PHP HTMLPurifier::purify方法代码示例

 function html_purify($dirty_html, $config = FALSE)
 {
     require_once APPPATH . 'third_party/htmlpurifier-4.6.0-standalone/HTMLPurifier.standalone.php';
     if (is_array($dirty_html)) {
         foreach ($dirty_html as $key => $val) {
             $clean_html[$key] = html_purify($val, $config);
         }
     } else {
         $ci =& get_instance();
         switch ($config) {
             //settings for rhe WYSIWYG
             case 'comment':
                 $config = HTMLPurifier_Config::createDefault();
                 $config->set('Core.Encoding', $ci->config->item('charset'));
                 $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                 $config->set('HTML.Allowed', 'a[href|title],img[title|src|alt],em,strong,cite,blockquote,code,ul,ol,li,dl,dt,dd,p,br,h1,h2,h3,h4,h5,h6,span,*[style]');
                 $config->set('AutoFormat.AutoParagraph', TRUE);
                 $config->set('AutoFormat.Linkify', TRUE);
                 $config->set('AutoFormat.RemoveEmpty', TRUE);
                 break;
             case FALSE:
                 $config = HTMLPurifier_Config::createDefault();
                 $config->set('Core.Encoding', $ci->config->item('charset'));
                 $config->set('HTML.Doctype', 'XHTML 1.0 Strict');
                 break;
             default:
                 show_error('The HTMLPurifier configuration labeled "' . htmlentities($config, ENT_QUOTES, 'UTF-8') . '" could not be found.');
         }
         $purifier = new HTMLPurifier($config);
         $clean_html = $purifier->purify($dirty_html);
     }
     return $clean_html;
 }

 /**
  * Transforms string to purified string.
  *
  * @param string $string
  *
  * @return string
  *
  * @throws TransformationFailedException if $string is null.
  */
 public function reverseTransform($string)
 {
     if (null === $string) {
         throw new TransformationFailedException("Field is empty!");
     }
     return strip_tags($this->purifier->purify($string));
 }

 /**
  * Transforms description string to purified description string.
  *
  * @param string $description
  *
  * @return string
  *
  * @throws TransformationFailedException if $description is null.
  */
 public function reverseTransform($description)
 {
     if (null === $description) {
         throw new TransformationFailedException("Description field is empty!");
     }
     return $this->purifier->purify(strip_tags($description));
 }

 /**
  * @inheritdoc
  */
 public function transform($value)
 {
     if (is_null($value)) {
         return $value;
     }
     if (is_scalar($value)) {
         $value = (string) $value;
     }
     if (!is_string($value)) {
         throw new TransformationFailedException(sprintf('Expected a string to transform, got %s instead', json_encode($value)));
     }
     // purify to remove really obscure html
     return $this->purifier->purify($value);
 }

 /**
  * Escape any comment for being placed inside HTML, but preserve simple links (<a href="...">).
  *
  * @param   string  $comment
  *
  * @return  string
  */
 public function escapeComment($comment)
 {
     if (self::$purifier === null) {
         require_once 'HTMLPurifier/Bootstrap.php';
         require_once 'HTMLPurifier.php';
         require_once 'HTMLPurifier.autoload.php';
         $config = HTMLPurifier_Config::createDefault();
         $config->set('Core.EscapeNonASCIICharacters', true);
         $config->set('HTML.Allowed', 'a[href]');
         $config->set('Cache.DefinitionImpl', null);
         self::$purifier = new HTMLPurifier($config);
     }
     return self::$purifier->purify($comment);
 }

