PHP Format::sanitize方法代码示例

 function createNote($ext_id)
 {
     global $thisstaff;
     if (!$thisstaff) {
         Http::response(403, "Login required");
     } elseif (!isset($_POST['note']) || !$_POST['note']) {
         Http::response(422, "Send `note` parameter");
     } elseif (!($note = QuickNote::create(array('staff_id' => $thisstaff->getId(), 'body' => Format::sanitize($_POST['note']), 'created' => new SqlFunction('NOW'), 'ext_id' => $ext_id)))) {
         Http::response(500, "Unable to create new note");
     } elseif (!$note->save(true)) {
         Http::response(500, "Unable to create new note");
     }
     $show_options = true;
     include STAFFINC_DIR . 'templates/note.tmpl.php';
 }

 function htmlchars($var, $sanitize = false)
 {
     static $phpversion = null;
     if (is_array($var)) {
         return array_map(array('Format', 'htmlchars'), $var);
     }
     if ($sanitize) {
         $var = Format::sanitize($var);
     }
     if (!isset($phpversion)) {
         $phpversion = phpversion();
     }
     $flags = ENT_COMPAT;
     if ($phpversion >= '5.4.0') {
         $flags |= ENT_HTML401;
     }
     try {
         return htmlspecialchars((string) $var, $flags, 'UTF-8', false);
     } catch (Exception $e) {
         return $var;
     }
 }

 static function fromVars($vars, $update = false)
 {
     // Try and lookup by email address
     $user = static::lookupByEmail($vars['email']);
     if (!$user) {
         $name = $vars['name'];
         if (!$name) {
             list($name) = explode('@', $vars['email'], 2);
         }
         $user = User::create(array('name' => Format::htmldecode(Format::sanitize($name, false)), 'created' => new SqlFunction('NOW'), 'updated' => new SqlFunction('NOW'), 'default_email' => UserEmail::ensure($vars['email'])));
         // Is there an organization registered for this domain
         list($mailbox, $domain) = explode('@', $vars['email'], 2);
         if (isset($vars['org_id'])) {
             $user->set('org_id', $vars['org_id']);
         } elseif ($org = Organization::forDomain($domain)) {
             $user->setOrganization($org, false);
         }
         try {
             $user->save(true);
             $user->emails->add($user->default_email);
             // Attach initial custom fields
             $user->addDynamicData($vars);
         } catch (OrmException $e) {
             return null;
         }
     } elseif ($update) {
         $errors = array();
         $user->updateInfo($vars, $errors, true);
     }
     /* INICIO
        Anthony Parisi
        */
     if (isset($_SESSION["crmEmail"])) {
         $mysqli = new mysqli("localhost", "root", "ip15x0", "vtigercrm600");
         $sqlUser = $mysqli->query("SELECT MAX(id) FROM `vtigercrm600`.vtiger_modtracker_detail;");
         $resUser = $sqlUser->fetch_array();
         $mysqli->query("UPDATE `vtigercrm600`.`vtiger_contactdetails` SET `mobile` = '" . $_SESSION["crmPhone"] . "' WHERE UPPER(`vtiger_contactdetails`.`email`) = UPPER('" . $_SESSION["crmEmail"] . "');");
         $mysqli->query("INSERT INTO `vtigercrm600`.vtiger_modtracker_detail(id,fieldname,prevalue,postvalue) VALUES('" . $resUser[0] . "','email',NULL,'" . $_SESSION["crmPhone"] . "');");
         unset($_SESSION["crmEmail"]);
         unset($_SESSION["crmPhone"]);
     }
     /* FIN */
     return $user;
 }

 function save($refetch = false)
 {
     if (count($this->dirty)) {
         $this->set('updated', new SqlFunction('NOW'));
     }
     if (isset($this->dirty['notes'])) {
         $this->notes = Format::sanitize($this->notes);
     }
     return parent::save($refetch);
 }

