PHP secure函数代码示例

/**
* Registration Form Template Plugin
*
* Assists in the creation of registration forms
*
* @param string $return The relative or absolute URL to return to after registering
*/
function smarty_block_registration_form($params, $tagdata, &$smarty, &$repeat)
{
    if (!isset($params['var'])) {
        show_error('You must specify a "var" parameter for template {registration_form} calls.  This parameter specifies the variable name for the returned array.');
    } else {
        $variables = array();
        // get return URL
        if (isset($params['return']) and !empty($params['return'])) {
            $variables['return'] = query_value_encode($params['return']);
        } else {
            $variables['return'] = '';
        }
        // form action
        $variables['form_action'] = site_url('users/post_registration');
        if (setting('ssl_certificate') == '1') {
            $variables['form_action'] = secure($variables['form_action']);
        }
        // populated values
        $variables['first_name'] = $smarty->CI->input->post('firstname');
        $variables['last_name'] = $smarty->CI->input->post('last_name');
        $variables['email'] = $smarty->CI->input->post('email');
        $variables['username'] = $smarty->CI->input->post('username');
        $custom_fields = $smarty->CI->user_model->get_custom_fields(array('registration_form' => TRUE, 'not_in_admin' => TRUE));
        $variables['custom_fields'] = $custom_fields;
        if (is_array($custom_fields)) {
            foreach ($custom_fields as $field) {
                $variables[$field['name']] = $smarty->CI->input->post($field['name']);
            }
        }
        $smarty->assign($params['var'], $variables);
        echo $tagdata;
    }
}

 /**
  *
  * Untuk keamanan data, trim inputan agar tidak ada spasi, Htmlentities
  *
  */
 function multisecure($array)
 {
     foreach ($array as $key => $value) {
         $array[$key] = secure($value);
     }
     return $array;
 }

 private function validateRegistration()
 {
     loadLibrary("validation.lib");
     $user = secure($_POST["username"]);
     $display = secure($_POST["display"]);
     $pass1 = secure($_POST["pass1"]);
     $pass2 = secure($_POST["pass2"]);
     $email1 = secure($_POST["email1"]);
     $email2 = secure($_POST["email2"]);
     $res = valid_username($user);
     if ($res !== true) {
         $this->errors[] = $res;
     }
     $res = valid_displayname($display);
     if ($res !== true) {
         $this->errors[] = $res;
     }
     if ($pass1 !== $pass2) {
         $this->errors[] = "passwords_dont_match";
     } else {
         $res = valid_password($pass1);
         if ($res !== true) {
             $this->errors[] = $res;
         }
     }
     if ($email1 !== $email2) {
         $this->errors[] = "emails_dont_match";
     } else {
         $res = valid_email($email1);
         if ($res !== true) {
             $this->errors[] = $res;
         }
     }
     // Validate these next two for the most protective method.
     if ($_POST["hideemail"] == "no") {
         $hideemail = false;
     } else {
         $hideemail = true;
     }
     if ($_POST["receiveemail"] == "yes") {
         $receiveemail = true;
     } else {
         $receiveemail = false;
     }
     // Check ToS box
     if (!$_POST["tos"]) {
         $this->errors[] = "tos_not_checked";
     }
     if (count($this->errors) == 0) {
         // Add the user
         global $yakbb;
         $yakbb->db->insert("users", array("id" => 0, "username" => $user, "displayname" => $display, "password" => sha256($pass1), "email" => $email1, "emailshow" => $hideemail ? 0 : 1, "emailoptin" => $receiveemail ? 1 : 0, "activated" => 1, "activationcode" => "", "pending" => 0, "registeredtime" => time(), "lastip" => $yakbb->ip, "template" => $yakbb->config["default_template"], "language" => $yakbb->config["default_language"], "timezone" => $yakbb->config["default_timezone"]));
         redirect("?action=login&reg=true");
     }
 }

