PHP secure_data函数代码示例

function option_html($selected = '', $arr = array())
{
    $selected = trim($selected);
    foreach ($arr as $k => $v) {
        $k = secure_data($k);
        $is_selected = $k === $selected ? 'selected="selected"' : '';
        echo '<option value="' . $k . '" ' . $is_selected . '>' . $v . '</option>';
    }
}

function understanding($input, $db)
{
    $output = '';
    $action = '';
    //Initial check (mainly for size)
    $input_params = text_parameters($input);
    //If input is correct, eval hardcoded commands
    $hard = hardcoded($input, $db);
    if ($hard != FALSE) {
        $type = 'Hardcoded';
        $output .= addslashes($hard['output']);
        if ($hard['out_type'] == 'append') {
            $method = 'append';
        } else {
            $method = 'html';
        }
        $action = "\$('#" . $hard['element'] . "')." . $method . "('" . $output . "')";
    } else {
        $output .= 'Input: <b>' . $input . '</b><br>';
        //In case we're done work already and cached it
        $meaning = check_cache_for_input($input);
        //Sanitize from common errors of transmitting data in computer systems
        $meaning = sanitize($meaning);
        //Make sure nothing in input will threaten system in any way. Output is code, ready to execute
        $input_secured = secure_data($meaning);
        //Determining data type, content type
        $input_types = typification($meaning);
        //Create simplified version in case of too complex input can slow down understanding
        $input_simplified = simplify($meaning, $input_types);
        $types = get_main_types($input_types);
        if ($types === FALSE) {
            //Can't be
            die("Unknown type of input. Something really wrong");
        }
        $results = array();
        foreach ($types as $type) {
            //echo $type;
            $results[] = output_mapping($input, $type);
        }
        $best_result = best_result($results);
        $output .= 'Input type: ' . $best_result['type'] . '<br><br>Output:<br><br>';
        $output .= "<b>" . $best_result['output'] . "</b><br><br>";
        $action = "\$('#output').append('" . $output . "');";
    }
    return array('output' => $output, 'action' => $action);
}

<?php

require_once 'config.php';
$id = secure_data($_GET['id']);
$uk = secure_data($_GET['uk']);
$payment_data = mysql_get_rows('payments', array('where' => "md5(id)='{$id}' AND md5(unique_key)='{$uk}'"), 1);
if (!$payment_data) {
    header("Location: " . SITE_URL . "admin/");
    die;
}
$user_data = mysql_get_rows('users', array('where' => "id='{$payment_data['user_id']}'"), 1);
$messages = array();
$overdue = 0;
if ($payment_data['info_updated'] == 1) {
    $msg_types = implode(',', array(0, 1, 2, 3, 4, 5, 6));
    $info_data = mysql_get_rows('messages', array('where' => "payment_id='{$payment_data['id']}' AND msg_type='1'"), 1);
    $messages = mysql_get_rows('messages', array('where' => "payment_id='{$payment_data['id']}' AND msg_type IN ({$msg_types})"));
    $time = time();
    $deliver_time = strtotime($payment_data['order_start_date']) + $info_data['days'] * 86400;
    if (in_array($payment_data['job_status'], array(2, 4)) && $time > $deliver_time) {
        $overdue = 1;
    }
}
if (!is_array($messages)) {
    $messages = array();
}
?>
			<div id="page-wrapper">
				<div class="loader-parent clearfix mb20">
					<h1 class="page-header">Outsource Info</h1>
					<div class="well well-msg clearfix">

<?php

checkAjax();
$error = 0;
$message = '';
$fields = array('name', 'content', 'parent');
$required_fields = array('name', 'content', 'parent');
$insert_data = array();
$return_data = array('status' => 0);
foreach ($fields as $field) {
    if ($field === 'content') {
        $val = addslashes(trim($_POST[$field]));
    } else {
        $val = secure_data($_POST[$field]);
    }
    if (in_array($field, $required_fields) && $val === '') {
        $error = 1;
        $message .= $message !== '' ? '<br>Please fill up all data' : 'Please fill up all data';
        break;
    }
    $insert_data[$field] = $val;
}
if ($error == 0) {
    $parent = $insert_data['parent'];
    $course_id = selectDB(" WHERE id='{$parent}'", 'course_sections', 'course_id');
    $insert_data['created_at'] = date('Y-m-d H:i:s', time());
    $insert_data['type'] = 2;
    $insert_data['course_id'] = $course_id;
    insertDB($insert_data, 'course_sections');
    $_SESSION['msg_selector'] = 'success';
    $_SESSION['msg_message'] = 'step added succesfully.';

