PHP Sanitize::html方法代码示例

 public function show()
 {
     if (!isset($this->params['type'])) {
         $this->error(ECode::$MAIL_NOBOX);
     }
     if (!isset($this->params['num'])) {
         $this->error(ECode::$MAIL_NOMAIL);
     }
     $type = $this->params['type'];
     $num = $this->params['num'];
     try {
         $box = new MailBox(User::getInstance(), $type);
         $mail = Mail::getInstance($num, $box);
     } catch (Exception $e) {
         $this->error(ECode::$MAIL_NOMAIL);
     }
     $this->notice = $box->desc . "-阅读邮件";
     $mail->setRead();
     $content = $mail->getHtml();
     preg_match("|来  源:[\\s]*([0-9a-zA-Z.:*]+)|", $content, $f);
     $f = empty($f) ? "" : "<br />FROM {$f[1]}";
     $s = ($pos = strpos($content, "<br/><br/>")) === false ? 0 : $pos + 10;
     $e = ($pos = strpos($content, "<br/>--<br/>")) === false ? strlen($content) : $pos + 7;
     $content = substr($content, $s, $e - $s) . $f;
     if (Configure::read("ubb.parse")) {
         $content = XUBB::parse($content);
     }
     App::import("Sanitize");
     $this->set("type", $type);
     $this->set("num", $mail->num);
     $this->set("title", Sanitize::html($mail->TITLE));
     $this->set("sender", $mail->OWNER);
     $this->set("time", date("Y-m-d H:i:s", $mail->POSTTIME));
     $this->set("content", $content);
 }

 function view($id = null)
 {
     if (!$id) {
         $this->redirect(array('action' => 'index'));
     }
     // Make sure the user is allowed to see the account.
     $id = Sanitize::escape($id);
     if (!$this->isAuthorized($id)) {
         $this->Session->setFlash(__('Invalid account', true));
         $this->redirect(array('action' => 'index'));
     }
     $this->Account->id = $id;
     $account = Sanitize::html($this->Account->field('name'));
     $this->set('page_header', __('%s - Overview', $account));
     // Set the idata needed for nav menu.
     $type = $this->NavMenu->checkType($this->Account->getType($id));
     $this->set('navMenu', $this->NavMenu->menu($type));
     $this->set('selectedTab', 'overview');
     $this->set('accountId', $id);
     $this->set('overview', '');
     // If the request is ajax, use ajax component.
     if ($this->request->isAjax()) {
         $this->render('/Elements/ajax', 'ajax');
     }
 }

 public function verifyUserByToken($username, $token)
 {
     $username = Sanitize::html($username);
     $token = Sanitize::html($token);
     $username = trim($username);
     $token = trim($token);
     if (empty($username) || empty($token)) {
         Log::set(__METHOD__ . LOG_SEP . 'Username or Token-email empty. Username: ' . $username . ' - Token-email: ' . $token);
         return false;
     }
     $user = $this->dbUsers->getDb($username);
     if ($user == false) {
         Log::set(__METHOD__ . LOG_SEP . 'Username does not exist: ' . $username);
         return false;
     }
     $currentTime = Date::current(DB_DATE_FORMAT);
     if ($user['tokenEmailTTL'] < $currentTime) {
         Log::set(__METHOD__ . LOG_SEP . 'Token-email expired: ' . $username);
         return false;
     }
     if ($token === $user['tokenEmail']) {
         // Set the user loggued.
         $this->setLogin($username, $user['role']);
         // Invalidate the current token.
         $this->dbUsers->generateTokenEmail($username);
         Log::set(__METHOD__ . LOG_SEP . 'User logged succeeded by Token-email - Username: ' . $username);
         return true;
     } else {
         Log::set(__METHOD__ . LOG_SEP . 'Token-email incorrect.');
     }
     return false;
 }