/**
* Login Form Template Plugin
*
* Assists in the creation of login forms
*
* @param string $return The relative or absolute URL to return to after logging in
* @param string $username Username value
*/
function smarty_block_login_form($params, $tagdata, &$smarty, &$repeat)
{
    if (!isset($params['var'])) {
        show_error('You must specify a "var" parameter for template {login_form} calls.  This parameter specifies the variable name for the returned array.');
    } else {
        $variables = array();
        // get return URL
        if (isset($params['return']) and !empty($params['return'])) {
            $variables['return'] = query_value_encode($params['return']);
        } else {
            $variables['return'] = '';
        }
        // form action
        $variables['form_action'] = site_url('users/post_login');
        if (setting('ssl_certificate') == '1') {
            $variables['form_action'] = secure($variables['form_action']);
        }
        // username
        $variables['username'] = isset($params['username']) ? $params['username'] : '';
        $smarty->assign($params['var'], $variables);
        echo $tagdata;
    }
}

function lock()
{
    if (!isset($_session['id'])) {
        return false;
    }
    if (!isset($_session['email'])) {
        return false;
    }
    if (isset($_POST['app'])) {
        $userName = secure($_POST['email'], $mysqli);
        $ID = secure($_POST['ID'], $mysqli);
    } else {
        $userName = secure($_session['email'], $mysqli);
        $ID = secure($_session['ID'], $mysqli);
    }
    $q = "SELECT * FROM users WHERE username = '{$userName}' AND ID = '{$ID}'";
    if ($res = $mysqli->query($q)) {
        if ($res->num_rows > 0) {
            return true;
        } else {
            return false;
        }
    }
}

if ($utente == -1) {
    header('Location: index.php');
} else {
    $user_level = get_user_level($utente);
    if ($user_level == 0) {
        header('Location: userhome.php');
    }
    if ($user_level == 1) {
        header('Location: docente.php');
    }
}
if ($_POST["submit"]) {
    $nome = secure($_POST["nome"]);
    $cognome = secure($_POST["cognome"]);
    $username = secure($_POST["username"]);
    $password = hash("sha512", secure($_POST["password"]));
    $db = database_connect();
    if (!($result = $db->query("select * from utenti where username='{$username}'"))) {
        die('ERRORE: ' . $db->error);
    }
    $rows = $result->num_rows;
    if ($rows == 0) {
        if (!$db->query("INSERT INTO utenti\n\t\t\t\t(nome, cognome, username, password, classe, level) VALUES\n\t\t\t\t('" . $nome . "', '" . $cognome . "', '" . $username . "', '" . $password . "', 6, 1)")) {
            echo "Errore" . $db->error;
        } else {
            echo "SUCCESS";
        }
    } else {
        echo "EXISTS";
    }
}

         $errors = array(1 => 'The file to big for the server\'s config', 2 => 'The file to big for this page', 3 => 'There was a problem during upload (file was truncated)', 4 => 'No file upload', 5 => 'No temp folder', 6 => 'Write error on server');
         return $errors[$e];
     } else {
         if ($e > 7) {
             return true;
         } else {
             return false;
         }
     }
 }
 function secure($file)
 {
     return preg_replace('#(.+)\\.php#i', '$1.SECURED_PHP', $file);
 }
 if (isset($_FILES['myfile']) && strtolower($_FILES['myfile']['name']) != "index.html") {
     $sFileName = secure($_FILES['myfile']['name']);
     $sFileType = $_FILES['myfile']['type'];
     $sFileSize = intval(bytesToSize1024($_FILES['myfile']['size'], 1));
     $sFileError = error2msg($_FILES['myfile']['error']);
     $sFileExt = pathinfo($_SESSION['upload_path'] . $sFileName, PATHINFO_EXTENSION);
     $ok = '<li class="DD_file DD_success ' . $sFileExt . '">   
         <span class="DD_filename">' . $sFileName . '</span>
         [<em class="DD_filetype">' . $sFileType . '</em>, 
         <em class="DD_filesize">' . $sFileSize . '</em>] [OK]
     </li>';
     $notok = '<li class="DD_file DD_error">   
         <span class="DD_filename">' . $sFileName . '</span>
         [<em class="DD_filetype">' . $sFileType . '</em>, 
         <em class="DD_filesize">' . $sFileSize . '</em>] [UPLOAD ERROR !]
     </li>';
     if (is_array($auto_dropzone['destination_filepath']) && !empty($auto_dropzone['destination_filepath'][$sFileExt]) && is_dir($_SESSION['upload_path'] . $auto_dropzone['destination_filepath'][$sFileExt])) {

