PHP validate_input函数代码示例

 function testInputTimeWrong()
 {
     $input = '21:30am';
     $return = validate_input(array('type' => 'time'), $input, $error);
     $this->assertEqual($input, '21:30am');
     $this->assertEqual($return, false);
 }

 function testValidInputAddressBlankEmpty()
 {
     $input = '';
     $valid = array('type' => 'address', 'blank' => 1);
     validate_input($valid, $input, $error);
     $this->assertTrue(empty($error));
     $this->assertTrue(empty($input));
 }

 public function __construct($request)
 {
     // Get the token from $request which has been set in the headers
     $this->token = $request['token'];
     // Get the args which is simply the url without domain and ...
     $args = $request['args'];
     // This will check if user is authenticated, if not Auth will throw a Error(7) and kills the page
     Auth::authenticate($this->token);
     // Get the all arguments from url
     $this->args = explode('/', rtrim($args, '/'));
     // Get the Controller name
     $this->endpoint = ucfirst($this->args[0]);
     // always the first one is our endpoint , E.g : api/v1/ -> products
     // Do a loop on all arguments to find ids and popo names
     foreach ($this->args as $arg) {
         // Look for an id , either mongo id , or product id !
         if (is_mongo_id($arg)) {
             $this->id = $arg;
             continue;
             // continue if the condition is met , go next loop
         }
         // Check if there is popo with this arg in popo folder
         if (popo_exists($this->endpoint, uc_first($arg))) {
             $this->popo = uc_first($arg);
         }
     }
     // Request type
     $this->request_type = $this->get_request_method();
     // PUT and DELETE can be hidden inside of an POST request , check them :
     if ($this->request_type == 'POST' && array_key_exists('HTTP_X_HTTP_METHOD', $_SERVER)) {
         if ($_SERVER['HTTP_X_HTTP_METHOD'] == "DELETE") {
             $this->request_type = 'DELETE';
         } else {
             if ($_SERVER['HTTP_X_HTTP_METHOD'] == 'PUT') {
                 $this->request_type = 'PUT';
             }
         }
     }
     // Get all inputs
     $this->input = @file_get_contents('php://input');
     $this->input = json_decode($this->input);
     // Check if request method is either POST or PUT and if yes , check if input is empty or not
     validate_input($this->input, $this->request_type);
     // Get params from GET , if is set
     if (isset($_GET)) {
         $this->params = $_GET;
         // first param is like : /produtcs/34534543  , So we dont need it
         array_shift($this->params);
     }
     // Get params from POST , if is set
     if (isset($_POST)) {
         foreach ($_POST as $k => $v) {
             $this->params[$k] = $v;
         }
     }
     // Define the protocol
     $this->protocol = !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443 ? "https" : "http";
 }

function check_entry($array)
{
    header_if(!validate_input(array($array["model_name"])), 400);
    $criteria = $array;
    unset($criteria["model_name"]);
    $entry = call_user_func("select_" . $array["model_name"], $_GET[$array["model_name"]], array_merge(array("id"), array_keys($criteria)));
    header_if(is_empty($entry), 404);
    foreach ($criteria as $column => $value) {
        header_if($value != $entry[$column], 403);
    }
    define($array["model_name"], $entry["id"]);
    $GLOBALS[$array["model_name"]] = $entry;
}

function create_linked_user($username, $email, $password, $panelType)
{
    // Global variables
    global $redis_enabled, $redis_server;
    // Connect to the DB
    $ret = create_connection($connection);
    if ($ret !== true) {
        return $ret;
    }
    // Connect to Redis
    if ($redis_enabled === true) {
        $redis = new Redis();
        if (!$redis->connect($redis_server)) {
            $redis = false;
        }
    } else {
        $redis = false;
    }
    // Validate input
    $ret = validate_input($username, $email, $password, $panelType);
    if ($ret !== true) {
        end_connection(true, $connection);
        return $ret;
    }
    // Create user
    if (create_user($username, $email, $password, $userid, $apikey, $connection) !== true) {
        end_connection(true, $connection);
        return 'Username already exists';
    }
    // Set the type of user profile
    $prefix = 'data/' . $panelType;
    // Create feeds
    if (create_feeds($prefix . '_feeds.json', $feeds, $apikey) !== true) {
        end_connection(true, $connection);
        return 'Error while creating the feeds';
    }
    // Create inputs
    if (create_inputs($prefix . '_inputs.json', $userid, $inputs, $connection, $redis) !== true) {
        end_connection(true, $connection);
        return 'Error while creating the inputs';
    }
    // Create processes
    if (create_processes($prefix . '_processes.json', $feeds, $inputs, $apikey) !== true) {
        end_connection(true, $connection);
        return 'Error while creating the processes';
    }
    end_connection(false, $connection);
    return true;
}

