PHP scrub_in函数代码示例

/**
 * scrub_in
 * Run on inputs, stuff that might get stuck in our db
 */
function scrub_in($input)
{
    if (!is_array($input)) {
        return stripslashes(htmlspecialchars(strip_tags($input), ENT_QUOTES, AmpConfig::get('site_charset')));
    } else {
        $results = array();
        foreach ($input as $item) {
            $results[] = scrub_in($item);
        }
        return $results;
    }
}

function update_preferences($pref_id = 0)
{
    /* Get current keys */
    $sql = "SELECT `id`,`name`,`type` FROM `preference`";
    /* If it isn't the System Account's preferences */
    if ($pref_id != '-1') {
        $sql .= " WHERE `catagory` != 'system'";
    }
    $db_results = Dba::read($sql);
    $results = array();
    // Collect the current possible keys
    while ($r = Dba::fetch_assoc($db_results)) {
        $results[] = array('id' => $r['id'], 'name' => $r['name'], 'type' => $r['type']);
    }
    // end collecting keys
    /* Foreach through possible keys and assign them */
    foreach ($results as $data) {
        /* Get the Value from POST/GET var called $data */
        $name = $data['name'];
        $apply_to_all = 'check_' . $data['name'];
        $new_level = 'level_' . $data['name'];
        $id = $data['id'];
        $value = scrub_in($_REQUEST[$name]);
        /* Some preferences require some extra checks to be performed */
        switch ($name) {
            case 'transcode_bitrate':
                $value = Stream::validate_bitrate($value);
                break;
            default:
                break;
        }
        if (preg_match('/_pass$/', $name)) {
            if ($value == '******') {
                unset($_REQUEST[$name]);
            } else {
                if (preg_match('/md5_pass$/', $name)) {
                    $value = md5($value);
                }
            }
        }
        /* Run the update for this preference only if it's set */
        if (isset($_REQUEST[$name])) {
            Preference::update($id, $pref_id, $value, $_REQUEST[$apply_to_all]);
        }
        if (Access::check('interface', '100') && $_REQUEST[$new_level]) {
            Preference::update_level($id, $_REQUEST[$new_level]);
        }
    }
    // end foreach preferences
    // Now that we've done that we need to invalidate the cached preverences
    Preference::clear_from_session();
}

            $GLOBALS['user'] = new User($auth['username']);
            $GLOBALS['user']->id = '-1';
            $GLOBALS['user']->username = $auth['username'];
            $GLOBALS['user']->fullname = $auth['fullname'];
            $GLOBALS['user']->access = $auth['access'];
        }
        if (!$GLOBALS['user']->id and !AmpConfig::get('demo_mode')) {
            Auth::logout(session_id());
            exit;
        }
        $GLOBALS['user']->update_last_seen();
    }
} else {
    if (isset($_REQUEST['sid'])) {
        session_name(AmpConfig::get('session_name'));
        session_id(scrub_in($_REQUEST['sid']));
        session_start();
        $GLOBALS['user'] = new User($_SESSION['userdata']['uid']);
    } else {
        $GLOBALS['user'] = new User();
    }
}
// If NO_SESSION passed
// Load the Preferences from the database
Preference::init();
if (session_id()) {
    Session::extend(session_id());
    // We only need to create the tmp playlist if we have a session
    $GLOBALS['user']->load_playlist();
}
/* Add in some variables for ajax done here because we need the user */

 case 'show_all_songs':
     $artist = new Artist($_REQUEST['artist']);
     $artist->format();
     $object_type = 'song';
     $object_ids = $artist->get_songs();
     require_once AmpConfig::get('prefix') . '/templates/show_artist.inc.php';
     break;
 case 'update_from_tags':
     $type = 'artist';
     $object_id = intval($_REQUEST['artist']);
     $target_url = AmpConfig::get('web_path') . "/artists.php?action=show&artist=" . $object_id;
     require_once AmpConfig::get('prefix') . '/templates/show_update_items.inc.php';
     break;
 case 'match':
 case 'Match':
     $match = scrub_in($_REQUEST['match']);
     if ($match == "Browse" || $match == "Show_all") {
         $chr = "";
     } else {
         $chr = $match;
     }
     /* Enclose this in the purty box! */
     require AmpConfig::get('prefix') . '/templates/show_box_top.inc.php';
     show_alphabet_list('artists', 'artists.php', $match);
     show_alphabet_form($chr, T_('Show Artists starting with'), "artists.php?action=match");
     require AmpConfig::get('prefix') . '/templates/show_box_bottom.inc.php';
     if ($match === "Browse") {
         show_artists();
     } elseif ($match === "Show_all") {
         $offset_limit = 999999;
         show_artists();