function evalArg($type, $arg)
{
    switch ($type) {
        case 'string':
            $arg = is_string($arg) ? $arg : '';
            break;
        case 'int':
            $arg = secure_data($arg, "int");
            break;
        case 'array_int':
            $arg = string2array4ID($arg);
            break;
        default:
            $arg = "";
            break;
    }
    return $arg;
}

		(check?)remember me
*/
if (!isLoggedIn()) {
    //validation variables
    $username_not_empty = TRUE;
    // $username_valid is set by check_in.php
    $password_not_empty = TRUE;
    $passwords_match = TRUE;
    $username = '';
    //check if wants to login
    if (isset($_POST['username']) && isset($_POST['password'])) {
        $username = $_POST['username'];
        $password = $_POST['password'];
        //secure data agains code injection
        $username = secure_data($username);
        $password = secure_data($password);
        //check if username is not empty
        if (empty($username)) {
            $username_not_empty = FALSE;
        }
        $query = "SELECT password, salt\n\t\t\t\t\t\tFROM {$usertable}\n\t\t\t\t\t\tWHERE username = '{$username}';";
        $query2 = "SELECT password, salt, username\n\t\t\t\t\t\tFROM {$usertable}\n\t\t\t\t\t\tWHERE email = '{$username}';";
        $result = mysql_query($query);
        $result2 = mysql_query($query2);
        //check if username exists
        if (mysql_num_rows($result) < 1 && mysql_num_rows($result2) < 1) {
            $username_valid = FALSE;
        }
        //check if password is not empty
        if (empty($password)) {
            $password_not_empty = FALSE;

<?php

session_start();
$id_testResult = $_SESSION["id_testResult"];
$username_patient = $_SESSION["username"];
$genderm = $_SESSION["gender"];
$id_riskTest = $_SESSION["id_riskTest"];
$score_value = $_SESSION["test_score"];
$message_patient = $DoctorErr = $success_medCase = "";
$docOptions = $problem = $id_profileDoctor = $checkbox_count = 0;
if (isset($_POST["toDoctorButton"])) {
    if (!empty($_POST["patientMessage"])) {
        $message_patient = secure_data($_POST["patientMessage"]);
    }
    if (empty($_POST['doctor_list'])) {
        $DoctorErr = "Select 1 doctor";
        $problem = $problem + 1;
    } else {
        $checkbox_count = count($_POST['doctor_list']);
        if ($checkbox_count > 1) {
            $DoctorErr = "Select exactly 1 doctor";
            $problem = $problem + 1;
        } else {
            foreach ($_POST['doctor_list'] as $value) {
                $str = $value;
            }
            if ($str == 1) {
                $id_profileDoctor = 1;
            } elseif ($str == 2) {
                $id_profileDoctor = 2;
            } elseif ($str == 3) {

<?php

$header = 0;
require_once '../config.php';
$return_data = array('status' => 0);
$allowed_types = array('image/png', 'image/jpg', 'image/jpeg', 'image/bmp');
$allowed_ext = array('png', 'jpg', 'jpeg', 'bmp');
//$filename = trim($_POST['filename']);
//print_r($_FILES); exit;
$path = secure_data($_POST['path']);
$file = $_FILES['Filedata'];
$filetype = $file['type'];
$fileext = substr(strrchr($file['name'], '.'), 1);
if (in_array($fileext, $allowed_ext) && in_array($filetype, $allowed_types)) {
    $newname = rand() . '_' . time() . '_' . rand() . '.' . $fileext;
    $destination = UPLOAD_ROOT . $path . '/' . $newname;
    $action = copy($file['tmp_name'], $destination);
    if ($action) {
        $return_data['status'] = 1;
        $return_data['filename'] = $newname;
        $return_data['filepath'] = UPLOAD_URL . $path . '/' . $newname;
    } else {
        $return_data['message'] = 'An error occured.';
    }
} else {
    $return_data['message'] = 'Please upload valid image.';
}
echo json_encode($return_data);
exit;