 function save($id, $vars, &$errors, $allowempty = false)
 {
     //Cleanup.
     $vars['name'] = Format::striptags(trim($vars['name']));
     //validate
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal error. Try again');
     }
     if (!$vars['type']) {
         $errors['type'] = __('Type is required');
     }
     if (!$vars['name']) {
         $errors['name'] = __('Name is required');
     } elseif (($pid = self::getIdByName($vars['name'])) && $pid != $id) {
         $errors['name'] = __('Name already exists');
     }
     if (!$vars['body'] && !$allowempty) {
         $errors['body'] = __('Page body is required');
     }
     if ($errors) {
         return false;
     }
     //save
     $sql = ' updated=NOW() ' . ', `type`=' . db_input($vars['type']) . ', name=' . db_input($vars['name']) . ', body=' . db_input(Format::sanitize($vars['body'])) . ', isactive=' . db_input($vars['isactive'] ? 1 : 0) . ', notes=' . db_input(Format::sanitize($vars['notes']));
     if ($id) {
         $sql = 'UPDATE ' . PAGE_TABLE . ' SET ' . $sql . ' WHERE id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this site page'));
     } else {
         $sql = 'INSERT INTO ' . PAGE_TABLE . ' SET ' . $sql . ', created=NOW()';
         if (!db_query($sql) || !($id = db_insert_id())) {
             $errors['err'] = sprintf(__('Unable to create %s.'), __('this site page')) . ' ' . __('Internal error occurred');
             return false;
         }
         $sql = 'UPDATE ' . PAGE_TABLE . ' SET `content_id`=`id`' . ' WHERE id=' . db_input($id);
         if (!db_query($sql)) {
             return false;
         }
         return $id;
     }
     return false;
 }

 function save($id, $vars, &$errors)
 {
     if (!$vars['subject']) {
         $errors['subject'] = 'Message subject is required';
     }
     if (!$vars['body']) {
         $errors['body'] = 'Message body is required';
     }
     if (!$id) {
         if (!$vars['tpl_id']) {
             $errors['tpl_id'] = 'Template set is required';
         }
         if (!$vars['code_name']) {
             $errors['code_name'] = 'Code name is required';
         }
     }
     if ($errors) {
         return false;
     }
     $vars['body'] = Format::sanitize($vars['body'], false);
     if ($id) {
         $sql = 'UPDATE ' . EMAIL_TEMPLATE_TABLE . ' SET updated=NOW() ' . ', subject=' . db_input($vars['subject']) . ', body=' . db_input($vars['body']) . ' WHERE id=' . db_input($this->getId());
         return db_query($sql);
     } else {
         $sql = 'INSERT INTO ' . EMAIL_TEMPLATE_TABLE . ' SET created=NOW(),
             updated=NOW(), tpl_id=' . db_input($vars['tpl_id']) . ', code_name=' . db_input($vars['code_name']) . ', subject=' . db_input($vars['subject']) . ', body=' . db_input($vars['body']);
         if (db_query($sql) && ($id = db_insert_id())) {
             return $id;
         }
     }
     return null;
 }