function delete_user($username)
{
    // Connect to the DB
    $ret = create_connection($connection);
    if ($ret !== true) {
        return $ret;
    }
    // Validate input
    $ret = validate_input($username);
    if ($ret !== true) {
        $connection->close();
        return $ret;
    }
    // Get user data
    $user_data = get_user_data($username, $connection);
    if ($user_data === false) {
        $connection->close();
        return 'Username provided does not exist';
    }
    // Delete feeds
    if (delete_feeds($user_data, $connection) !== true) {
        $connection->close();
        return 'Error while deleting the feeds';
    }
    // Delete inputs
    if (delete_inputs($user_data, $connection) !== true) {
        $connection->close();
        return 'Error while deleting the inputs';
    }
    // Delete EWatcher panels
    if (delete_ewatcher($user_data, $connection) !== true) {
        $connection->close();
        return 'Error while deleting user configuration (EWatcher)';
    }
    // Delete user
    if (delete_user_data($user_data, $connection) !== true) {
        $connection->close();
        return 'Error while deleting user data';
    }
    $connection->close();
    return true;
}

    } else {
        // name or password missing?
        $smarty->assign('alert', true);
    }
} elseif ($id && $name) {
    runSQL("UPDATE " . TBL_USERS . "\n               SET name = '" . addslashes($name) . "', permissions = {$perm}, email = '" . addslashes($email) . "'\n\t\t\t WHERE id = {$id}");
    // new password?
    if (!empty($password)) {
        $pw = md5($password);
        runSQL("UPDATE " . TBL_USERS . " SET passwd = '{$pw}' WHERE id = '{$id}'");
        $message = $lang['msg_permpassupd'];
    } else {
        $message = $lang['msg_permupd'];
    }
} elseif ($del && $_POST['del']) {
    validate_input($del);
    // clear user and config
    runSQL('DELETE FROM ' . TBL_USERS . ' WHERE id = ' . $del);
    runSQL('DELETE FROM ' . TBL_USERCONFIG . ' WHERE user_id = ' . $del);
    // clear permissions
    runSQL('DELETE FROM ' . TBL_PERMISSIONS . ' WHERE from_uid = ' . $del);
    $message = $lang['msg_userdel'];
    $smarty->assign('alert', true);
}
// current user permissions
$result = runSQL('SELECT id, name, permissions, email
                    FROM ' . TBL_USERS . '
                ORDER BY name');
foreach ($result as $user) {
    // is guest ?
    $user['guest'] = $user['id'] == $config['guestid'] ? 1 : 0;