<?php

include 'config.php';
checkAjax();
$return_data = array('status' => 0);
$section_id = secure_data($_POST['sectionId']);
$step_id = secure_data($_POST['stepId']);
$enable = secure_data($_POST['changeEnable']);
$user_id = $_SESSION['agent'];
// Check if record exists or not
$is_exists = mysql_get_rows('user_completed_couse', array('where' => "section_id='{$section_id}' AND user_id='{$user_id}'"), 1);
if ($is_exists === '') {
    $section_data = mysql_get_rows('course_sections', array('where' => "id='{$section_id}'"), 1);
    $insert_values = array('user_id' => $user_id, 'course_id' => $section_data['course_id'], 'section_id' => $section_id);
    $id = insertDB($insert_values, 'user_completed_couse');
    $completed = array();
} else {
    $id = $is_exists['id'];
    if (trim($is_exists['completed']) === '') {
        $completed = array();
    } else {
        $completed = explode(',', trim($is_exists['completed']));
    }
}
if ($enable == 1) {
    $completed[] = $step_id;
    array_unique($completed);
    $str_completed = implode(',', $completed);
    updateDB("completed = '{$str_completed}'", "WHERE id='{$id}'", 'user_completed_couse');
    $return_data['status'] = 1;
    $return_data['enable'] = 1;

if (isLoggedIn()) {
    header('Location: ../index.php');
}
//check if username and password fields are not empty
if (isset($_POST['username']) && isset($_POST['pass1']) && isset($_POST['pass2'])) {
    //connect to the DB
    $conn = mysql_connect($dbhost, $dbuser, $dbpass);
    mysql_select_db($dbname, $conn);
    //secure data agains code injection
    $username = secure_data($_POST['username']);
    $pass1 = secure_data($_POST['pass1']);
    $pass2 = secure_data($_POST['pass2']);
    $email1 = secure_data($_POST['email1']);
    $email2 = secure_data($_POST['email2']);
    $fname = secure_data($_POST['fname']);
    $lname = secure_data($_POST['lname']);
    //check if username is not empty
    if (empty($username)) {
        $username_not_empty = FALSE;
    }
    //check if username is valid
    if (!ctype_alnum($username) || strlen($username) > 15) {
        $username_valid = FALSE;
    }
    //check if user exists
    $query = "SELECT username\r\t\t\t\t\tFROM {$usertable}\r\t\t\t\t\tWHERE username = '{$username}';";
    $result = mysql_query($query);
    // user exists
    if (mysql_num_rows($result) > 0) {
        $username_not_duplicate = FALSE;
    }

<?php

require_once '../config.php';
checkAjax();
$section_id = secure_data($_POST['section_id']);
$return_data = array('status' => 0);
if ($section_id > 0) {
    $qry = "SELECT * FROM course_sections WHERE id = '{$section_id}' AND type=1";
    $result = mysql_query($qry);
    if (mysql_num_rows($result) > 0) {
        $row = mysql_fetch_assoc($result);
        $return_data['status'] = 1;
        $return_data['name'] = $row['name'];
    }
}
echo json_encode($return_data);
exit;

<?php

require_once '../config.php';
checkAjax();
$return_data = array('status' => 0);
$service = secure_data($_POST['service']);
$html = '<option value="">-- Add new Job --</option>';
if ($service !== '') {
    $qry = "SELECT * FROM service_packages WHERE service_id = '{$service}'";
    $result = mysql_query($qry);
    if (mysql_num_rows($result) > 0) {
        while ($row = mysql_fetch_assoc($result)) {
            $html .= '<option value="' . $row['id'] . '">' . $row['job'] . '</option>';
        }
    }
    $return_data['status'] = 1;
    $return_data['html'] = $html;
    $return_data['messge'] = 'Jobs fetched successfully';
} else {
    $return_data['message'] = 'An error occured';
}
echo json_encode($return_data);
exit;