 function save($id, $vars, &$errors)
 {
     $vars['username'] = Format::striptags($vars['username']);
     $vars['firstname'] = Format::striptags($vars['firstname']);
     $vars['lastname'] = Format::striptags($vars['lastname']);
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal Error');
     }
     if (!$vars['firstname']) {
         $errors['firstname'] = __('First name required');
     }
     if (!$vars['lastname']) {
         $errors['lastname'] = __('Last name required');
     }
     $error = '';
     if (!$vars['username'] || !Validator::is_username($vars['username'], $error)) {
         $errors['username'] = $error ? $error : __('Username is required');
     } elseif (($uid = Staff::getIdByUsername($vars['username'])) && $uid != $id) {
         $errors['username'] = __('Username already in use');
     }
     if (!$vars['email'] || !Validator::is_valid_email($vars['email'])) {
         $errors['email'] = __('Valid email is required');
     } elseif (Email::getIdByEmail($vars['email'])) {
         $errors['email'] = __('Already in use system email');
     } elseif (($uid = Staff::getIdByEmail($vars['email'])) && $uid != $id) {
         $errors['email'] = __('Email already in use by another agent');
     }
     if ($vars['phone'] && !Validator::is_phone($vars['phone'])) {
         $errors['phone'] = __('Valid phone number is required');
     }
     if ($vars['mobile'] && !Validator::is_phone($vars['mobile'])) {
         $errors['mobile'] = __('Valid phone number is required');
     }
     if ($vars['passwd1'] || $vars['passwd2'] || !$id) {
         if ($vars['passwd1'] && strcmp($vars['passwd1'], $vars['passwd2'])) {
             $errors['passwd2'] = __('Passwords do not match');
         } elseif ($vars['backend'] != 'local' || $vars['welcome_email']) {
             // Password can be omitted
         } elseif (!$vars['passwd1'] && !$id) {
             $errors['passwd1'] = __('Temporary password is required');
             $errors['temppasswd'] = __('Required');
         } elseif ($vars['passwd1'] && strlen($vars['passwd1']) < 6) {
             $errors['passwd1'] = __('Password must be at least 6 characters');
         }
     }
     if (!$vars['dept_id']) {
         $errors['dept_id'] = __('Department is required');
     }
     if (!$vars['group_id']) {
         $errors['group_id'] = __('Group is required');
     }
     if (!$vars['timezone_id']) {
         $errors['timezone_id'] = __('Time zone selection is required');
     }
     // Ensure we will still have an administrator with access
     if ($vars['isadmin'] !== '1' || $vars['isactive'] !== '1') {
         $sql = 'select count(*), max(staff_id) from ' . STAFF_TABLE . ' WHERE isadmin=1 and isactive=1';
         if (($res = db_query($sql)) && (list($count, $sid) = db_fetch_row($res))) {
             if ($count == 1 && $sid == $id) {
                 $errors['isadmin'] = __('Cowardly refusing to remove or lock out the only active administrator');
             }
         }
     }
     if ($errors) {
         return false;
     }
     $sql = 'SET updated=NOW() ' . ' ,isadmin=' . db_input($vars['isadmin']) . ' ,isactive=' . db_input($vars['isactive']) . ' ,isvisible=' . db_input(isset($vars['isvisible']) ? 1 : 0) . ' ,onvacation=' . db_input(isset($vars['onvacation']) ? 1 : 0) . ' ,assigned_only=' . db_input(isset($vars['assigned_only']) ? 1 : 0) . ' ,dept_id=' . db_input($vars['dept_id']) . ' ,group_id=' . db_input($vars['group_id']) . ' ,timezone_id=' . db_input($vars['timezone_id']) . ' ,daylight_saving=' . db_input(isset($vars['daylight_saving']) ? 1 : 0) . ' ,username=' . db_input($vars['username']) . ' ,firstname=' . db_input($vars['firstname']) . ' ,lastname=' . db_input($vars['lastname']) . ' ,email=' . db_input($vars['email']) . ' ,backend=' . db_input($vars['backend']) . ' ,phone="' . db_input(Format::phone($vars['phone']), false) . '"' . ' ,phone_ext=' . db_input($vars['phone_ext']) . ' ,mobile="' . db_input(Format::phone($vars['mobile']), false) . '"' . ' ,signature=' . db_input(Format::sanitize($vars['signature'])) . ' ,notes=' . db_input(Format::sanitize($vars['notes']));
     if ($vars['passwd1']) {
         $sql .= ' ,passwd=' . db_input(Passwd::hash($vars['passwd1']));
         if (isset($vars['change_passwd'])) {
             $sql .= ' ,change_passwd=1';
         }
     } elseif (!isset($vars['change_passwd'])) {
         $sql .= ' ,change_passwd=0';
     }
     if ($id) {
         $sql = 'UPDATE ' . STAFF_TABLE . ' ' . $sql . ' WHERE staff_id=' . db_input($id);
         if (db_query($sql) && db_affected_rows()) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this agent')) . ' ' . __('Internal error occurred');
     } else {
         $sql = 'INSERT INTO ' . STAFF_TABLE . ' ' . $sql . ', created=NOW()';
         if (db_query($sql) && ($uid = db_insert_id())) {
             return $uid;
         }
         $errors['err'] = sprintf(__('Unable to create %s.'), __('this agent')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

 function save($id, $vars, &$errors)
 {
     // Required fields
     if (!$vars['namespace'] || !isset($vars['body']) || !isset($vars['staff_id'])) {
         return false;
     }
     $sql = ' SET `namespace`=' . db_input($vars['namespace']) . ' ,body=' . db_input(Format::sanitize($vars['body'], false)) . ' ,staff_id=' . db_input($vars['staff_id']);
     if (!$id) {
         $sql = 'INSERT INTO ' . DRAFT_TABLE . $sql . ' ,created=NOW()';
         if (!db_query($sql) || !($draft = self::lookup(db_insert_id()))) {
             return false;
         }
         // Cloned attachments...
         if ($vars['attachments'] && is_array($vars['attachments'])) {
             $draft->attachments->upload($vars['attachments'], true);
         }
         return $draft;
     } else {
         $sql = 'UPDATE ' . DRAFT_TABLE . $sql . ' WHERE id=' . db_input($id);
         if (db_query($sql) && db_affected_rows() == 1) {
             return $this;
         }
     }
 }