//Ajout d'un tarif
if (isset($_POST['add']) && isset($_POST['ecole_lyonnaise'][0]) && in_array($_POST['ecole_lyonnaise'][0], ['0', '1']) && isset($_POST['for_pompom'][0]) && in_array($_POST['for_pompom'][0], ['yes', 'or', 'no']) && isset($_POST['for_cameraman'][0]) && in_array($_POST['for_cameraman'][0], ['yes', 'or', 'no']) && isset($_POST['for_fanfaron'][0]) && in_array($_POST['for_fanfaron'][0], ['yes', 'or', 'no']) && !empty($_POST['type'][0]) && in_array($_POST['type'][0], array_keys($typesTarifs)) && !empty($_POST['ordre'][0]) && intval($_POST['ordre'][0]) && !empty($_POST['nom'][0]) && !empty($_POST['description'][0]) && isset($_POST['montant'][0]) && isset($_POST['special'][0]) && (empty($_POST['special'][0]) || in_array($_POST['special'][0], array_keys($sports))) && is_numeric($_POST['montant'][0])) {
    if (!isset($_POST['logement'])) {
        $_POST['logement'] = array();
    }
    $pdo->exec($s = 'INSERT INTO tarifs SET ' . 'nom = "' . secure($_POST['nom'][0]) . '", ' . 'description = "' . secure($_POST['description'][0]) . '", ' . 'tarif = ' . abs((double) $_POST['montant'][0]) . ', ' . 'ecole_lyonnaise = ' . $_POST['ecole_lyonnaise'][0] . ', ' . 'for_pompom = "' . $_POST['for_pompom'][0] . '", ' . 'for_cameraman = "' . $_POST['for_cameraman'][0] . '", ' . 'for_fanfaron = "' . $_POST['for_fanfaron'][0] . '", ' . 'type = "' . secure($_POST['type'][0]) . '", ' . 'logement = ' . (in_array('0', $_POST['logement']) ? '1' : '0') . ', ' . 'id_sport_special = ' . (empty($_POST['special'][0]) || $_POST['type'][0] == 'nonsportif' ? 'NULL' : $_POST['special'][0]) . ', ' . 'ordre = ' . abs((int) $_POST['ordre'][0]));
    $add = true;
}
//On récupère l'indice du champ concerné
if ((!empty($_POST['delete']) || !empty($_POST['edit'])) && isset($_POST['id']) && is_array($_POST['id'])) {
    $i = array_search(empty($_POST['delete']) ? $_POST['edit'] : $_POST['delete'], $_POST['id']);
}
//On edite un tarif
if (isset($i) && empty($_POST['delete']) && isset($_POST['ecole_lyonnaise'][$i]) && in_array($_POST['ecole_lyonnaise'][$i], ['0', '1']) && isset($_POST['for_pompom'][$i]) && in_array($_POST['for_pompom'][$i], ['yes', 'or', 'no']) && isset($_POST['for_cameraman'][$i]) && in_array($_POST['for_cameraman'][$i], ['yes', 'or', 'no']) && isset($_POST['for_fanfaron'][$i]) && in_array($_POST['for_fanfaron'][$i], ['yes', 'or', 