 /**
  * 过滤数据 重组
  * @param array $data
  * @param array $modelfield
  */
 public function filterData($data = array(), $modelfield = array())
 {
     $newmodelfield = $this->parseModelField($modelfield);
     $newdata = $data;
     foreach ($data as $k => $d) {
         if (key_exists($k, $newmodelfield)) {
             switch ($newmodelfield[$k]['type']) {
                 case 'editor':
                     //编辑器过滤XSS
                     Vendor('Htmlpurifier.library.HTMLPurifier#auto');
                     $config = \HTMLPurifier_Config::createDefault();
                     $purifier = new \HTMLPurifier($config);
                     $newdata[$k] = $purifier->purify(htmlspecialchars_decode($d));
                     break;
                 case 'position':
                     //推荐位
                     $newdata[$k] = implode(',', $d);
                     break;
                 case 'checkbox':
                     $newdata[$k] = implode(',', $d);
                     break;
             }
         }
     }
     return $newdata;
 }

 /**
  * Value sanitation. Sanitize input and output with ease using one of the sanitation types below.
  * 
  * @param  string $data the string/value you wish to sanitize
  * @param  string $type the type of sanitation you wish to use.
  * @return string       the sanitized string
  */
 public function sanitize($data, $type = '')
 {
     ## Use the HTML Purifier, as it help remove malicious scripts and code. ##
     ##       HTML Purifier 4.4.0 - Standards Compliant HTML Filtering       ##
     require_once 'htmlpurifier/HTMLPurifier.standalone.php';
     $purifier = new HTMLPurifier();
     $config = HTMLPurifier_Config::createDefault();
     $config->set('Core.Encoding', 'UTF-8');
     // If no type if selected, it will simply run it through the HTML purifier only.
     switch ($type) {
         // Remove HTML tags (can have issues with invalid tags, keep that in mind!)
         case 'purestring':
             $data = strip_tags($data);
             break;
             // Only allow a-z (H & L case)
         // Only allow a-z (H & L case)
         case 'atoz':
             $data = preg_replace('/[^a-zA-Z]+/', '', $data);
             break;
             // Integers only - Remove any non 0-9 and use Intval() to make sure it is an integer which comes out.
         // Integers only - Remove any non 0-9 and use Intval() to make sure it is an integer which comes out.
         case 'integer':
             $data = intval(preg_replace('/[^0-9]+/', '', $data));
             break;
     }
     /* HTML purifier to help prevent XSS in case anything slipped through. */
     $data = $purifier->purify($data);
     return $data;
 }

 public function saveAction()
 {
     $form = new News_Form_Article();
     $formData = $this->_request->getPost();
     $form->populate($formData);
     if (!$form->isValid($formData)) {
         $appSession = Zend_Registry::get('appSession');
         $appSession->articleForm = $form;
         $this->_forward('index');
         return;
     }
     $news = new News_Model_News();
     if ($this->_getParam('id')) {
         if (!($article = $news->getRowInstance($this->_getParam('id')))) {
             $this->_helper->FlashMessenger->addMessage($this->view->translate('The article doesn\'t exist.'));
             $this->_redirect('/news');
             return;
         }
     } else {
         $article = $news->createRow();
     }
     require_once 'htmlpurifier/library/HTMLPurifier.auto.php';
     $config = HTMLPurifier_Config::createDefault();
     $purifier = new HTMLPurifier($config);
     $cleanHtml = $purifier->purify($form->getValue('content'));
     $article->title = $form->getValue('title');
     $article->date = $form->getValue('date');
     $article->excerpt = $form->getValue('excerpt');
     $article->content = $cleanHtml;
     $article->save();
     $this->_helper->FlashMessenger->addMessage($this->view->translate('The article has been saved.'));
     $this->_redirect('/news');
 }

