PHP sanitize函数代码示例

function fetchHtml($url, $referer = false)
{
    $info = parse_url($url);
    if (empty($info['host'])) {
        return false;
    }
    $cookies = "data/cookies_" . str_replace('-', '.', sanitize($info['host'])) . ".txt";
    $agent = 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1';
    $headers = array('ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'ACCEPT_LANGUAGE: en-us,en;q=0.5', 'CACHE_CONTROL: max-age=0');
    $c = curl_init();
    curl_setopt($c, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($c, CURLOPT_VERBOSE, false);
    @curl_setopt($c, CURLOPT_FOLLOWLOCATION, 1);
    curl_setopt($c, CURLOPT_USERAGENT, $agent);
    curl_setopt($c, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($c, CURLOPT_URL, $url);
    curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($c, CURLOPT_COOKIEJAR, $cookies);
    curl_setopt($c, CURLOPT_COOKIEFILE, $cookies);
    if ($referer !== false) {
        curl_setopt($c, CURLOPT_REFERER, $url1);
    }
    $res = curl_exec($c);
    if (curl_getinfo($c, CURLINFO_HTTP_CODE) >= 300) {
        return false;
    }
    return $res;
}

 public function output()
 {
     //reset votes
     if ($this->config('resetvotes')) {
         $this->reset_votes();
         $this->set_config('resetvotes', 0);
     }
     if ($this->config('title')) {
         $this->header = sanitize($this->config('title'));
     }
     $this->tpl->add_css("\r\n\t\t\t.quickpolls_radio label{\r\n\t\t\t   display: block;\r\n\t\t\t   margin-bottom: -10px;\r\n\t\t\t }\r\n\t\t");
     $myout = '<div>' . sanitize($this->config('question')) . '</div><br />';
     if ($this->in->exists('quickpolls_' . $this->id)) {
         $blnResult = $this->performVote();
         if ($blnResult) {
             $myout .= $this->showResults();
         } else {
             $myout .= $this->showForm();
         }
     } else {
         if ($this->config('closedate') > 0 && $this->config('closedate') < $this->time->time || $this->in->get('quickpolls_results', 0) == $this->id && $this->config('showresults') || $this->userVoted()) {
             $myout .= $this->showResults();
         } else {
             $myout .= $this->showForm();
         }
     }
     if ($this->config('showresults') && !$this->blnShowResults) {
         $myout .= '<br /><div><a href="' . $this->SID . '&amp;quickpolls_results=' . $this->id . '">' . $this->user->lang('quickpolls_resuls') . '</a></div>';
     }
     return $myout;
 }

function login($email, $password)
{
    $user_id = user_id_from_email($email);
    $email = sanitize($email);
    $password = MD5($password);
    return mysql_result(mysql_query("SELECT COUNT(user_id) FROM users WHERE email = '{$email}' AND password = '{$password}'"), 0) == 1 ? $user_id : false;
}

function insertElement()
{
    if (isset($_POST['ClassificationID'])) {
        $ClassificationID = json_decode(sanitize($_POST['ClassificationID']));
    }
    if (isset($_POST['Element'])) {
        $Element = json_decode(sanitize($_POST['Element']));
    }
    if (isset($_POST['AtomicMass'])) {
        $AtomicMass = json_decode(sanitize($_POST['AtomicMass']));
    }
    $dbConn = mysqli_connect(server(), username(), password(), db("Elements"));
    if ($dbConn->connect_error) {
        die("Connection failed: " . $dbConn->connect_error);
    }
    $query = "INSERT INTO Elements ( ClassificationID, Element, AtomicMass ) " . "VALUES ( " . "" . $ClassificationID . ", " . "'" . $Element . "', " . "" . $AtomicMass . " );";
    $result = $dbConn->query($query);
    $return = new stdClass();
    $return->querystring = (string) $query;
    if ($result) {
        $return->success = true;
    } else {
        $return->success = false;
    }
    return json_encode($return);
}

function login($username, $password)
{
    $user_id = user_id_from_username($username);
    $username = sanitize($username);
    $password = md5($password);
    return mysql_result(mysql_query("SELECT COUNT(user_id) FROM users WHERE username = '{$username}' AND password = '{$password}'"), 0) == 1 ? $user_id : false;
}

function welcome_privmsg_send(&$registration_details)
{
    global $username, $main_smarty, $current_user;
    include_once mnminclude . 'user.php';
    include_once 'config.php';
    include_once my_pligg_base . '/modules/simple_messaging/kmessaging/class.KMessaging.php';
    $siteName = $main_smarty->get_config_vars('PLIGG_Visual_Name');
    // User ID of Admin
    define('welcome_privmsg_admin_id', '1');
    // Message Subject
    define('welcome_privmsg_subject', 'Welcome to ' . $siteName);
    // Message Body
    define('welcome_privmsg_body', 'Thanks for registering on our site!');
    // Check User ID != 0
    if ($registration_details['id'] > 0) {
        $msg_subject = sanitize(welcome_privmsg_subject, 2);
        $msg_body = welcome_privmsg_body;
        $msg_to_ID = $registration_details['id'];
        $msg_from_ID = welcome_privmsg_admin_id;
        $message = new KMessaging(true);
        $msg_result = $message->SendMessage($msg_subject, $msg_body, $msg_from_ID, $msg_to_ID, 0);
        if ($msg_result != 0) {
            echo "Module Error #" . $msg_result;
        }
    } else {
        // Unable to find User ID
        echo "Module Error #1";
        die;
    }
}