 /**
  * get_newest_sql
  * This returns the get_newest sql
  */
 public static function get_newest_sql($type, $catalog = 0)
 {
     $type = self::validate_type($type);
     $sql = "SELECT DISTINCT(`{$type}`) as `id`, MIN(`addition_time`) AS `real_atime` FROM `song` ";
     $sql .= "LEFT JOIN `catalog` ON `catalog`.`id` = `song`.`catalog` ";
     if (AmpConfig::get('catalog_disable')) {
         $sql .= "WHERE `catalog`.`enabled` = '1' ";
     }
     if ($catalog > 0) {
         $sql .= "AND `catalog` = '" . scrub_in($catalog) . "' ";
     }
     $sql .= "GROUP BY `{$type}` ORDER BY `real_atime` DESC ";
     return $sql;
 }

/**
 *
 * LICENSE: GNU Affero General Public License, version 3 (AGPLv3)
 * Copyright 2001 - 2015 Ampache.org
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */
require_once 'lib/init.php';
if (isset($_REQUEST['param_name'])) {
    $name = scrub_in($_REQUEST['param_name']);
    if (isset($_REQUEST[$name])) {
        echo $name . ": " . scrub_in($_REQUEST[$name]);
    }
}
if (isset($_REQUEST['error'])) {
    $error = scrub_in($_REQUEST['error']);
    $error_description = scrub_in($_REQUEST['error_description']);
    echo $error . " error: " . $error_description;
}

    case 'album_preview':
        $songs = Song_preview::get_song_previews($_REQUEST['mbid']);
        foreach ($songs as $song) {
            if (!empty($song->file)) {
                $media_ids[] = array('object_type' => 'song_preview', 'object_id' => $song->id);
            }
        }
        break;
    case 'song_preview':
        $media_ids[] = array('object_type' => 'song_preview', 'object_id' => scrub_in($_REQUEST['id']));
        break;
    case 'channel':
        $media_ids[] = array('object_type' => 'channel', 'object_id' => scrub_in($_REQUEST['id']));
        break;
    case 'broadcast':
        $media_ids[] = array('object_type' => 'broadcast', 'object_id' => scrub_in($_REQUEST['id']));
        break;
    default:
        break;
}
// end action switch
// See if we need a special streamtype
switch ($_REQUEST['action']) {
    case 'download':
        $stream_type = 'download';
        break;
    case 'democratic':
        // Don't let them loop it
        // FIXME: This looks hacky
        if (AmpConfig::get('play_type') == 'democratic') {
            AmpConfig::set('play_type', 'stream', true);

 case 'add_user':
     /**
      * User information has been entered
      * we need to check the database for possible existing username first
      * if username exists, error and say "Please choose a different name."
      * if username does not exist, insert user information into database
      * then allow the user to 'click here to login'
      * possibly by logging them in right then and there with their current info
      * and 'click here to login' would just be a link back to index.php
      */
     $fullname = scrub_in($_POST['fullname']);
     $username = scrub_in($_POST['username']);
     $email = scrub_in($_POST['email']);
     $website = scrub_in($_POST['website']);
     $pass1 = scrub_in($_POST['password_1']);
     $pass2 = scrub_in($_POST['password_2']);
     /* If we're using the captcha stuff */
     if (AmpConfig::get('captcha_public_reg')) {
         $captcha = captcha::solved();
         if (!isset($captcha)) {
             Error::add('captcha', T_('Error Captcha Required'));
         }
         if (isset($captcha)) {
             if ($captcha) {
                 $msg = "SUCCESS";
             } else {
                 Error::add('captcha', T_('Error Captcha Failed'));
             }
         }
         // end if we've got captcha
     }

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 *
 */
require_once 'lib/init.php';
UI::show_header();
// Switch on Action
switch ($_REQUEST['action']) {
    case 'delete':
        if (AmpConfig::get('demo_mode')) {
            break;
        }
        $song_id = scrub_in($_REQUEST['song_id']);
        show_confirmation(T_('Song Deletion'), T_('Are you sure you want to permanently delete this song?'), AmpConfig::get('web_path') . "/song.php?action=confirm_delete&song_id=" . $song_id, 1, 'delete_song');
        break;
    case 'confirm_delete':
        if (AmpConfig::get('demo_mode')) {
            break;
        }
        $song = new Song($_REQUEST['song_id']);
        if (!Catalog::can_remove($song)) {
            debug_event('song', 'Unauthorized to remove the song `.' . $song->id . '`.', 1);
            UI::access_denied();
            exit;
        }
        if ($song->remove_from_disk()) {
            show_confirmation(T_('Song Deletion'), T_('Song has been deleted.'), AmpConfig::get('web_path'));
        } else {