 public function index()
 {
     $this->js[] = "forum.refer.js";
     $this->css[] = "mail.css";
     $type = Refer::$AT;
     $pageBar = "";
     if (isset($this->params['type'])) {
         $type = $this->params['type'];
     }
     try {
         $refer = new Refer(User::getInstance(), $type);
     } catch (ReferNullException $e) {
         $this->error(ECode::$REFER_NONE);
     }
     $p = isset($this->params['url']['p']) ? $this->params['url']['p'] : 1;
     App::import('vendor', "inc/pagination");
     try {
         $pagination = new Pagination($refer, Configure::read("pagination.mail"));
         $articles = $pagination->getPage($p);
     } catch (Exception $e) {
         $this->error(ECode::$REFER_NONE);
     }
     if ($refer->getTotalNum() > 0) {
         $info = array();
         App::import('Sanitize');
         foreach ($articles as $v) {
             $info[] = array("index" => $v['INDEX'], "id" => $v['ID'], "board" => $v['BOARD'], "user" => $v['USER'], "title" => Sanitize::html($v['TITLE']), "time" => date("Y-m-d H:i:s", $v['TIME']), "read" => $v['FLAG'] === Refer::$FLAG_READ);
         }
         $this->set("info", $info);
     }
     $link = "{$this->base}/refer/{$type}?p=%page%";
     $this->set("pageBar", $pagination->getPageBar($p, $link));
     $this->set("pagination", $pagination);
     $this->set("type", $type);
 }

 public function add($args)
 {
     $dataForDb = array();
     // This data will be saved in the database
     $dataForFile = array();
     // This data will be saved in the file
     // Generate the database key.
     $key = $this->generateKey($args['slug']);
     // The user is always the one loggued.
     $args['username'] = Session::get('username');
     if (Text::isEmpty($args['username'])) {
         return false;
     }
     // The current unix time stamp.
     if (empty($args['unixTimeCreated'])) {
         $args['unixTimeCreated'] = Date::unixTime();
     }
     // Verify arguments with the database fields.
     foreach ($this->dbFields as $field => $options) {
         if (isset($args[$field])) {
             // Sanitize if will be saved on database.
             if (!$options['inFile']) {
                 $tmpValue = Sanitize::html($args[$field]);
             } else {
                 $tmpValue = $args[$field];
             }
         } else {
             $tmpValue = $options['value'];
         }
         // Check where the field will be written, if in the file or in the database.
         if ($options['inFile']) {
             $dataForFile[$field] = Text::firstCharUp($field) . ': ' . $tmpValue;
         } else {
             // Set type
             settype($tmpValue, gettype($options['value']));
             // Save on database
             $dataForDb[$field] = $tmpValue;
         }
     }
     // Make the directory.
     if (Filesystem::mkdir(PATH_POSTS . $key) === false) {
         Log::set(__METHOD__ . LOG_SEP . 'Error occurred when trying to create the directory ' . PATH_POSTS . $key);
         return false;
     }
     // Make the index.txt and save the file.
     $data = implode("\n", $dataForFile);
     if (file_put_contents(PATH_POSTS . $key . DS . 'index.txt', $data) === false) {
         Log::set(__METHOD__ . LOG_SEP . 'Error occurred when trying to put the content in the file index.txt');
         return false;
     }
     // Save the database
     $this->db[$key] = $dataForDb;
     if ($this->save() === false) {
         Log::set(__METHOD__ . LOG_SEP . 'Error occurred when trying to save the database file.');
         return false;
     }
     return true;
 }

 public function contentRaw($raw = true)
 {
     // This content is not sanitized.
     $content = $this->getField('contentRaw');
     if ($raw) {
         return $content;
     }
     return Sanitize::html($content);
 }

 public function beforeFilter()
 {
     $this->_mbase = Configure::read("plugins.mobile.base");
     $this->css['plugin']['mobile'][] = "m.css";
     $this->notice = Configure::read("site.name");
     parent::beforeFilter();
     if (isset($this->params['url']['m'])) {
         App::import('Sanitize');
         $this->_msg = Sanitize::html(trim($this->params['url']['m']));
     }
 }

 public function getParameterByPostEscape($name, $defultValue = "")
 {
     $parameter = $defultValue;
     if ($this->request->is('post')) {
         if (array_key_exists($name, $_POST)) {
             $parameter = $this->request->data[$name];
             $parameter = Sanitize::escape($parameter);
         }
     }
     return Sanitize::html($parameter);
 }