 /**
  * Transform a raw field value.
  *
  * @param string $name The name of the field to transform, as specified in the schema.
  * @param string $value The value to be transformed.
  * @return string The transformed value.
  */
 public function transformField($name, $value)
 {
     $schemaFields = $this->schema->getSchema();
     $fieldParameters = $schemaFields[$name];
     if (!isset($fieldParameters['transformations']) || empty($fieldParameters['transformations'])) {
         return $value;
     } else {
         // Field exists in schema, so apply sequence of transformations
         $transformedValue = $value;
         foreach ($fieldParameters['transformations'] as $transformation) {
             switch (strtolower($transformation)) {
                 case "purify":
                     $transformedValue = $this->purifier->purify($transformedValue);
                     break;
                 case "escape":
                     $transformedValue = $this->escapeHtmlCharacters($transformedValue);
                     break;
                 case "purge":
                     $transformedValue = $this->purgeHtmlCharacters($transformedValue);
                     break;
                 case "trim":
                     $transformedValue = $this->trim($transformedValue);
                     break;
                 default:
                     break;
             }
         }
         return $transformedValue;
     }
 }

 /**
  * render
  *
  * @param string $userId
  * @param array  $messages
  * @param bool   $showDefaultMessage
  *
  * @return string
  */
 protected function render($userId, $messages, $showDefaultMessage = false)
 {
     $messageHtml = '';
     $messageHtml .= '<div class="rcmMessage userMessageList" data-ng-controller="rcmMessageList">';
     foreach ($messages as $userMessage) {
         /** @var \RcmMessage\Entity\Message $message */
         $message = $userMessage->getMessage();
         $cssName = $this->getCssName($message->getLevel());
         $messageSubject = $message->getSubject();
         $messageBody = $message->getMessage();
         $messageHtml .= '
         <div class="alert' . $cssName . '" ng-hide="hiddenUserMessageIds[\'' . $userId . ':' . $userMessage->getId() . '\']" role="alert">
           <button type="button" class="close" ng-click="dismissUserMessage(' . $userId . ', ' . $userMessage->getId() . ')" aria-label="Close">
           <span aria-hidden="true">&times;</span>
           </button>
           <span class="subject">
           ' . $this->htmlPurifier->purify($this->translator->translate($messageSubject)) . ':
           </span>
           <span class="body">
           ' . $this->htmlPurifier->purify($this->translator->translate($messageBody)) . '
           </span>
         </div>
         ';
     }
     $messageHtml .= '</div>';
     return $messageHtml;
 }

 function save()
 {
     $this->import_parameters();
     $this->load_library('htmlpurifier-4.5.0-lite/library/HTMLPurifier.auto');
     $config = HTMLPurifier_Config::createDefault();
     $purifier = new HTMLPurifier($config);
     $message = $purifier->purify(html_entity_decode($this->message));
     $this->set('message', $message);
     $reference_object = new $this->reference_object($this->reference_id);
     //if the message is being created for an object other than a project, then the project id will be retrieved from
     //the actual object
     //if the message is being posted on a project, then the project id is the messages reference_id
     if ($this->reference_object != 'project') {
         $project_id = isset($reference_object->project_id) ? $reference_object->project_id : false;
     } else {
         $project_id = $this->reference_id;
     }
     if ($project_id) {
         $this->set('project_id', $project_id);
     }
     if (isset($reference_object->client_id)) {
         $this->set('client_id', $reference_object->client_id);
     }
     $this->set('user_id', current_user()->id);
     //these two parameters shouldn't be set yet (they are set when we log activity which happens after the save),
     //but let's just make sure
     $this->unset_param('linked_object');
     $this->unset_param('linked_object_title');
     $result = parent::save();
     ActivityManager::message_created($this);
     return $result;
 }

 protected function _purifyValue($val)
 {
     if ($val == $this->_example) {
         $val = null;
     } else {
         static $purifier = null;
         if ($this->_prevent_xss) {
             if (!empty($val)) {
                 if ($purifier == null && class_exists('HTMLPurifier')) {
                     if (iconv_get_encoding("internal_encoding") != "UTF-8") {
                         $config = HTMLPurifier_Config::createDefault();
                         $config->set('Core.Encoding', iconv_get_encoding("internal_encoding"));
                         // replace with your encoding
                         $purifier = new HTMLPurifier($config);
                     } else {
                         $purifier = new HTMLPurifier();
                     }
                 }
                 if ($purifier != null) {
                     $val = $purifier->purify($val);
                 }
             }
         }
     }
     return $val;
 }

