PHP shtmlspecialchars函数代码示例

function html2bbcode($message) {
	global $_SGLOBAL;
	
	if(empty($_SGLOBAL['html_s_exp'])) {
		$_SGLOBAL['html_s_exp'] = array(
			"/\<div class=\"quote\"\>\<span class=\"q\"\>(.*?)\<\/span\>\<\/div\>/is",
			"/\<a href=\"(.+?)\".*?\<\/a\>/is",
			"/(\r\n|\n|\r)/",
			"/<br.*>/siU",
			"/[ \t]*\<img src=\"image\/face\/(.+?).gif\".*?\>[ \t]*/is",
			"/\s*\<img src=\"(.+?)\".*?\>\s*/is"
		);
		$_SGLOBAL['html_r_exp'] = array(
			"[quote]\\1[/quote]",
			"\\1",
			'',
			"\n",
			"[em:\\1:]",
			"\n[img]\\1[/img]\n"
		);
		$_SGLOBAL['html_s_str'] = array('<b>', '</b>', '<i>','</i>', '<u>', '</u>', '&nbsp; &nbsp; &nbsp; &nbsp; ', '&nbsp; &nbsp;', '&nbsp;&nbsp;', '&lt;', '&gt;', '&amp;');
		$_SGLOBAL['html_r_str'] = array('[b]', '[/b]','[i]', '[/i]', '[u]', '[/u]', "\t", '   ', '  ', '<', '>', '&');
	}	
	
	@$message = str_replace($_SGLOBAL['html_s_str'], $_SGLOBAL['html_r_str'],
		preg_replace($_SGLOBAL['html_s_exp'], $_SGLOBAL['html_r_exp'], $message));
		
	$message = shtmlspecialchars($message);
	
	return trim($message);
}

    static function checkHtml($html)
    {
        $html = stripslashes($html);
        preg_match_all("/<([^<]+)>/is", $html, $ms);
        $searchs[] = '<';
        $replaces[] = '<';
        $searchs[] = '>';
        $replaces[] = '>';
        if ($ms[1]) {
            $allowtags = 'img|a|font|div|table|tbody|caption|tr|td|th|br
						|p|b|strong|i|u|em|span|ol|ul|li|blockquote
						|object|param|embed';
            //允许的标签
            $ms[1] = array_unique($ms[1]);
            foreach ($ms[1] as $value) {
                $searchs[] = "<" . $value . ">";
                $value = shtmlspecialchars($value);
                $value = str_replace(array('/', '/*'), array('.', '/.'), $value);
                $skipkeys = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload', 'javascript', 'script', 'eval', 'behaviour', 'expression', 'style', 'class');
                $skipstr = implode('|', $skipkeys);
                $value = preg_replace(array("/({$skipstr})/i"), '.', $value);
                if (!preg_match("/^[/|s]?({$allowtags})(s+|\$)/is", $value)) {
                    $value = '';
                }
                $replaces[] = empty($value) ? '' : "<" . str_replace('"', '"', $value) . ">";
            }
        }
        $html = str_replace($searchs, $replaces, $html);
        $html = addslashes($html);
        return $html;
    }

 function checkhtml($html)
 {
     $html = stripslashes($html);
     preg_match_all("/\\<([^\\<]+)\\>/is", $html, $ms);
     $searchs[] = '<';
     $replaces[] = '&lt;';
     $searchs[] = '>';
     $replaces[] = '&gt;';
     if ($ms[1]) {
         $allowtags = 'img|font|div|table|tbody|tr|td|th|br|p|b|strong|i|u|em|span|ol|ul|li';
         //允许的标签
         $ms[1] = array_unique($ms[1]);
         foreach ($ms[1] as $value) {
             $searchs[] = "&lt;" . $value . "&gt;";
             $value = shtmlspecialchars($value);
             $value = str_replace(array('\\', '/*'), array('.', '/.'), $value);
             $value = preg_replace(array("/(javascript|script|eval|behaviour|expression)/i", "/(\\s+|&quot;|')on/i"), array('.', ' .'), $value);
             if (!preg_match("/^[\\/|\\s]?({$allowtags})(\\s+|\$)/is", $value)) {
                 $value = '';
             }
             $replaces[] = empty($value) ? '' : "<" . str_replace('&quot;', '"', $value) . ">";
         }
     }
     $html = str_replace($searchs, $replaces, $html);
     //$html = addslashes($html);
     return $html;
 }