/**
* login function
* 
* This function attempts to login the user
* 
* @params = mysqli object
* returns = boolean (true if connected, false if not)
*/
function login($connection)
{
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
        $user = validate_input($_POST['user']);
        $password = hash('sha512', validate_input($_POST['password']));
        $checkStudent = "\tSELECT *\n\t\t\t\t\t\t\tFROM student\n\t\t\t\t\t\t\tWHERE email = ? LIMIT 1;";
        $checkAdvisor = "\tSELECT *\n\t\t\t\t\t\t\tFROM advisor\n\t\t\t\t\t\t\tWHERE email = ? LIMIT 1;";
        // Prepare the statement, bind parameters, then execute!
        // mysqli::prepare returns a mysqli_stmt object or false if an error occurred
        $stmt = $connection->prepare($checkAdvisor);
        $stmt->bind_param('s', $user);
        $stmt->execute();
        // $result stores the mysqli_result object
        $result = $stmt->get_result();
        $storedAdvisor = $result->fetch_assoc();
        if (!empty($storedAdvisor)) {
            if (hash_equals($password, $storedAdvisor['password'])) {
                // That means the user is an advisor! Let's set the session variables...
                $_SESSION['fname'] = $storedAdvisor['fname'];
                $_SESSION['lname'] = $storedAdvisor['lname'];
                $_SESSION['advid'] = $storedAdvisor['advid'];
                $_SESSION['password'] = $storedAdvisor['password'];
                $_SESSION['loggedin'] = TRUE;
                $_SESSION['timeout'] = time();
                $connection->close();
                // Take them to the advisor homepage
                header("Location: advisor_home.php");
            } else {
                // Set the passwordErr variable to display on the login page
                $_SESSION['passwordErr'] = "<p class='error'>* Incorrect password</p>";
                $_SESSION['username'] = $_POST['user'];
                $connection->close();
            }
        } else {
            // No match found in the advisor table, so check the student table
            $stmt = $connection->prepare($checkStudent);
            $stmt->bind_param('s', $user);
            $stmt->execute();
            $result = $stmt->get_result();
            $storedStudent = $result->fetch_assoc();
            // write_to_file($storedStudent, "Stored Student");
            if (!empty($storedStudent)) {
                if (hash_equals($password, $storedStudent['password'])) {
                    // That means the user is a student! Let's set the session variables...
                    $_SESSION['fname'] = $storedStudent['fname'];
                    $_SESSION['lname'] = $storedStudent['lname'];
                    $_SESSION['studentid'] = $storedStudent['studentid'];
                    $_SESSION['major'] = $storedStudent['major'];
                    $_SESSION['startyear'] = $storedStudent['startyear'];
                    $_SESSION['password'] = $storedStudent['password'];
                    $_SESSION['loggedin'] = TRUE;
                    $_SESSION['timeout'] = time();
                    $connection->close();
                    // Take them to the student homepage!
                    header("Location: form.php");
                } else {
                    $_SESSION['passwordErr'] = "<p class='error'>* Incorrect password</p>";
                    $_SESSION['username'] = $_POST['user'];
                    $connection->close();
                }
            } else {
                $_SESSION['usernameErr'] = "<p class='error'>* Username not found</p>";
                $connection->close();
            }
        }
    }
}

if ($_REQUEST['action'] == 'delete') {
    if (!is_reserved_currency($_REQUEST['code'])) {
        $sql = "DELETE FROM currencies WHERE code='" . $_REQUEST['code'] . "' ";
        mysql_query($sql) or die(mysql_error() . $sql);
    } else {
        echo "<p><b>Cannot delete currency: reserved by the system</b></p>";
    }
}
if ($_REQUEST['action'] == 'set_default') {
    $sql = "UPDATE currencies SET is_default = 'N' WHERE code <> '" . $_REQUEST['code'] . "' ";
    mysql_query($sql) or die(mysql_error() . $sql);
    $sql = "UPDATE currencies SET is_default = 'Y' WHERE code = '" . $_REQUEST['code'] . "' ";
    mysql_query($sql) or die(mysql_error() . $sql);
}
if ($_REQUEST['submit'] != '') {
    $error = validate_input();
    if ($error != '') {
        echo "Error: cannot save due to the following errors:<br>";
        echo $error;
    } else {
        $sql = "REPLACE INTO currencies(code, name, rate, sign, decimal_places, decimal_point, thousands_sep, is_default) VALUES ('" . $_REQUEST['code'] . "', '" . $_REQUEST['name'] . "', '" . $_REQUEST['rate'] . "',  '" . $_REQUEST['sign'] . "', '" . $_REQUEST['decimal_places'] . "', '" . $_REQUEST['decimal_point'] . "', '" . $_REQUEST['thousands_sep'] . "', '" . $_REQUEST['is_default'] . "') ";
        //echo $sql;
        mysql_query($sql) or die(mysql_error());
        $_REQUEST['new'] = '';
        $_REQUEST['action'] = '';
        //print_r ($_REQUEST);
    }
}
?>
<b>All currency rates are relative to the USD. (USD rate is always 1)</b><br>
All prices will be displayed in the default currency.<br>