'no']) && !empty($_POST['type'][$i]) && in_array($_POST['type'][$i], array_keys($typesTarifs)) && !empty($_POST['ordre'][$i]) && intval($_POST['ordre'][$i]) && !empty($_POST['nom'][$i]) && !empty($_POST['description'][$i]) && isset($_POST['montant'][$i]) && isset($_POST['special'][$i]) && (empty($_POST['special'][$i]) || in_array($_POST['special'][$i], array_keys($sports))) && is_numeric($_POST['montant'][$i])) {
    if (!isset($_POST['logement'])) {
        $_POST['logement'] = array();
    }
    $pdo->exec('UPDATE tarifs SET ' . 'nom = "' . secure($_POST['nom'][$i]) . '", ' . 'description = "' . secure($_POST['description'][$i]) . '", ' . 'tarif = ' . abs((double) $_POST['montant'][$i]) . ', ' . 'ecole_lyonnaise = ' . $_POST['ecole_lyonnaise'][$i] . ', ' . 'for_pompom = "' . $_POST['for_pompom'][$i] . '", ' . 'for_cameraman = "' . $_POST['for_cameraman'][$i] . '", ' . 'for_fanfaron = "' . $_POST['for_fanfaron'][$i] . '", ' . 'type = "' . secure($_POST['type'][$i]) . '", ' . 'logement = ' . (in_array($_POST['id'][$i], $_POST['logement']) ? '1' : '0') . ', ' . 'id_sport_special = ' . (empty($_POST['special'][$i]) || $_POST['type'][$i] == 'nonsportif' ? 'NULL' : $_POST['special'][$i]) . ', ' . 'ordre = ' . abs((int) $_POST['ordre'][$i]) . ' ' . 'WHERE id = ' . abs((int) $_POST['id'][$i]));
    $modify = true;
} else {
    if (isset($i) && !empty($_POST['delete'])) {
        $pdo->exec('DELETE FROM tarifs ' . 'WHERE id = ' . abs((int) $_POST['id'][$i]));
        $delete = true;
    }
}
$tarifs_lyonnais = $pdo->query('SELECT ' . 't.*, ' . 'COUNT(te.id_ecole) AS teid ' . 'FROM tarifs AS t ' . 'LEFT JOIN tarifs_ecoles AS te ON ' . 'te.id_tarif = t.id ' . 'WHERE ' . 't.ecole_lyonnaise = 1 ' . 'GROUP BY ' . 't.id ' . 'ORDER BY ' . 'ordre ASC, ' . 'nom ASC') or DEBUG_ACTIVE && die(print_r($pdo->errorInfo()));
$tarifs_lyonnais = $tarifs_lyonnais->fetchAll(PDO::FETCH_ASSOC);
$tarifs_nonlyonnais = $pdo->query('SELECT ' . 't.*, ' . 'COUNT(te.id_ecole) AS teid ' . 'FROM tarifs AS t ' . 'LEFT JOIN tarifs_ecoles AS te ON ' . 'te.id_tarif = t.id ' . 'WHERE ' . 't.ecole_lyonnaise = 0 ' . 'GROUP BY ' . 't.id ' . 'ORDER BY ' . 'ordre ASC, ' . 'nom ASC') or DEBUG_ACTIVE && die(print_r($pdo->errorInfo()));
$tarifs_nonlyonnais = $tarifs_nonlyonnais->fetchAll(PDO::FETCH_ASSOC);
//Inclusion du bon fichier de template
require DIR . 'templates/admin/ecoles/tarification.php';