function codedisp($code)
{
    global $discuzcodes, $_DCACHE;
    $discuzcodes['pcodecount']++;
    $code = shtmlspecialchars(str_replace('\\"', '"', preg_replace("/^[\n\r]*(.+?)[\n\r]*\$/is", "\\1", $code)));
    $discuzcodes['codehtml'][$discuzcodes['pcodecount']] = "<p style=\"font-weight: bold; margin: 1em 1em 0 1em;\">CODE:</p><code style=\"display: block; margin: 0 1em 1em; padding: 0.5em; border: 1px solid #CCC; font: 12px Courier, monospace; line-height: 1.8em;\">{$code}</code>";
    $discuzcodes['codecount']++;
    return "[\tDISCUZ_CODE_{$discuzcodes['pcodecount']}\t]";
}

 function spacecutstr($str, $length)
 {
     $bbcodes = 'b|i|u|color|size|font|align|list|indent|url|email|code|free|table|tr|td|img|swf|payto|float';
     $str = shtmlspecialchars(cutstr(strip_tags(preg_replace(array("/\\[hide=?\\d*\\](.+?)\\[\\/hide\\]/is", "/\\[quote](.*)\\[\\/quote]/siU", "/\\[({$bbcodes})=?.*\\]/iU", "/\\[\\/({$bbcodes})\\]/i", "/\\[attach\\](\\d+)\\[\\/attach\\]/i"), array("[b]***[/b]", '', '', '', ''), $str)), $length));
     $find = array("/http:\\/\\/[a-z0-9\\/\\-_+=.~!%@?#%&;:\$\\()|]+?\\.(jpg|gif|png|bmp)/is", "/(\n|\r|\r\n){2,}/", "/\\s{2,}/");
     $replace = array("<img onload=\"if(this.width>320) {this.resized=true;this.width=320;}\" src=\"\\0\">", "\r\n", '');
     $str = preg_replace($find, $replace, $str);
     return trim(nl2br($str));
 }

function getcssname($dirname) {
	$css = sreadfile(S_ROOT.'./theme/'.$dirname.'/style.css');
	if($css) {
		preg_match("/\[name\](.+?)\[\/name\]/i", $css, $mathes);
		if(!empty($mathes[1])) $name = shtmlspecialchars($mathes[1]);
	} else {
		$name = 'No name';
	}
	return $name;
}

function shtmlspecialchars($string)
{
    if (is_array($string)) {
        foreach ($string as $key => $val) {
            $string[$key] = shtmlspecialchars($val);
        }
    } else {
        $string = preg_replace('/&amp;((#(\\d{3,5}|x[a-fA-F0-9]{4})|[a-zA-Z][a-z0-9]{2,5});)/', '&\\1', str_replace(array('&', '"', '<', '>'), array('&amp;', '&quot;', '&lt;', '&gt;'), $string));
    }
    return $string;
}