<?php

include 'config.php';
include 'includes/paypalconfig.php';
$settings = json_decode(file_get_contents('admin/data/settings.txt'));
$custom = explode('||', secure_data($_POST['custom']));
$payment_data = mysql_get_rows('payments', array('where' => "unique_key = '{$custom['0']}' AND user_id = '{$custom['1']}'"), 1);
if ($payment_data) {
    header("Location: " . SITE_URL . 'updateinfo.php?uk=' . md5($custom[0]) . '&id=' . md5($payment_data['id']));
} else {
    header("Location: " . SITE_URL);
}

    curl_setopt_array($request, array(CURLOPT_URL => $url, CURLOPT_POST => TRUE, CURLOPT_POSTFIELDS => http_build_query(array('cmd' => '_notify-validate') + $ipn_post_data), CURLOPT_RETURNTRANSFER => TRUE, CURLOPT_HEADER => FALSE, CURLOPT_SSL_VERIFYPEER => FALSE, CURLOPT_SSL_VERIFYHOST => FALSE, CURLOPT_CAINFO => 'cacert.pem'));
    // Execute request and get response and status code
    $response = curl_exec($request);
    $status = curl_getinfo($request, CURLINFO_HTTP_CODE);
    // Close connection
    curl_close($request);
    if ($status == 200 && $response == 'VERIFIED') {
        // TODO : Check condition for unique txn_id
        $service_data = array();
        $package_data = array();
        $qry = "SELECT * FROM service_packages WHERE id = '{$ipn_post_data['option_selection1']}'";
        $result = mysql_query($qry);
        if (mysql_num_rows($result) > 0) {
            $package_data = mysql_fetch_assoc($result);
            $service_data = mysql_get_rows('services', array('where' => "id = '{$package_data['service_id']}'"), 1);
            if (!is_array($service_data)) {
                $service_data = array();
            }
        }
        $custom = explode('||', $ipn_post_data['custom']);
        $insert_data = array('user_id' => $custom[1], 'client_id' => $ipn_post_data['option_selection2'], 'item_name' => count($service_data) > 0 ? $service_data['name'] : '', 'quantity' => $ipn_post_data['quantity'], 'amount' => $ipn_post_data['mc_gross'], 'txn_id' => $ipn_post_data['txn_id'], 'date' => date('Y-m-d H:i:s', strtotime($ipn_post_data['payment_date'])), 'payment_status' => $ipn_post_data['payment_status'], 'info_updated' => 1, 'package' => $ipn_post_data['item_name'], 'test_ipn' => $ipn_post_data['test_ipn'], 'unique_key' => $custom[0], 'package_id' => $ipn_post_data['option_selection1'], 'post_data' => json_encode($ipn_post_data), 'job_status' => 1);
        $payment_id = insertDB($insert_data, 'payments');
        // TODO : Insert in message
        if (count($package_data) > 0) {
            $message_data = array('receiver_id' => $custom[1], 'payment_id' => $payment_id, 'message' => secure_data($package_data['required_data']), 'deliverable' => secure_data($package_data['deliverable']), 'days' => secure_data($package_data['days_to_complete']), 'msg_type' => 1);
            insertDB($message_data, 'messages');
        }
        // TODO : Send email + save proper data in db
    }
    exit;
}

    $message = secure_data($_POST['message']);
    $days = secure_data($_POST['days']);
    $insert_data = array('message' => $message, 'days' => $days);
    $attachment_update = secure_data($_POST['attachment_update']);
    if ($attachment_update == 1) {
        $attachment = secure_data($_POST['attachment']);
        $insert_data['attachment'] = $attachment;
        if ($attachment) {
            $src = UPLOAD_ROOT . 'temp/' . $attachment;
            $des = UPLOAD_ROOT . 'attachment/' . $attachment;
            rename($src, $des);
        }
    }
    $insert_data['sender_id'] = $_SESSION['agent'];
    $insert_data['msg_type'] = 1;
    $insert_data['payment_id'] = secure_data($_POST['pi']);
    // Insert
    insertDB($insert_data, 'messages');
    // Update
    updateDB("info_updated = '1'", 'WHERE id = ' . $insert_data['payment_id'], 'payments');
    ob_start();
    include "info_display.php";
    $html = ob_get_contents();
    ob_end_clean();
    $return_data['html'] = $html;
    $return_data['status'] = 1;
    $return_data['message'] = 'Info updated successfully';
} else {
    $messages = '';
    foreach ($v->errors() as $k => $msgs) {
        foreach ($msgs as $msg) {