function login($username, $password)
{
    $user_id = user_id_from_username($username);
    $username = sanitize($username);
    $password = hash('sha512', $password);
    return mysql_result(mysql_query("SELECT COUNT(`user_id`) FROM `bplay_users` WHERE `username`='{$username}' AND `password`='{$password}'"), 0) == 1 ? $user_id : false;
}

 public function createProject()
 {
     $project_name = sanitize($_POST['projectName']);
     $user_id = sanitize($_POST['userId']);
     $errors = array();
     if (empty($project_name)) {
         $errors[] = "Please enter a project name! \n";
     }
     if (count($errors) == 0) {
         $dbh = new PDO("mysql:host=" . $GLOBALS['db_host'] . ";dbname=" . $GLOBALS['db_db'], $GLOBALS['db_user'], $GLOBALS['db_pass']);
         $dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
         $stmt = $dbh->prepare("select * from projects where UserID = :userId and ProjectName = :projectName");
         $stmt->execute(array('userId' => $user_id, "projectName" => $project_name));
         if ($stmt->rowCount()) {
             echo "Project with name: " . $project_name . " already exists!";
         } else {
             $stmt = $dbh->prepare("insert into projects (UserID, ProjectName) values ( :userId, :projectName) ");
             $stmt->execute(array('userId' => $user_id, "projectName" => $project_name));
             $project_id = $dbh->lastInsertId();
             if ($stmt->rowCount()) {
                 $project = array("projectName" => $project_name, "projectId" => $project_id);
                 echo json_success_data("Project Created Sucessfully", $project);
             } else {
                 echo json_error_msg("Project NOT Created Sucessfully");
             }
         }
     }
 }

function welcome_privmsg_send()
{
    global $username, $main_smarty, $current_user;
    include_once mnminclude . 'user.php';
    include_once './3rdparty/kmessaging/class.KMessaging.php';
    $siteName = $main_smarty->get_config_vars('PLIGG_Visual_Name');
    // User ID of Admin
    define('welcome_privmsg_admin_id', '1');
    // Message Subject
    define('welcome_privmsg_subject', 'Welcome to ' . $siteName);
    // Message Body
    define('welcome_privmsg_body', 'Thanks for registering on our site.  If you have any questions, be sure to visit our FAQ section. Sincerely, Webmaster');
    // Check User ID != 0
    if ($current_user->user_id > 0) {
        $msg_subject = sanitize(welcome_privmsg_subject, 2);
        $msg_body = welcome_privmsg_body;
        $msg_to_ID = $current_user->user_id;
        $msg_from_ID = welcome_privmsg_admin_id;
        $message = new KMessaging(true);
        $msg_result = $message->SendMessege($msg_subject, $msg_body, $msg_from_ID, $msg_to_ID, 0);
        if ($msg_result != 0) {
            echo "Module Error #" . $msg_result;
        }
    } else {
        // Unable to find User ID
        echo "Module Error #1";
        die;
    }
}

 public function output()
 {
     if ($this->config('pk_mycontent_headtext')) {
         $this->header = sanitize($this->config('pk_mycontent_headtext'));
     }
     return html_entity_decode(htmlspecialchars_decode($this->config('pk_mycontent_useroutput')));
 }

function getDatabases()
{
    // retrieve and sanitize posted values.
    if (isset($_POST['server'])) {
        $server = json_decode(sanitize($_POST['server']));
    }
    if (isset($_POST['username'])) {
        $username = json_decode(sanitize($_POST['username']));
    }
    if (isset($_POST['password'])) {
        $password = json_decode(sanitize($_POST['password']));
    }
    $databaseNames = array();
    $dbConn = mysqli_connect($server, $username, $password);
    $query = "SHOW DATABASES";
    $result = $dbConn->query($query);
    if ($result) {
        while ($row = $result->fetch_array()) {
            array_push($databaseNames, $row[0]);
        }
    }
    $return = new stdClass();
    $return->credentials = $server + "  " + $username + "   " + $password;
    $return->succsss = true;
    $return->errorMessage = "";
    $return->data['database_names'] = $databaseNames;
    $json = json_encode($return);
    return $json;
}