function posttag($tagnamestr)
{
    global $_SGLOBAL, $lang;
    $tagarr = array('existsname' => array(), 'nonename' => array(), 'closename' => array(), 'existsid' => array());
    if (empty($tagnamestr)) {
        return $tagarr;
    }
    $tagnamearr = array();
    $valuearr = explode(' ', str_replace(',', ' ', shtmlspecialchars($tagnamestr)));
    foreach ($valuearr as $value) {
        if (count($tagnamearr) > 10) {
            break;
        }
        $value = posttagcheck($value);
        if ($value) {
            $tagnamearr[md5($value)] = $value;
        }
    }
    if (empty($tagnamearr)) {
        return $tagarr;
    }
    $query = $_SGLOBAL['db']->query('SELECT * FROM ' . tname('tags') . ' WHERE tagname IN (' . simplode($tagnamearr) . ')');
    while ($value = $_SGLOBAL['db']->fetch_array($query)) {
        $tagarr['existsid'][] = $value['tagid'];
        $tagarr['existsname'][] = $value['tagname'];
        if ($value['close']) {
            $tagarr['closename'][] = $value['tagname'];
        }
    }
    if (!empty($tagarr['existsname'])) {
        foreach ($tagnamearr as $value) {
            if (!in_array($value, $tagarr['existsname'])) {
                $tagarr['nonename'][] = $value;
            }
        }
    } else {
        $tagarr['nonename'] = $tagnamearr;
    }
    if (!empty($tagarr['closename'])) {
        showmessage($lang['not_allowed_to_belong_to_the_following_tag'] . ':<p>' . implode(',', $tagarr['closename']) . '</p>');
    }
    return $tagarr;
}

/**
 * 模型在线投稿提交处理函数
 */
function modelpost($cacheinfo, $cp = 1)
{
    global $_SGLOBAL, $theurl, $_SCONFIG;
    include_once S_ROOT . './function/upload.func.php';
    $_POST['mid'] = !empty($_POST['mid']) ? intval($_POST['mid']) : 0;
    $itemid = !empty($_POST['itemid']) ? intval($_POST['itemid']) : 0;
    $hash = '';
    $op = 'add';
    $resultitems = $resultmessage = array();
    $modelsinfoarr = $cacheinfo['models'];
    $columnsinfoarr = $cacheinfo['columns'];
    //获取等级信息
    if ($cacheinfo['models']['modelname'] == 'defect') {
        switch ($_POST['grade']) {
            case 1:
                $_POST['grade'] = '64';
                break;
            case 2:
                $_POST['grade'] = '32';
                break;
            case 3:
                $_POST['grade'] = '16';
                break;
            case 4:
                $_POST['grade'] = '9';
                break;
            case 5:
                $_POST['grade'] = '4';
                break;
            case 6:
                $_POST['grade'] = '1';
                break;
            case 7:
                $_POST['grade'] = '-1';
                break;
            case 8:
                $_POST['grade'] = '-2';
                break;
            case 9:
                $_POST['grade'] = '-3';
                break;
        }
        $gradearr = array('0' => $alang['general_state'], '64' => $alang['check_grade_1'], '32' => $alang['check_grade_2'], '16' => $alang['check_grade_3_1'], '9' => $alang['check_grade_3_2'], '4' => $alang['check_grade_3_3'], '1' => $alang['check_grade_4'], '-1' => $alang['check_grade_5'], '-2' => $alang['check_grade_6'], '-3' => $alang['check_grade_7']);
        if (!empty($_SCONFIG['checkgrade'])) {
            $newgradearr = explode("\t", $_SCONFIG['checkgrade']);
            $gradearr['64'] = $newgradearr[0];
            $gradearr['32'] = $newgradearr[1];
            $gradearr['16'] = $newgradearr[2];
            $gradearr['9'] = $newgradearr[3];
            $gradearr['4'] = $newgradearr[4];
            $gradearr['1'] = $newgradearr[5];
            $gradearr['-1'] = $newgradearr[6];
            $gradearr['-2'] = $newgradearr[7];
            $gradearr['-3'] = $newgradearr[8];
        }
    } else {
        $gradearr = array('0' => $alang['general_state'], '1' => $alang['check_grade_1'], '2' => $alang['check_grade_2'], '3' => $alang['check_grade_3'], '4' => $alang['check_grade_4'], '5' => $alang['check_grade_5'], '6' => $alang['check_grade_6'], '7' => $alang['check_grade_7']);
        if (!empty($_SCONFIG['checkgrade'])) {
            $newgradearr = explode("\t", $_SCONFIG['checkgrade']);
            for ($i = 0; $i < count($newgradearr); $i++) {
                if (!empty($newgradearr[$i])) {
                    $gradearr[$i + 1] = $newgradearr[$i];
                }
            }
        }
    }
    if (empty($_POST['mid']) || $_POST['mid'] != $modelsinfoarr['mid']) {
        showmessage('parameter_error');
    }
    $feedcolum = array();
    foreach ($columnsinfoarr as $result) {
        if ($result['isfixed'] == 1) {
            $resultitems[] = $result;
        } else {
            $resultmessage[] = $result;
        }
        if ($result['formtype'] == 'linkage') {
            if (!empty($_POST[$result['fieldname']])) {
                $_POST[$result['fieldname']] = $cacheinfo['linkage']['info'][$result['fieldname']][$_POST[$result['fieldname']]];
            }
        } elseif ($result['formtype'] == 'timestamp') {
            if (empty($_POST[$result['fieldname']])) {
                $_POST[$result['fieldname']] = $_SGLOBAL['timestamp'];
            } else {
                $_POST[$result['fieldname']] = sstrtotime($_POST[$result['fieldname']]);
            }
        }
    }
    //更新用户最新更新时间
    if (empty($itemid) && $_SGLOBAL['supe_uid']) {
        updatetable('members', array('updatetime' => $_SGLOBAL['timestamp']), array('uid' => $_SGLOBAL['supe_uid']));
    }
    //输入检查
    $_POST['catid'] = intval($_POST['catid']);
    $_POST['allowreply'] = isset($_POST['allowreply']) ? intval($_POST['allowreply']) : checkperm('allowcomment') ? 1 : 0;
    $_POST['subject'] = shtmlspecialchars(trim($_POST['subject']));
    //检查输入
//.........这里部分代码省略.........