} else {
    $register_form = 'includes/forms/register_form.php';
}
if (isset($_GET['done'])) {
    // Include reCaptcha
    if ($setting['use_captcha'] == 1) {
        require_once 'includes/misc/recaptchalib.php';
        $resp = recaptcha_check_answer($setting['captcha_privkey'], $_SERVER["REMOTE_ADDR"], $_POST["recaptcha_challenge_field"], $_POST["recaptcha_response_field"]);
        if ($resp->is_valid) {
            $captcha_success = 1;
        } else {
            $captcha_success = 0;
        }
    }
    if ($setting['use_qa_captcha'] == 1) {
        $user_answer = secure(strtolower($_POST["qa_captcha_answer"]));
        $formatted_answers = str_replace(", ", ",", strtolower($setting['qa_captcha_answers']));
        $answers = explode(',', $formatted_answers);
        foreach ($answers as $answer) {
            if ($answer == $user_answer) {
                $qa_captcha_success = 1;
            }
        }
        if (!isset($qa_captcha_success)) {
            $qa_captcha_success = 0;
        }
    }
    if ($setting['use_captcha'] != 1 && $setting['use_qa_captcha'] != 1) {
        $captcha_success = 1;
        $qa_captcha_success = 1;
    }

if (!preg_match ('/^Registered/', $chk_lic)) {
    $chk_lic = @file_get_contents("license.txt");
    if (!preg_match ('/^Registered/', $chk_lic)) {
        $addTitle = "License";
        require 'includes/license.php';
        exit;
    }
}

session_start();
$_SERVER = cleanArray($_SERVER);
$_POST = cleanArray($_POST);
$_GET = cleanArray($_GET);
$_COOKIE = cleanArray($_COOKIE);

secure();

$time_start = get_microtime();

//------------------------------------------------------------------------
// Determine what page is being requested
//------------------------------------------------------------------------
$pageId = get_input('pageId');
if (!$pageId) { $pageId = "login"; }
if(!validate_input($pageId, 'pageId')) {
	echo "Error on pageId validation! <br>Check your regExpArray in config.php!\n";
   	$pageId = "login";
}

//------------------------------------------------------------------------
// Connect to database. If connection fails then set the pageId for the

<?php

require_once 'functions.php';
secure(2);
require_once 'conn.php';
require_once 'header.php';
?>
<style type="text/css">
<!--
.style1 {
	color: #0000CC;
	font-weight: bold;
	font-size: 26px;
}
-->
</style>

<div id="content">

<div id="right">

<br/>
<table align="center" width="100%" id="table1" cellpadding="5" cellspacing="5" border="2">
    <tr><th colspan="6"><center>
      <span class="style1">ORDERED LIST</span>
    </center></th></tr>
    <tr>
<th>Roll No.</th>
<th>Customer Name</th>
<th>Item List</th>
<th>Adress</th>

 private function loadUser()
 {
     $this->user = array("id" => 0, "username" => "Guest", "group" => -1, "template" => $this->config["default_template"], "language" => $this->config["default_language"]);
     $this->smarty->assign("guest", true);
     $this->smarty->assign("admin_access", false);
     if (getYakCookie("username") != "" && getYakCookie("password") != "") {
         // Check login
         $user = secure(getYakCookie("username"));
         $pass = getYakCookie("password");
         loadLibrary("validation.lib");
         if (valid_username($user) === true && valid_password($pass) === true) {
             $this->db->query("\r\n\t\t\t\t\tSELECT\r\n\t\t\t\t\t\t*\r\n\t\t\t\t\tFROM\r\n\t\t\t\t\t\tyakbb_users\r\n\t\t\t\t\tWHERE\r\n\t\t\t\t\t\tusername = '" . $this->db->secure($user) . "'\r\n\t\t\t\t\tLIMIT\r\n\t\t\t\t\t\t1\r\n\t\t\t\t");
             if ($this->db->numRows() == 1) {
                 $x = $this->db->fetch();
                 if ($x["password"] === $pass) {
                     $this->user = $x;
                     $this->smarty->assign("guest", false);
                 }
             }
         }
     }
 }