 function log($priority, $title, $message, $alert = false, $force = false)
 {
     //We are providing only 3 levels of logs. Windows style.
     switch ($priority) {
         case LOG_EMERG:
         case LOG_ALERT:
         case LOG_CRIT:
         case LOG_ERR:
             $level = 1;
             //Error
             break;
         case LOG_WARN:
         case LOG_WARNING:
             $level = 2;
             //Warning
             break;
         case LOG_NOTICE:
         case LOG_INFO:
         case LOG_DEBUG:
         default:
             $level = 3;
             //Debug
     }
     $loglevel = array(1 => 'Error', 'Warning', 'Debug');
     $info = array('title' => &$title, 'level' => $loglevel[$level], 'level_id' => $level, 'body' => &$message);
     Signal::send('syslog', null, $info);
     //Logging everything during upgrade.
     if ($this->getConfig()->getLogLevel() < $level && !$force) {
         return false;
     }
     //Alert admin if enabled...
     if ($alert && $this->getConfig()->getLogLevel() >= $level) {
         $this->alertAdmin($title, $message);
     }
     //Save log based on system log level settings.
     $sql = 'INSERT INTO ' . SYSLOG_TABLE . ' SET created=NOW(), updated=NOW() ' . ',title=' . db_input(Format::sanitize($title, true)) . ',log_type=' . db_input($loglevel[$level]) . ',log=' . db_input(Format::sanitize($message, false)) . ',ip_address=' . db_input($_SERVER['REMOTE_ADDR']);
     db_query($sql, false);
     return true;
 }

 function save($id, $vars, &$errors)
 {
     global $cfg;
     $vars['title'] = Format::striptags(trim($vars['title']));
     if ($id && $id != $vars['id']) {
         $errors['err'] = __('Internal error. Try again');
     }
     if (!$vars['title']) {
         $errors['title'] = __('Title required');
     } elseif (strlen($vars['title']) < 3) {
         $errors['title'] = __('Title is too short. 3 chars minimum');
     } elseif (($cid = self::getIdByTitle($vars['title'])) && $cid != $id) {
         $errors['title'] = __('Title already exists');
     }
     if (!$vars['response']) {
         $errors['response'] = __('Response text is required');
     }
     if ($errors) {
         return false;
     }
     $sql = ' updated=NOW() ' . ',dept_id=' . db_input($vars['dept_id'] ?: 0) . ',isenabled=' . db_input($vars['isenabled']) . ',title=' . db_input($vars['title']) . ',response=' . db_input(Format::sanitize($vars['response'])) . ',notes=' . db_input(Format::sanitize($vars['notes']));
     if ($id) {
         $sql = 'UPDATE ' . CANNED_TABLE . ' SET ' . $sql . ' WHERE canned_id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this canned response'));
     } else {
         $sql = 'INSERT INTO ' . CANNED_TABLE . ' SET ' . $sql . ',created=NOW()';
         if (db_query($sql) && ($id = db_insert_id())) {
             return $id;
         }
         $errors['err'] = sprintf(__('Unable to create %s.'), __('this canned response')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

 function getClean()
 {
     return trim($this->body, " <>br/\t\n\r") ? Format::sanitize($this->body) : '';
 }

 static function fromVars($vars)
 {
     // Try and lookup by email address
     $user = static::lookupByEmail($vars['email']);
     if (!$user) {
         $name = $vars['name'];
         if (!$name) {
             list($name) = explode('@', $vars['email'], 2);
         }
         $user = User::create(array('name' => Format::htmldecode(Format::sanitize($name, false)), 'created' => new SqlFunction('NOW'), 'updated' => new SqlFunction('NOW'), 'default_email' => UserEmail::ensure($vars['email'])));
         // Is there an organization registered for this domain
         list($mailbox, $domain) = explode('@', $vars['email'], 2);
         if (isset($vars['org_id'])) {
             $user->set('org_id', $vars['org_id']);
         } elseif ($org = Organization::forDomain($domain)) {
             $user->setOrganization($org, false);
         }
         try {
             $user->save(true);
             $user->emails->add($user->default_email);
             // Attach initial custom fields
             $user->addDynamicData($vars);
         } catch (OrmException $e) {
             return null;
         }
     }
     return $user;
 }