 /**
  * Converts a given string to our xml friendly text.
  * This step involves purifying the string
  *
  * @param String $string Input string to reformat
  * @return String Reformatted string (optional HTML -> Markdown, UTF-8)
  */
 public function xml_ready($string, $convert_to_markdown = true)
 {
     static $purifier = null;
     static $fixer = null;
     static $markdown = null;
     if ($purifier === null) {
         $purifier_config = HTMLPurifier_Config::createDefault();
         $purifier_config->set('Cache.SerializerPath', realpath($GLOBALS['TMP_PATH']));
         $purifier = new HTMLPurifier($purifier_config);
         $markdown = new HTML_To_Markdown();
         $markdown->set_option('strip_tags', true);
     }
     $string = studip_utf8encode($string);
     $string = $purifier->purify($string);
     if ($convert_to_markdown) {
         $string = $markdown->convert($string);
         $string = preg_replace('/\\[\\]\\((\\w+:\\/\\/.*?)\\)/', '', $string);
         $string = preg_replace('/\\[(\\w+:\\/\\/.*?)\\/?\\]\\(\\1\\/?\\s+"(.*?)"\\)/isxm', '$2: $1', $string);
         $string = preg_replace('/\\[(\\w+:\\/\\/.*?)\\/?\\]\\(\\1\\/?\\)/isxm', '$1', $string);
         $string = preg_replace('/\\[(.*?)\\]\\((\\w+:\\/\\/.*?)\\)/', '$1: $2', $string);
     }
     $string = preg_replace('/[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f]/', '', $string);
     $string = trim($string);
     $string = htmlspecialchars($string, ENT_QUOTES, 'UTF-8');
     return $string;
 }

 public function edit_contact()
 {
     if (isset($_POST['edit_contact_btn'])) {
         $data_post = $this->input->post();
         $this->load->helper('HTMLPurifier');
         $config = HTMLPurifier_Config::createDefault();
         $purifier = new HTMLPurifier($config);
         $data_update['content'] = $purifier->purify($data_post['content_contact']);
         if ($this->Contact->update($data_update)) {
             $content = 'Cập nhật thông tin liên lạc thành công.';
             set_notice('status', SUCCESS_STATUS, $content);
             header('location:' . base_url() . 'index.php/_admin/manage_site/contact/show_contact');
         } else {
             $content = 'Cập nhật thông tin liên lạc thất bại.';
             set_notice('status', FAILED_STATUS, $content);
             header('location:' . base_url() . 'index.php/_admin/manage_site/contact/show_contact');
         }
     } else {
         $data['contact'] = $this->Contact->get_contact();
         $data['subView'] = '/manage_site/contact/edit_contact_layout';
         $data['title'] = "Cập nhật thông tin liên hệ";
         $data['subData'] = $data;
         $this->load->view('/main/main_layout', $data);
     }
 }

function scrape($url, $path, $parse)
{
    $config = HTMLPurifier_Config::createDefault();
    $config->set('Core.Encoding', 'UTF-8');
    //encoding of output
    $config->set('HTML.Doctype', 'XHTML 1.1');
    //doctype of output
    $purifier = new HTMLPurifier($config);
    $dirty_html = file_get_contents($url);
    $clean_html = $purifier->purify($dirty_html);
    $html = str_get_html($clean_html);
    switch ($parse) {
        case 'tag':
            $ret = $html->find($path)->tag;
            break;
        case 'outertext':
            $ret = $html->find($path)->outertext;
            break;
        case 'innertext':
            $ret = $html->find($path)->innertext;
            break;
        case 'plaintext':
            $ret = $html->find($path)->plaintext;
            break;
        default:
            $ret = $html->find($path);
            break;
    }
    // clean up memory
    $html->clear();
    unset($dirty_html);
    unset($clean_html);
    unset($html);
    return $ret;
}