 /**
  * clean keywords string
  */
 private function _cleanKeywords($data)
 {
     $keywords = $data['keywords'];
     if (!empty($keywords)) {
         $san = new Sanitize();
         $keywords = $san->html($keywords);
     } else {
         $keywords = '';
     }
     return $keywords;
 }

 public function index()
 {
     $this->js[] = "forum.board.js";
     $this->css[] = "board.css";
     App::import('Sanitize');
     if (!isset($this->params['num'])) {
         $this->error(ECode::$SEC_NOSECTION);
     }
     try {
         $num = $this->params['num'];
         $this->_sec = Section::getInstance($num, Section::$NORMAL);
     } catch (SectionNullException $e) {
         $this->error(ECode::$SEC_NOSECTION);
     } catch (BoardNullException $e) {
         $this->error(ECode::$BOARD_NOBOARD);
     }
     $secs = $this->_sec->getAll();
     $ret = false;
     if (!$this->_sec->isNull()) {
         $u = User::getInstance();
         foreach ($secs as $brd) {
             $last = array();
             $last["id"] = "";
             $last["title"] = $last["owner"] = $last["date"] = "无";
             if ($brd->hasReadPerm($u)) {
                 $threads = $brd->getTypeArticles(0, 1, Board::$ORIGIN);
                 if (!empty($threads)) {
                     $threads = $threads[0];
                     $last = array("id" => $threads->ID, "title" => Sanitize::html($threads->TITLE), "owner" => $threads->isSubject() ? $threads->OWNER : "原帖已删除", "date" => date("Y-m-d H:i:s", $threads->POSTTIME));
                 }
             }
             $bms = split(" ", $brd->BM);
             foreach ($bms as &$bm) {
                 if (preg_match("/[^0-9a-zA-Z]/", $bm)) {
                     $bm = array($bm, false);
                 } else {
                     $bm = array($bm, true);
                 }
             }
             $ret[] = array("name" => $brd->NAME, "desc" => $brd->DESC, "type" => $brd->isDir() ? "section" : "board", "bms" => $bms, "curNum" => $brd->CURRENTUSERS, "todayNum" => $brd->getTodayNum(), "threadsNum" => $brd->getThreadsNum(), "articleNum" => $brd->ARTCNT, "last" => $last);
         }
     }
     $this->set("sec", $ret);
     $this->set("noBrd", ECode::msg(ECode::$SEC_NOBOARD));
     $this->set("secName", $this->_sec->getDesc());
     if (!$this->_sec->isRoot()) {
         $parent = $this->_sec->getParent();
         $this->notice[] = array("url" => "/section/{$parent->getName()}", "text" => $parent->getDesc());
     }
     $this->title = Configure::read('site.name') . '-' . $this->_sec->getDesc();
     $this->notice[] = array("url" => "/section/{$this->_sec->getName()}", "text" => $this->_sec->getDesc());
     $this->notice[] = array("url" => "", "text" => $this->_sec->isRoot() ? "分区列表" : "目录列表");
 }

 public function setDb($array)
 {
     $tmp = array();
     // All fields will be sanitize before save.
     foreach ($array as $key => $value) {
         $tmp[$key] = Sanitize::html($value);
     }
     $this->db = $tmp;
     // Save db on file
     $Tmp = new dbJSON($this->filenameDb);
     $Tmp->db = $tmp;
     $Tmp->save();
 }