?>

		<?php 
function validate_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    $data = strip_tags($data);
    return $data;
}
// gather and validate data from $_POST array
$quote = validate_input($_POST['quote']);
$candidate = validate_input($_POST['candidate']);
$source = validate_input($_POST['source']);
$date = validate_input($_POST['date']);
// only send form data to db if all fields are filled out
if (!empty($candidate) and !empty($quote) and !empty($source) and !empty($date)) {
    try {
        $sql = "INSERT INTO app_data (quote, candidate, source, date) VALUES (:quote, :candidate, :source, :date)";
        // set up pdo prepared statment
        $stmt = $db->prepare($sql);
        // bind to params in INSERT statement
        $stmt->bindParam(':quote', $quote);
        $stmt->bindParam(':candidate', $candidate);
        $stmt->bindParam(':source', $source);
        $stmt->bindParam(':date', $date);
        // run sql
        $stmt->execute();
        // display success message if the request succeeded
        echo "<section class='result-msg'><h3>Your entry is saved &mdash; Head back to see it!</h3>";

/** Laita kysymys tietokantaan
 * @param $question_id integer
 */
function put_question_to_db($question_id)
{
    /* $title string
     * $body string
     * $tags string
     */
    if (check_user_status()) {
        echo "User status pelaa";
        $body = pg_escape_string($_POST['question']['body']);
        $title = pg_escape_string($_POST['question']['title']);
        $tags = $_POST['question']['tags'];
        if (validate_input($title, $body, $tags)) {
            echo "User input pelaa";
            $title = $_POST['question']['title'];
            set_question($question_id);
            set_tags($question_id);
            header("Location: /pgCodesS/index.php?" . "question_updated" . "&" . "question_id=" . $question_id . "&" . $title);
        } else {
            header("Location: /pgCodesS/index.php?" . "&unsuccessful_new_question");
        }
    } else {
        header("Location: /pgCodesS/index.php" . "&unsuccessful_new_question");
    }
}

	<form action="create_group.php" method="post">
		<div class="grid-container">
			<div class="grid-row">
				<div class="col-10"><label for="name"><strong>Group Name: </strong></label></div>
			</div>
			<div class="grid-row">
				<div class="col-9"><input type="text" name="name" id="name" class="ajax-validate-input" maxlength="100" value="<?php 
if (isset($_POST['name'])) {
    echo escape(trim($_POST['name']));
}
?>
" data-validate="group_name" required/></div>
				<div class="col-1 validation-status"><?php 
if (!isset($trimmed['name'])) {
    echo '<div class="status" data-status="failed"></div>';
} elseif (!validate_input($trimmed['name'], 'group_name')) {
    echo '<div class="status" data-status="failed"></div>';
}
?>
</div>
			</div>
			<div class="grid-row">
				<div class="col-10"><label for="genre"><strong>Group Type: </strong></label></div>
			</div>
			<!-- GROUP TYPE -->
			<div class="grid-row">
				<div class="col-10">
					<select name="group_type" id="group-type" required autofocus style="width:100%;height:30px;">
						<option value=1 data-type="music">Music</option>
						<option value=2 data-type="dance">Dance</option>
						<option value=3 data-type="comedy">Comedy</option>

//========================================================================
// END: HANDLE RELOAD CACHE REQUEST
//========================================================================
//========================================================================
// BEGIN: HANDLE SET USER ACCESS REQUEST
//========================================================================
if (strcasecmp($configTask, "updateUserACL") == 0) {
    $selectuser = get_input('selectuser');
    $setUserAccess = TRUE;
    // Make sure access controls are enabled
    if (!defined('USE_ACL') || !USE_ACL) {
        echo "Access control is not enabled.";
        $setUserAccess = FALSE;
    }
    // Make sure the username of selectuser is OK
    if (!validate_input($selectuser, 'username')) {
        echo "Invalid username. Usernames must be at least 4 character and only use alpha-numeric and _ (underscore).";
        $setUserAccess = FALSE;
    }
    // Make sure the user exists
    if ($setUserAccess) {
        $sql = "SELECT * FROM " . AUTHTABLENAME . " WHERE username='" . $selectuser . "'";
        $result = perform_query($sql, $dbLink);
        if (num_rows($result) == 0) {
            echo "Username " . $selectuser . " does not exist!";
            $setUserAccess = FALSE;
        }
    }
    // If conditions are OK then update the user's access
    if ($setUserAccess && grant_access($username, 'edit_acl', $dbLink)) {
        $actionInputs = array();