function checkandadd(&$uPOST)
{
    $a = 0;
    while (isset($uPOST["varn" . $a])) {
        if (isset($uPOST["varv" . $a])) {
            if (extExists($uPOST["varn" . $a], 1)) {
                db_connect();
                $query = "SELECT `value` from `ext` WHERE `data`='" . $uPOST["varn" . $a] . "' AND `maxmin`='1' LIMIT 1";
                sanitize($uPOST["varn" . $a]);
                $result = mysql_query($query) or die("query failed");
                db_disconnect();
                $c_row = mysql_fetch_assoc($result);
                if ($uPOST["varv" . $a] > $c_row['value']) {
                    //echo "highest";
                    extInsert($uPOST["varn" . $a], 1, $uPOST["varv" . $a], $uPOST['uts']);
                }
            }
        }
        if (isset($uPOST["varv" . $a])) {
            if (extExists($uPOST["varn" . $a], 0)) {
                db_connect();
                $query = "SELECT `value` from `ext` WHERE `data`='" . $uPOST["varn" . $a] . "' AND `maxmin`='0' LIMIT 1";
                sanitize($uPOST["varn" . $a]);
                $result = mysql_query($query) or die("query failed");
                db_disconnect();
                $c_row = mysql_fetch_assoc($result);
                if ($uPOST["varv" . $a] < $c_row['value']) {
                    //echo "lowest";
                    extInsert($uPOST["varn" . $a], 0, $uPOST["varv" . $a], $uPOST['uts']);
                }
            }
        }
        $a++;
    }
}

function editRanks()
{
    // Doh, globals!
    global $MySelf;
    global $DB;
    // Are we allowed to do this?
    if (!$MySelf->canEditRank()) {
        makeNotice("You do not have sufficient rights to access this page.", "warning", "Access denied");
    }
    // Get all unique rank IDS.
    $ranks = $DB->query("SELECT DISTINCT rankid FROM ranks");
    // Edit each one at a time.
    while ($rankID = $ranks->fetchRow()) {
        $ID = $rankID[rankid];
        if (isset($_POST["title_" . $ID . "_name"])) {
            // Cleanup
            $name = sanitize($_POST["title_" . $ID . "_name"]);
            numericCheck($_POST["order_" . $ID], 0);
            $order = $_POST["order_" . $ID];
            // Update the Database.
            $DB->query("UPDATE ranks SET name='" . $name . "', rankOrder='" . $order . "' WHERE rankid='" . $ID . "' LIMIT 1");
        }
    }
    header("Location: index.php?action=showranks");
}

 public function getUploadedFile($tag, $where = '/app/cache/uploads/')
 {
     $return = array('error' => false, 'path' => false, 'name' => false);
     if (isset($_FILES[$tag]['name']) && $_FILES[$tag]['name'] != '') {
         $image = $_FILES[$tag];
         $orig_name = isset($image['name']) ? $image['name'] : false;
         $type = isset($image['type']) ? $image['type'] : false;
         $tmp_name = isset($image['tmp_name']) ? $image['tmp_name'] : false;
         $error_value = isset($image['error']) ? $image['error'] : false;
         if ($error_value === false) {
             $return['error'] = 'The file could not be uploaded because ' . $error_value;
         } else {
             $dots = explode('.', $orig_name);
             if (count($dots) == 1) {
                 $return['error'] = 'Your filename does not have an extension';
             } else {
                 $extension = $dots[count($dots) - 1];
                 unset($dots[count($dots) - 1]);
                 $orig_file_name = implode('.', $dots);
                 $new_name = sanitize(trim($orig_file_name)) . '_' . md5(time() . $orig_name) . '.' . $extension;
                 while (file_exists(path($where . $new_name))) {
                     $new_name = time() % 100 . $new_name;
                 }
                 if (!move_uploaded_file($tmp_name, path($where . $new_name))) {
                     $return['error'] = 'The file could not be uploaded. Please try again.';
                 } else {
                     $return['path'] = $where . $new_name;
                     $return['name'] = $orig_name;
                 }
             }
         }
     }
     return $return;
 }

function dowork()
{
    global $db;
    $canIhaveAccess = 0;
    $canIhaveAccess = $canIhaveAccess + checklevel('god');
    if ($canIhaveAccess == 1) {
        if (is_writable('../settings.php') == 0) {
            die("Error: settings.php is not writeable.");
        }
        $action = isset($_REQUEST['action']) && sanitize($_REQUEST['action'], 3) != '' ? sanitize($_REQUEST['action'], 3) : "view";
        if ($action == "view") {
            $config = new pliggconfig();
            if (isset($_REQUEST['page'])) {
                $config->var_page = sanitize($_REQUEST['page'], 3);
                $config->showpage();
            } else {
                $config->listpages();
            }
        }
        if ($action == "save") {
            $config = new pliggconfig();
            $config->var_id = substr(sanitize($_REQUEST['var_id'], 3), 6, 10);
            $config->var_value = $db->escape($_REQUEST['var_value']);
            $config->store();
        }
    }
}