 /**
  * video
  * This returns a single video
  */
 public static function video($input)
 {
     $video_id = scrub_in($input['filter']);
     echo XML_Data::videos(array($video_id));
 }

 /**
  * pam_auth
  *
  * Check to make sure the pam_auth function is implemented (module is
  * installed), then check the credentials.
  */
 private static function pam_auth($username, $password)
 {
     $results = array();
     if (!function_exists('pam_auth')) {
         $results['success'] = false;
         $results['error'] = 'The PAM PHP module is not installed';
         return $results;
     }
     $password = scrub_in($password);
     if (pam_auth($username, $password)) {
         $results['success'] = true;
         $results['type'] = 'pam';
         $results['username'] = $username;
     } else {
         $results['success'] = false;
         $results['error'] = 'PAM login attempt failed';
     }
     return $results;
 }

 *
 */
header('Cache-Control: no-cache');
header('Pragma: no-cache');
header('Expires: ' . gmdate(DATE_RFC1123, time() - 1));
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
<html>
<head>
<title><?php 
echo AmpConfig::get('site_title');
?>
</title>
<?php 
if (!$is_share) {
    $playlist = new Stream_Playlist(scrub_in($_REQUEST['playlist_id']));
}
?>
<script language="javascript" type="text/javascript">
var jplaylist = new Array();
var jtypes = new Array();

function addMedia(media)
{
    var jpmedia = {};
    jpmedia['title'] = media['title'];
    jpmedia['artist'] = media['artist'];
    jpmedia[media['filetype']] = media['url'];
    jpmedia['poster'] = media['poster'];
    jpmedia['artist_id'] = media['artist_id'];
    jpmedia['album_id'] = media['album_id'];

         $prefix = substr($key, 0, 4);
         $value = trim($value);
         if ($prefix == 'rule' && strlen($value)) {
             $rules[$key] = Dba::escape($value);
         }
     }
     switch ($_REQUEST['operator']) {
         case 'or':
             $operator = 'OR';
             break;
         default:
             $operator = 'AND';
             break;
     }
     // end switch on operator
     $playlist_name = (string) scrub_in($_REQUEST['playlist_name']);
     $playlist = new Search(null, 'song');
     $playlist->parse_rules($data);
     $playlist->logic_operator = $operator;
     $playlist->name = $playlist_name;
     $playlist->save();
     break;
 case 'delete_playlist':
     // If we made it here, we didn't have sufficient rights.
     UI::access_denied();
     break;
 case 'show_playlist':
     $playlist = new Search($_REQUEST['playlist_id'], 'song');
     $playlist->format();
     $object_ids = $playlist->get_items();
     require_once AmpConfig::get('prefix') . UI::find_template('show_search.inc.php');

 protected function showAuthToken()
 {
     $api = new Services_Soundcloud($this->userid, $this->secret, $this->getRedirectUri());
     $authurl = $api->getAuthorizeUrl(array('scope' => 'non-expiring'));
     echo "<br />Go to <strong><a href='" . $authurl . "' target='_blank'>" . $authurl . "</a></strong> to generate the authorization code, then enter it bellow.<br />";
     echo "<form action='" . get_current_path() . "' method='post' enctype='multipart/form-data'>";
     if ($_REQUEST['action']) {
         echo "<input type='hidden' name='action' value='" . scrub_in($_REQUEST['action']) . "' />";
         echo "<input type='hidden' name='catalogs[]' value='" . $this->id . "' />";
     }
     echo "<input type='hidden' name='perform_ready' value='true' />";
     echo "<input type='text' name='authcode' />";
     echo "<input type='submit' value='Ok' />";
     echo "</form>";
     echo "<br />";
 }

                case 'quality':
                    $quality = intval($vparts[$i + 1]);
                    break;
            }
        }
    }
}
$share_id = intval($_REQUEST['share_id']);
$subtitle = '';
$send_all_in_once = false;
if (!$type) {
    $type = 'song';
}
debug_event('play', 'Asked for type {' . $type . "}", 5);
if ($type == 'playlist') {
    $playlist_type = scrub_in($_REQUEST['playlist_type']);
    $oid = $sid;
}
/* This is specifically for tmp playlist requests */
$demo_id = Dba::escape($_REQUEST['demo_id']);
$random = Dba::escape($_REQUEST['random']);
/* First things first, if we don't have a uid/oid stop here */
if (empty($oid) && empty($demo_id) && empty($random)) {
    debug_event('play', 'No object UID specified, nothing to play', 2);
    header('HTTP/1.1 400 Nothing To Play');
    exit;
}
// Authenticate the user if specified
$u = $_SERVER['PHP_AUTH_USER'];
if (empty($u)) {
    $u = $_REQUEST['u'];