PHP Typecho_Common::removeXSS方法代码示例

 public static function personalConfigHandle($settings, $isSetup)
 {
     $db = Typecho_Db::get();
     if ($isSetup) {
         Typecho_Widget::widget('Widget_Abstract_Options')->insert(array('name' => '_plugin:UserSign', 'value' => serialize($settings), 'user' => 0));
     }
     $user = Typecho_Widget::widget('Widget_User');
     $user->execute();
     $db->query($db->sql()->where('uid = ?', $user->uid)->update('table.users')->rows(array('userSign' => Typecho_Common::removeXSS($settings['userSign']))));
 }

 /**
  * pingbackPing
  *
  * @param string $source
  * @param string $target
  * @access public
  * @return void
  */
 public function pingbackPing($source, $target)
 {
     /** 检查源地址是否存在*/
     if (!($http = Typecho_Http_Client::get())) {
         return new IXR_Error(16, _t('源地址服务器错误'));
     }
     try {
         $http->setTimeout(5)->send($source);
         $response = $http->getResponseBody();
         if (200 == $http->getResponseStatus()) {
             if (!$http->getResponseHeader('x-pingback')) {
                 preg_match_all("/<link[^>]*rel=[\"']([^\"']*)[\"'][^>]*href=[\"']([^\"']*)[\"'][^>]*>/i", $response, $out);
                 if (!isset($out[1]['pingback'])) {
                     return new IXR_Error(50, _t('源地址不支持PingBack'));
                 }
             }
         } else {
             return new IXR_Error(16, _t('源地址服务器错误'));
         }
     } catch (Exception $e) {
         return new IXR_Error(16, _t('源地址服务器错误'));
     }
     /** 检查目标地址是否正确*/
     $pathInfo = Typecho_Common::url(substr($target, strlen($this->options->index)), '/');
     $post = Typecho_Router::match($pathInfo);
     /** 这样可以得到cid或者slug*/
     if (!$post instanceof Widget_Archive || !$post->have() || !$post->is('single')) {
         return new IXR_Error(33, _t('这个目标地址不存在'));
     }
     if ($post) {
         /** 检查是否可以ping*/
         if ($post->allowPing) {
             /** 现在可以ping了，但是还得检查下这个pingback是否已经存在了*/
             $pingNum = $this->db->fetchObject($this->db->select(array('COUNT(coid)' => 'num'))->from('table.comments')->where('table.comments.cid = ? AND table.comments.url = ? AND table.comments.type <> ?', $post->cid, $source, 'comment'))->num;
             if ($pingNum <= 0) {
                 /** 现在开始插入以及邮件提示了 $response就是第一行请求时返回的数组*/
                 preg_match("/\\<title\\>([^<]*?)\\<\\/title\\>/is", $response, $matchTitle);
                 $finalTitle = Typecho_Common::removeXSS(trim(strip_tags($matchTitle[1])));
                 /** 干掉html tag，只留下<a>*/
                 $text = Typecho_Common::stripTags($response, '<a href="">');
                 /** 此处将$target quote,留着后面用*/
                 $pregLink = preg_quote($target);
                 /** 找出含有target链接的最长的一行作为$finalText*/
                 $finalText = '';
                 $lines = explode("\n", $text);
                 foreach ($lines as $line) {
                     $line = trim($line);
                     if (NULL != $line) {
                         if (preg_match("|<a[^>]*href=[\"']{$pregLink}[\"'][^>]*>(.*?)</a>|", $line)) {
                             if (strlen($line) > strlen($finalText)) {
                                 /** <a>也要干掉，*/
                                 $finalText = Typecho_Common::stripTags($line);
                             }
                         }
                     }
                 }
                 /** 截取一段字*/
                 if (NULL == trim($finalText)) {
                     return new IXR_Error('17', _t('源地址中不包括目标地址'));
                 }
                 $finalText = '[...]' . Typecho_Common::subStr($finalText, 0, 200, '') . '[...]';
                 $pingback = array('cid' => $post->cid, 'created' => $this->options->gmtTime, 'agent' => $this->request->getAgent(), 'ip' => $this->request->getIp(), 'author' => $finalTitle, 'url' => Typecho_Common::safeUrl($source), 'text' => $finalText, 'ownerId' => $post->author->uid, 'type' => 'pingback', 'status' => $this->options->commentsRequireModeration ? 'waiting' : 'approved');
                 /** 加入plugin */
                 $pingback = $this->pluginHandle()->pingback($pingback, $post);
                 /** 执行插入*/
                 $insertId = $this->singletonWidget('Widget_Abstract_Comments')->insert($pingback);
                 /** 评论完成接口 */
                 $this->pluginHandle()->finishPingback($this);
                 return $insertId;
                 /** todo:发送邮件提示*/
             } else {
                 return new IXR_Error(48, _t('PingBack已经存在'));
             }
         } else {
             return IXR_Error(49, _t('目标地址禁止Ping'));
         }
     } else {
         return new IXR_Error(33, _t('这个目标地址不存在'));
     }
 }

 /**
  * 过滤评论内容
  *
  * @access public
  * @param string $text 评论内容
  * @return string
  */
 public function filterText($text)
 {
     $text = str_replace("\r", '', trim($text));
     $text = preg_replace("/\n{2,}/", "\n\n", $text);
     return Typecho_Common::removeXSS(Typecho_Common::stripTags($text, $this->options->commentsHTMLTagAllowed));
 }