 function create($vars)
 {
     global $cfg;
     //Must have...
     if (!$vars['ticketId'] || !$vars['type'] || !in_array($vars['type'], array('M', 'R', 'N'))) {
         return false;
     }
     $sql = ' INSERT INTO ' . TICKET_THREAD_TABLE . ' SET created=NOW() ' . ' ,thread_type=' . db_input($vars['type']) . ' ,ticket_id=' . db_input($vars['ticketId']) . ' ,title=' . db_input(Format::sanitize($vars['title'], true)) . ' ,body=' . db_input(Format::sanitize($vars['body'], true)) . ' ,staff_id=' . db_input($vars['staffId']) . ' ,poster=' . db_input($vars['poster']) . ' ,source=' . db_input($vars['source']);
     if (isset($vars['pid'])) {
         $sql .= ' ,pid=' . db_input($vars['pid']);
     } elseif (isset($vars['reply_to']) && $vars['reply_to'] instanceof ThreadEntry) {
         $sql .= ' ,pid=' . db_input($vars['reply_to']->getId());
     }
     if ($vars['ip_address']) {
         $sql .= ' ,ip_address=' . db_input($vars['ip_address']);
     }
     //echo $sql;
     if (!db_query($sql) || !($entry = self::lookup(db_insert_id(), $vars['ticketId']))) {
         return false;
     }
     /************* ATTACHMENTS *****************/
     //Upload/save attachments IF ANY
     if ($vars['files']) {
         //expects well formatted and VALIDATED files array.
         $entry->uploadFiles($vars['files']);
     }
     //Emailed or API attachments
     if ($vars['attachments']) {
         $entry->importAttachments($vars['attachments']);
     }
     //Canned attachments...
     if ($vars['cannedattachments'] && is_array($vars['cannedattachments'])) {
         $entry->saveAttachments($vars['cannedattachments']);
     }
     // Email message id (required for all thread posts)
     if (!isset($vars['mid'])) {
         $vars['mid'] = sprintf('<%s@%s>', Misc::randCode(24), substr(md5($cfg->getUrl()), -10));
     }
     $entry->saveEmailInfo($vars);
     return $entry;
 }

 function save($id, $vars, &$errors)
 {
     if (!$vars['grace_period']) {
         $errors['grace_period'] = __('Grace period required');
     } elseif (!is_numeric($vars['grace_period'])) {
         $errors['grace_period'] = __('Numeric value required (in hours)');
     }
     if (!$vars['name']) {
         $errors['name'] = __('Name is required');
     } elseif (($sid = SLA::getIdByName($vars['name'])) && $sid != $id) {
         $errors['name'] = __('Name already exists');
     }
     if ($errors) {
         return false;
     }
     $sql = ' updated=NOW() ' . ',isactive=' . db_input($vars['isactive']) . ',name=' . db_input($vars['name']) . ',grace_period=' . db_input($vars['grace_period']) . ',disable_overdue_alerts=' . db_input(isset($vars['disable_overdue_alerts']) ? 1 : 0) . ',enable_priority_escalation=' . db_input(isset($vars['enable_priority_escalation']) ? 1 : 0) . ',notes=' . db_input(Format::sanitize($vars['notes']));
     if ($id) {
         $sql = 'UPDATE ' . SLA_TABLE . ' SET ' . $sql . ' WHERE id=' . db_input($id);
         if (db_query($sql)) {
             return true;
         }
         $errors['err'] = sprintf(__('Unable to update %s.'), __('this SLA plan')) . ' ' . __('Internal error occurred');
     } else {
         if (isset($vars['id'])) {
             $sql .= ', id=' . db_input($vars['id']);
         }
         $sql = 'INSERT INTO ' . SLA_TABLE . ' SET ' . $sql . ',created=NOW() ';
         if (db_query($sql) && ($id = db_insert_id())) {
             return $id;
         }
         $errors['err'] = sprintf(__('Unable to add %s.'), __('this SLA plan')) . ' ' . __('Internal error occurred');
     }
     return false;
 }

    $email=null;
    if(!$_POST['email_id'] || !($email=Email::lookup($_POST['email_id'])))
        $errors['email_id']=__('Select from email address');

    if(!$_POST['email'] || !Validator::is_valid_email($_POST['email']))
        $errors['email']=__('Valid recipient email address required');

    if(!$_POST['subj'])
        $errors['subj']=__('Subject required');

    if(!$_POST['message'])
        $errors['message']=__('Message required');

    if(!$errors && $email){
        if($email->send($_POST['email'],$_POST['subj'],
                Format::sanitize($_POST['message']),
                null, array('reply-tag'=>false))) {
            $msg=Format::htmlchars(sprintf(__('Test email sent successfully to <%s>'),
                $_POST['email']));
            Draft::deleteForNamespace('email.diag');
        }
        else
            $errors['err']=__('Error sending email - try again.');
    }elseif($errors['err']){
        $errors['err']=__('Error sending email - try again.');
    }
}
$nav->setTabActive('emails');
$ost->addExtraHeader('<meta name="tip-namespace" content="emails.diagnostic" />',
    "$('#content').data('tipNamespace', '".$tip_namespace."');");
require(STAFFINC_DIR.'header.inc.php');