 public function set($args)
 {
     foreach ($args as $field => $value) {
         if (isset($this->dbFields[$field])) {
             $this->db[$field] = Sanitize::html($value);
         }
     }
     if ($this->save() === false) {
         Log::set(__METHOD__ . LOG_SEP . 'Error occurred when trying to save the database file.');
         return false;
     }
     return true;
 }

 function beforeSave(&$model)
 {
     App::import('Sanitize');
     foreach ($this->settings[$model->alias]['fields'] as $fieldName) {
         if ($fieldName === 'nome' || $fieldName === 'obs') {
             Sanitize::html(&$model->data[$model->alias][$fieldName], array('remove' => true));
         }
         if (isset($model->data[$model->alias]['data']) && $fieldName === 'data') {
             $model->data[$model->alias]['data'] = $this->converteParaMySQL($model, $model->data[$model->alias]['data']);
         }
     }
     return true;
 }

 function addComment(&$Model, $params, $user_id, $tpl_params = array(), $comment_type_name = null, $model_alias = null)
 {
     $mrClean = new Sanitize();
     $notification_data = a();
     $foreign_id = $params['form']['foreign_id'];
     $text = $mrClean->html($params['form']['comment']);
     $comment = array('Comment' => array('body' => $text, 'name' => $user_id, 'email' => 'abc@example.com'));
     $out = $Model->createComment($foreign_id, $comment);
     $comment_id = $Model->Comment->id;
     if (!$model_alias) {
         $model_alias = $Model->alias;
     }
     // Retrieve ids belonging to users that have be notified (eg each users that commented this object before)
     $comments = Set::extract($this->getComments($Model, $foreign_id, TRUE), '{n}.Comment.name');
     // Remove duplicated values
     $tbn = array_unique($comments);
     // Retrieve owner of the commented object
     $owner = $Model->read('user_id', $foreign_id);
     $owner_id = $owner[$model_alias]['user_id'];
     // owner should be notified as well
     if (!in_array($owner_id, $tbn)) {
         array_push($tbn, $owner_id);
     }
     $users = array_diff($tbn, array($user_id));
     if (!empty($users)) {
         $this->setupUserModel();
         $commenter = $this->user->read(array('name', 'surname'), $user_id);
         $owner = $this->user->read(array('name', 'surname'), $owner_id);
         $subject = $this->Conf->get('Site.name') . " comment notification";
         $domain = $this->Conf->get('Organization.domain');
         foreach ($users as $c_id) {
             // check whether the user is can be notified or not
             $active = $this->Acl->check(array('model' => 'User', 'foreign_key' => $c_id), 'site');
             $nfb = $this->user->read('notification', $c_id);
             if ($active && $nfb['User']['notification']) {
                 if ($c_id == $owner_id) {
                     $is_owner = true;
                 } else {
                     $is_owner = false;
                 }
                 array_push($notification_data, array('from' => 'noreply@' . $domain, 'to' => $this->user->getemail($c_id, $this->Conf->get('Organization.domain')), 'subject' => $subject, 'own' => $is_owner, 'owner' => $owner['User'], 'commenter' => $commenter['User']));
             }
         }
     }
     $Model->addtotimeline($tpl_params, null, 'comment', $user_id, $model_alias, $foreign_id, $comment_id, $comment_type_name);
     # clear cache
     clearCache($this->cacheName, '', '');
     return $notification_data;
 }

 /**
  * Sanitizes given array or value for safe input. Use the options to specify
  * the connection to use, and what filters should be applied (with a boolean
  * value). Valid filters: odd_spaces, encode, dollar, carriage, unicode,
  * escape, backslash.
  *
  * @param mixed $data Data to sanitize
  * @return mixed Sanitized data
  * @access public
  * @static
  */
 public static function clean($data)
 {
     if (empty($data)) {
         return $data;
     }
     if (is_array($data)) {
         foreach ($data as $key => $val) {
             $data[$key] = Sanitize::clean($val);
         }
         return $data;
     } else {
         $data = trim($data);
         $data = Sanitize::html($data);
         return $data;
     }
 }