}
$configs = array();
$query = $_SGLOBAL['db']->query("SELECT * FROM " . tname('config'));
while ($value = $_SGLOBAL['db']->fetch_array($query)) {
    $configs[$value['var']] = shtmlspecialchars($value['datavalue']);
}
if (empty($configs['feedfilternum']) || $configs['feedfilternum'] < 1) {
    $configs['feedfilternum'] = 1;
}
$datasets = $datas = $mails = array();
$query = $_SGLOBAL['db']->query("SELECT * FROM " . tname('data'));
while ($value = $_SGLOBAL['db']->fetch_array($query)) {
    if ($value['var'] == 'setting' || $value['var'] == 'mail') {
        $datasets[$value['var']] = empty($value['datavalue']) ? array() : unserialize($value['datavalue']);
    } else {
        $datasets[$value['var']] = shtmlspecialchars($value['datavalue']);
    }
}
$datas = $datasets['setting'];
$mails = $datasets['mail'];
// templates directory
$templatearr = array('default' => 'default');
$tpl_dir = sreaddir(S_ROOT . './template');
foreach ($tpl_dir as $dir) {
    if (file_exists(S_ROOT . './template/' . $dir . '/style.css')) {
        $templatearr[$dir] = $dir;
    }
}
$templateselect = array($configs['template'] => ' selected');
$toselect = array($configs['timeoffset'] => ' selected');
$onlineip = getonlineip();