/* Dernière modification : le 07/11/14 *********************/
/* *********************************************************/
//S'il n'y a pas de saison on affiche une erreur
if (empty($saison)) {
    die(require DIR . 'templates/_error.php');
}
//Ajout d'un vendeur
if (isset($_POST['add']) && !empty($_POST['nom'][0])) {
    $pdo->exec($s = 'INSERT INTO vendeurs SET ' . 'nom = "' . secure($_POST['nom'][0]) . '", ' . 'id_saison = ' . $saison['id']);
    $add = true;
}
//On récupère l'indice du champ concerné
if ((!empty($_POST['delete']) || !empty($_POST['edit'])) && isset($_POST['id']) && is_array($_POST['id'])) {
    $i = array_search(empty($_POST['delete']) ? $_POST['edit'] : $_POST['delete'], $_POST['id']);
}
//On edite un vendeur
if (!empty($i) && empty($_POST['delete']) && !empty($_POST['nom'][$i])) {
    $pdo->exec('UPDATE vendeurs SET ' . 'nom = "' . secure($_POST['nom'][$i]) . '" ' . 'WHERE id = ' . $_POST['id'][$i]);
    $modify = true;
} else {
    if (!empty($i) && !empty($_POST['delete'])) {
        $pdo->exec('DELETE FROM vendeurs ' . 'WHERE id = ' . $_POST['id'][$i]);
        $delete = true;
    }
}
//Mise à jour des vendeurs
$vendeurs = !empty($saison) ? $pdo->query('SELECT id, nom ' . 'FROM vendeurs ' . 'WHERE id_saison = ' . $saison['id'] . ' ' . 'ORDER BY nom ASC')->fetchAll(PDO::FETCH_ASSOC) : array();
//Vendeurs triés par ordre d'ajout
$vendeurs_non_tries = !empty($saison) ? $pdo->query('SELECT id, nom ' . 'FROM vendeurs ' . 'WHERE id_saison = ' . $saison['id'] . ' ' . 'ORDER BY id ASC')->fetchAll(PDO::FETCH_ASSOC) : array();
//Inclusion du bon fichier de template
require DIR . 'templates/public/vendeurs.php';

<!DOCTYPE html>
<!--
To change this license header, choose License Headers in Project Properties.
To change this template file, choose Tools | Templates
and open the template in the editor.
-->
<html>
    <?php 
require 'database.php';
require 'utilities/utils.php';
$_GET = secure($_GET);
$_POST = secure($_POST);
if (isset($_GET['todo'])) {
    //        echo $_GET['todo'];
    if ($_GET['todo'] == 'accueil') {
        generateHTMLHeader('accueil');
        echo "<section id='content'>" . PHP_EOL;
        require "content/accueil.php";
        echo "</section>" . PHP_EOL;
    } elseif ($_GET['todo'] == 'actualites') {
        generateHTMLHeader('actualites');
        echo "<section id='content'>" . PHP_EOL;
        require "content/actualites.php";
        echo "</section>" . PHP_EOL;
    } elseif ($_GET['todo'] == 'allArticles') {
        generateHTMLHeader('allArticles');
        echo "<section id='content'>" . PHP_EOL;
        require "content/allArticles.php";
        echo "</section>" . PHP_EOL;
    } elseif ($_GET['todo'] == 'contact') {
        generateHTMLHeader('contact');

<?php

require_once 'functions.php';
secure(1);
require_once 'conn.php';
if (isset($_POST['Submit'])) {
    $item = "";
    if (isset($_POST['t1'])) {
        $item .= $_POST['t1'] . ',';
    }
    if (isset($_POST['t2'])) {
        $item .= $_POST['t2'] . ',';
    }
    if (isset($_POST['t3'])) {
        $item .= $_POST['t3'] . ',';
    }
    if (isset($_POST['t4'])) {
        $item .= $_POST['t4'] . ',';
    }
    if (isset($_POST['t5'])) {
        $item .= $_POST['t5'] . ',';
    }
    if (isset($_POST['t6'])) {
        $item .= $_POST['t6'] . ',';
    }
    if (isset($_POST['t7'])) {
        $item .= $_POST['t7'] . ',';
    }
    if (isset($_POST['t8'])) {
        $item .= $_POST['t8'] . ',';
    }