 public function onPageRequest(PageRequestEvent $event)
 {
     global $config, $page, $user;
     $this->show_user_info();
     if ($event->page_matches("user_admin")) {
         if ($event->get_arg(0) == "login") {
             if (isset($_POST['user']) && isset($_POST['pass'])) {
                 $this->page_login($_POST['user'], $_POST['pass']);
             } else {
                 $this->theme->display_login_page($page);
             }
         } else {
             if ($event->get_arg(0) == "recover") {
                 $this->page_recover($_POST['username']);
             } else {
                 if ($event->get_arg(0) == "create") {
                     $this->page_create();
                 } else {
                     if ($event->get_arg(0) == "list") {
                         // select users.id,name,joindate,admin,
                         // (select count(*) from images where images.owner_id=users.id) as images,
                         // (select count(*) from comments where comments.owner_id=users.id) as comments from users;
                         // select users.id,name,joindate,admin,image_count,comment_count
                         // from users
                         // join (select owner_id,count(*) as image_count from images group by owner_id) as _images on _images.owner_id=users.id
                         // join (select owner_id,count(*) as comment_count from comments group by owner_id) as _comments on _comments.owner_id=users.id;
                         $this->theme->display_user_list($page, User::by_list(0), $user);
                     } else {
                         if ($event->get_arg(0) == "logout") {
                             $this->page_logout();
                         }
                     }
                 }
             }
         }
         if (!$user->check_auth_token()) {
             return;
         } else {
             if ($event->get_arg(0) == "change_name") {
                 $input = validate_input(array('id' => 'user_id,exists', 'name' => 'user_name'));
                 $duser = User::by_id($input['id']);
                 $this->change_name_wrapper($duser, $input['name']);
             } else {
                 if ($event->get_arg(0) == "change_pass") {
                     $input = validate_input(array('id' => 'user_id,exists', 'pass1' => 'password', 'pass2' => 'password'));
                     $duser = User::by_id($input['id']);
                     $this->change_password_wrapper($duser, $input['pass1'], $input['pass2']);
                 } else {
                     if ($event->get_arg(0) == "change_email") {
                         $input = validate_input(array('id' => 'user_id,exists', 'address' => 'email'));
                         $duser = User::by_id($input['id']);
                         $this->change_email_wrapper($duser, $input['address']);
                     } else {
                         if ($event->get_arg(0) == "change_class") {
                             $input = validate_input(array('id' => 'user_id,exists', 'class' => 'user_class'));
                             $duser = User::by_id($input['id']);
                             $this->change_class_wrapper($duser, $input['class']);
                         } else {
                             if ($event->get_arg(0) == "delete_user") {
                                 $this->delete_user($page, isset($_POST["with_images"]), isset($_POST["with_comments"]));
                             }
                         }
                     }
                 }
             }
         }
     }
     if ($event->page_matches("user")) {
         $display_user = $event->count_args() == 0 ? $user : User::by_name($event->get_arg(0));
         if ($event->count_args() == 0 && $user->is_anonymous()) {
             $this->theme->display_error(401, "Not Logged In", "You aren't logged in. First do that, then you can see your stats.");
         } else {
             if (!is_null($display_user) && $display_user->id != $config->get_int("anon_id")) {
                 $e = new UserPageBuildingEvent($display_user);
                 send_event($e);
                 $this->display_stats($e);
             } else {
                 $this->theme->display_error(404, "No Such User", "If you typed the ID by hand, try again; if you came from a link on this " . "site, it might be bug report time...");
             }
         }
     }
 }

 private function add_members()
 {
     global $user;
     $inputs = validate_input(array("artistID" => "int", "members" => "string,lower"));
     $artistID = $inputs["artistID"];
     $members = explode(" ", $inputs["members"]);
     foreach ($members as $member) {
         if (!$this->member_exists($artistID, $member)) {
             $this->save_new_member($artistID, $member, $user->id);
         }
     }
 }