/**
 * 拼合sql語句
 * return array
 */
function getsetsqlarr($valuearr)
{
    $setsqlarr = array();
    if (!empty($valuearr)) {
        foreach ($valuearr as $value) {
            if (isset($_POST[$value['fieldname']])) {
                if (!preg_match("/^(img|flash|file)\$/i", $value['formtype'])) {
                    //提交來後的數據過濾
                    if (preg_match("/^(VARCHAR|CHAR|TEXT|MEDIUMTEXT|LONGTEXT)\$/i", $value['fieldtype'])) {
                        if ($value['formtype'] == 'checkbox') {
                            $_POST[$value['fieldname']] = implode("\n", shtmlspecialchars($_POST[$value['fieldname']]));
                        }
                        if (empty($value['ishtml'])) {
                            $_POST[$value['fieldname']] = shtmlspecialchars(trim($_POST[$value['fieldname']]));
                        } else {
                            $_POST[$value['fieldname']] = trim($_POST[$value['fieldname']]);
                        }
                        if (!empty($value['isbbcode'])) {
                            $_POST[$value['fieldname']] = modeldiscuzcode($_POST[$value['fieldname']]);
                        }
                    } elseif (preg_match("/^(TINYINT|SMALLINT|MEDIUMINT|INT|BIGINT)\$/i", $value['fieldtype'])) {
                        $_POST[$value['fieldname']] = intval($_POST[$value['fieldname']]);
                    }
                    $setsqlarr[$value['fieldname']] = $_POST[$value['fieldname']];
                } elseif ($value['isimage']) {
                    $setsqlarr[$value['fieldname']] = $_POST[$value['fieldname']];
                }
            }
        }
    }
    return $setsqlarr;
}

$start = empty($_GET['start']) ? 0 : intval($_GET['start']);
$countnum = 0;
$lastfileid = 0;
$sitemap_path = S_ROOT . './data/sitemap/';
if (!file_exists($sitemap_path)) {
    @mkdir($sitemap_path, '0666');
}
if (submitcheck('thevalue')) {
    if (!preg_match("/^[0-9a-z_]+\$/i", $_POST['mapname']) || strlen($_POST['mapname']) > 50) {
        showmessage('sitemap_name_error');
    }
    $mapdata = addslashes(serialize($sitemapdata));
    $_POST['maptype'] = saddslashes(shtmlspecialchars($_POST['maptype']));
    $_POST['mapnum'] = $_POST['maptype'] == 'google' ? intval($_POST['mapnum_google']) : intval($_POST['mapnum_baidu']);
    $_POST['createtype'] = intval($_POST['createtype']);
    $_POST['changefreq'] = $_POST['maptype'] == 'google' ? saddslashes(shtmlspecialchars($_POST['changefreq_google'])) : saddslashes(shtmlspecialchars($_POST['changefreq_baidu']));
    if (!empty($_POST['slogid'])) {
        $_SGLOBAL['db']->query("UPDATE " . tname('sitemaplogs') . " SET mapname='{$_POST['mapname']}', maptype='{$_POST['maptype']}', mapnum='{$_POST['mapnum']}', createtype='{$_POST['createtype']}', changefreq='{$_POST['changefreq']}' WHERE slogid='{$_POST['slogid']}'");
        showmessage('sitemap_config_update', $theurl);
    } else {
        $query = $_SGLOBAL['db']->query("SELECT count(*) FROM " . tname('sitemaplogs') . " WHERE mapname='{$_POST['mapname']}'");
        if ($value = $_SGLOBAL['db']->result($query, 0)) {
            showmessage('sitemap_name_exists');
        }
        $_SGLOBAL['db']->query("INSERT INTO " . tname('sitemaplogs') . "(mapname, maptype, mapnum, mapdata, createtype, changefreq) VALUES ('{$_POST['mapname']}', '{$_POST['maptype']}', '{$_POST['mapnum']}', '{$mapdata}', '{$_POST['createtype']}', '{$_POST['changefreq']}')");
        showmessage('sitemap_config_add', $theurl);
    }
} elseif (submitcheck('listsubmit')) {
    if (!empty($_POST['slogidarr'])) {
        $slogidarr = implode('\',\'', $_POST['slogidarr']);
        $_SGLOBAL['db']->query('DELETE FROM ' . tname('sitemaplogs') . ' WHERE slogid IN (\'' . $slogidarr . '\')');

