distinct($this->defaultConfig, $config['general']);
     // Make sure the cookie_domain for the sessions is set properly.
     if (empty($config['general']['cookies_domain'])) {
         if (isset($_SERVER['HTTP_HOST'])) {
             $hostname = $_SERVER['HTTP_HOST'];
         } elseif (isset($_SERVER['SERVER_NAME'])) {
             $hostname = $_SERVER['SERVER_NAME'];
         } else {
             $hostname = '';
         }
         // Don't set the domain for a cookie on a "TLD" - like 'localhost', or if the server_name is an IP-address
         if (strpos($hostname, '.') > 0 && preg_match("/[a-z0-9]/i", $hostname)) {
             if (preg_match("/^www[0-9]*./", $hostname)) {
                 $config['general']['cookies_domain'] = '.' . preg_replace("/^www[0-9]*./", '', $hostname);
             } else {
                 $config['general']['cookies_domain'] = '.' . $hostname;
             }
             // Make sure we don't have consecutive '.'-s in the cookies_domain..
             $config['general']['cookies_domain'] = str_replace('..', '.', $config['general']['cookies_domain']);
         } else {
             $config['general']['cookies_domain'] = '';
         }
     }
     // Make sure Bolt's mount point is OK:
     $config['general']['branding']['path'] = '/' . safeString($config['general']['branding']['path']);
     // Make sure $config['taxonomy'] is an array. (if the file is empty, YAML parses it as NULL)
     if (empty($config['taxonomy'])) {
         $config['taxonomy'] = array();
     }
     // Clean up taxonomies
     foreach ($config['taxonomy'] as $key => $value) {
         if (!isset($config['taxonomy'][$key]['name'])) {
             $config['taxonomy'][$key]['name'] = ucwords($config['taxonomy'][$key]['slug']);
         }
         if (!isset($config['taxonomy'][$key]['singular_name'])) {
             if (isset($config['taxonomy'][$key]['singular_slug'])) {
                 $config['taxonomy'][$key]['singular_name'] = ucwords($config['taxonomy'][$key]['singular_slug']);
             } else {
                 $config['taxonomy'][$key]['singular_name'] = ucwords($config['taxonomy'][$key]['slug']);
             }
         }
         if (!isset($config['taxonomy'][$key]['slug'])) {
             $config['taxonomy'][$key]['slug'] = strtolower(safeString($config['taxonomy'][$key]['name']));
         }
         if (!isset($config['taxonomy'][$key]['singular_slug'])) {
             $config['taxonomy'][$key]['singular_slug'] = strtolower(safeString($config['taxonomy'][$key]['singular_name']));
         }
         if (!isset($config['taxonomy'][$key]['has_sortorder'])) {
             $config['taxonomy'][$key]['has_sortorder'] = false;
         }
         // Make sure the options are $key => $value pairs, and not have implied integers for keys.
         if (!empty($config['taxonomy'][$key]['options']) && is_array($config['taxonomy'][$key]['options'])) {
             $options = array();
             // FIXME using $value variable seems bad idea because of outer loop uses too
             foreach ($config['taxonomy'][$key]['options'] as $optionkey => $value) {
                 if (is_numeric($optionkey)) {
                     $optionkey = makeSlug($value);
                     // was: strtolower(safeString($value));
                 }
                 $options[$optionkey] = $value;
             }
             $config['taxonomy'][$key]['options'] = $options;
         }
         // If taxonomy is like tags, set 'tagcloud' to true by default.
         if ($config['taxonomy'][$key]['behaves_like'] == 'tags' && !isset($config['taxonomy'][$key]['tagcloud'])) {
             $config['taxonomy'][$key]['tagcloud'] = true;
         }
     }
//.........这里部分代码省略.........

 }
 if ($description == '') {
     array_push($errors, 'The video description can not be blank.');
 }
 $values['description'] = $description;
 $citystate = '';
 if (isset($_POST['video_citystate'])) {
     $citystate = safeString($_POST['video_citystate']);
 }
 if ($citystate == '') {
     array_push($errors, 'The video city and states can not be blank.');
 }
 $values['citystate'] = $citystate;
 $street = '';
 if (isset($_POST['video_street'])) {
     $street = safeString($_POST['video_street']);
 }
 if ($street == '') {
     array_push($errors, 'The video street scan not be blank.');
 }
 $values['street'] = $street;
 if (!isset($_FILES['video_file'])) {
     array_push($errors, 'No session file was entered.');
 }
 if (strpos($_FILES['video_file']['type'], "video") === FALSE) {
     array_push($errors, 'The file you uploaded is not a video');
 }
 if (count($errors) == 0) {
     /* Might want to check the move code, this could cause colisions */
     $target_path = '/tmp/';
     $target_path = $target_path . basename($_FILES['video_file']['name']);

 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
 * DAMAGE.
 */
require_once '../includes/config.php';
if (isset($_GET['action']) && isset($_GET['follower']) && isset($_GET['followee'])) {
    $result = false;
    $action = safeString($_GET['action']);
    $follower = safeString($_GET['follower']);
    $followee = safeString($_GET['followee']);
    switch ($action) {
        case "follow":
            $result = addGraphEdge($follower, $followee);
            break;
        case "unfollow":
            $result = deleteGraphEdge($follower, $followee);
            break;
    }
    if ($result) {
        echo "worked!";
    } else {
        echo "failed!";
    }
}