function printruledebug($infoarr)
{
    global $alang;
    $rule = '';
    if (is_array($infoarr['code'])) {
        $infoarr['code'] = implode("\n", $infoarr['code']);
    }
    if (!empty($infoarr['code'])) {
        showprogress($alang['robot_debug_regional_source'], 1);
        showprogress('<textarea style="width:95%;" rows="7">' . $infoarr['code'] . '</textarea>');
    } else {
        showprogress($alang['robot_debug_not_content'], 1);
    }
    $rule = shtmlspecialchars(getregularstring($infoarr['rule'], 'from'));
    showprogress($alang['robot_debug_url'], 1);
    showprogress('<input type="text" style="width: 95%" value="' . $infoarr['url'] . '">');
    showprogress($alang['robot_debug_regular'], 1);
    showprogress('<input type="text" style="width: 95%" value="' . $rule . '">');
    showprogress($alang['robot_debug_source_code'], 1);
    showprogress('<textarea style="width:95%;" rows="7">' . shtmlspecialchars($infoarr['source']) . '</textarea>');
    exit;
}

         }
     }
 }
 if (!$managebatch && $opnum > 1) {
     cpmessage('choose_to_delete_the_tag', $_POST['mpurl']);
 }
 $_POST['ids'] = $newids;
 if ($_POST['optype'] == 'delete') {
     include_once S_ROOT . './source/function_delete.php';
     if (!empty($_POST['ids']) && deletetags($_POST['ids'])) {
         cpmessage('do_success', $_POST['mpurl']);
     } else {
         cpmessage('choose_to_delete_the_tag', $_POST['mpurl']);
     }
 } elseif ($_POST['optype'] == 'merge') {
     $_POST['newtagname'] = shtmlspecialchars(trim($_POST['newtagname']));
     if (strlen($_POST['newtagname']) < 1 || strlen($_POST['newtagname']) > 30) {
         cpmessage('to_merge_the_tag_name_of_the_length_discrepancies', $_POST['mpurl']);
     }
     // retrieve the new tag if there is
     $newtagid = getcount('tag', array('tagname' => $_POST['newtagname']), 'tagid');
     if (empty($newtagid)) {
         // add tag
         $setarr = array('tagname' => $_POST['newtagname'], 'uid' => $_SGLOBAL['supe_uid'], 'dateline' => $_SGLOBAL['timestamp']);
         $newtagid = inserttable('tag', $setarr, 1);
     }
     //ʼϲ
     include_once S_ROOT . './source/function_op.php';
     if (!empty($_POST['ids']) && mergetag($_POST['ids'], $newtagid)) {
         cpmessage('do_success', $_POST['mpurl']);
     } else {

                $tplname = substr($file, 0, -4);
                $pos = strpos($file, '_');
                if ($pos) {
                    $tpls[substr($tplname, 0, $pos)][] = array($file, $status);
                } else {
                    $tpls['base'][] = array($file, $status);
                }
            }
        }
        closedir($dh);
    }
} elseif ($_GET['op'] == 'edit') {
    $filename = checkfilename($_GET['filename']);
    $filefullname = $tpldir . $filename;
    $fp = fopen($filefullname, 'rb');
    $content = trim(shtmlspecialchars(fread($fp, filesize($filefullname))));
    fclose($fp);
} elseif ($_GET['op'] == 'repair') {
    $filename = checkfilename($_GET['filename']);
    $filefullname = $tpldir . $filename;
    //复制当前的文件
    $d_file = $filefullname . '.bak';
    if (file_exists($d_file)) {
        if (!@copy($d_file, $filefullname)) {
            swritefile($filefullname, sreadfile($d_file));
            @unlink($d_file);
        } else {
            @unlink($d_file);
        }
    } else {
        cpmessage('designated_template_files_can_not_be_restored');