PHP iaSanitize类代码示例

 public function gridRead($params, $columns, array $filterParams = array(), array $persistentConditions = array())
 {
     $params || ($params = array());
     $start = isset($params['start']) ? (int) $params['start'] : 0;
     $limit = isset($params['limit']) ? (int) $params['limit'] : 15;
     $sort = $params['sort'];
     $dir = in_array($params['dir'], array(iaDb::ORDER_ASC, iaDb::ORDER_DESC)) ? $params['dir'] : iaDb::ORDER_ASC;
     $order = $sort && $dir ? " ORDER BY `{$sort}` {$dir}" : '';
     $where = $values = array();
     foreach ($filterParams as $name => $type) {
         if (isset($params[$name]) && $params[$name]) {
             $value = iaSanitize::sql($params[$name]);
             switch ($type) {
                 case 'equal':
                     $where[] = sprintf('`%s` = :%s', $name, $name);
                     $values[$name] = $value;
                     break;
                 case 'like':
                     $where[] = sprintf('`%s` LIKE :%s', $name, $name);
                     $values[$name] = '%' . $value . '%';
             }
         }
     }
     $where = array_merge($where, $persistentConditions);
     $where || ($where[] = iaDb::EMPTY_CONDITION);
     $where = implode(' AND ', $where);
     $this->_iaDb->bind($where, $values);
     if (is_array($columns)) {
         $columns = array_merge(array('id', 'update' => 1, 'delete' => 1), $columns);
     }
     return array('data' => $this->_iaDb->all($columns, $where . $order, $start, $limit), 'total' => (int) $this->_iaDb->one(iaDb::STMT_COUNT_ROWS, $where));
 }

 protected function _modifyGridParams(&$conditions, &$values)
 {
     if (!empty($_GET['text'])) {
         $conditions[] = '(`title` LIKE :text OR `body` LIKE :text)';
         $values['text'] = '%' . iaSanitize::sql($_GET['text']) . '%';
     }
 }

 protected function _preSaveEntry(array &$entry, array $data, $action)
 {
     $iaAcl = $this->_iaCore->factory('acl');
     iaUtil::loadUTF8Functions('ascii', 'validation', 'bad', 'utf8_to_ascii');
     $entry['id'] = $iaAcl->obtainFreeId();
     $entry['assignable'] = $data['visible'];
     $entry['visible'] = $data['visible'];
     if (iaCore::ACTION_ADD == $action) {
         if (empty($data['name'])) {
             $this->addMessage('error_usergroup_incorrect');
         } else {
             $entry['name'] = strtolower(iaSanitize::paranoid($data['name']));
             if (!iaValidate::isAlphaNumericValid($entry['name'])) {
                 $this->addMessage('error_usergroup_incorrect');
             } elseif ($this->_iaDb->exists('`name` = :name', array('name' => $entry['name']))) {
                 $this->addMessage('error_usergroup_exists');
             }
         }
     }
     foreach ($this->_iaCore->languages as $iso => $title) {
         if (empty($data['title'][$iso])) {
             $this->addMessage(iaLanguage::getf('error_lang_title', array('lang' => $this->_iaCore->languages[$iso])), false);
         } elseif (!utf8_is_valid($data['title'][$iso])) {
             $data['title'][$iso] = utf8_bad_replace($data['title'][$iso]);
         }
     }
     if (!$this->getMessages()) {
         foreach ($this->_iaCore->languages as $iso => $title) {
             iaLanguage::addPhrase('usergroup_' . $entry['name'], $data['title'][$iso], $iso);
         }
     }
     return !$this->getMessages();
 }

 protected function _modifyGridParams(&$conditions, &$values)
 {
     if (isset($_GET['item']) && $_GET['item']) {
         $value = 'core' == strtolower($_GET['item']) ? '' : iaSanitize::sql($_GET['item']);
         $conditions[] = '`extras` = :extras';
         $values['extras'] = $value;
     }
 }

 protected function _gridRead($params)
 {
     $action = 1 == count($this->_iaCore->requestPath) ? $this->_iaCore->requestPath[0] : null;
     switch ($action) {
         case 'items':
             $output = array('data' => null);
             if ($items = $this->_iaCore->factory('item')->getItems(true)) {
                 foreach ($items as $key => $item) {
                     $output['data'][] = array('title' => iaLanguage::get($item), 'value' => $item);
                 }
             }
             break;
         case 'plans':
             $output = array('data' => null);
             $stmt = '';
             if (!isset($params['itemname']) || isset($params['itemname']) && iaUsers::getItemName() == $params['itemname']) {
                 $stmt = iaDb::convertIds(iaUsers::getItemName(), 'item');
                 $output['data'][] = array('title' => iaLanguage::get('funds'), 'value' => 0);
             } elseif (!empty($params['itemname'])) {
                 $stmt = iaDb::convertIds($params['itemname'], 'item');
             }
             $this->_iaCore->factory('plan');
             if ($planIds = $this->_iaDb->onefield(iaDb::ID_COLUMN_SELECTION, $stmt, null, null, iaPlan::getTable())) {
                 foreach ($planIds as $planId) {
                     $output['data'][] = array('title' => iaLanguage::get('plan_title_' . $planId), 'value' => $planId);
                 }
             }
             break;
         case 'gateways':
             $output = array('data' => null);
             if ($items = $this->getHelper()->getPaymentGateways()) {
                 foreach ($items as $name => $title) {
                     $output['data'][] = array('value' => $name, 'title' => $title);
                 }
             }
             break;
         case 'members':
             $output = array('data' => null);
             if (!empty($params['query'])) {
                 $where[] = 'CONCAT(`username`, `fullname`) LIKE :username';
                 $values['username'] = '%' . iaSanitize::sql($params['query']) . '%';
             }
             $where || ($where[] = iaDb::EMPTY_CONDITION);
             $where = implode(' AND ', $where);
             $this->_iaDb->bind($where, $values);
             if ($members = $this->_iaDb->all(array('id', 'username', 'fullname'), $where, null, null, iaUsers::getTable())) {
                 foreach ($members as $member) {
                     $output['data'][] = array('title' => $member['username'], 'value' => $member['id']);
                 }
             }
             break;
         default:
             $output = parent::_gridRead($params);
     }
     return $output;
 }

 private function _deleteFile($params)
 {
     $result = array('error' => true, 'message' => iaLanguage::get('invalid_parameters'));
     $item = isset($params['item']) ? iaSanitize::sql($params['item']) : null;
     $field = isset($params['field']) ? iaSanitize::sql($params['field']) : null;
     $path = isset($params['path']) ? iaSanitize::sql($params['path']) : null;
     $itemId = isset($params['itemid']) ? (int) $params['itemid'] : null;
     if ($itemId && $item && $field && $path) {
         $tableName = $this->_iaCore->factory('item')->getItemTable($item);
         $itemValue = $this->_iaDb->one($field, iaDb::convertIds($itemId), $tableName);
         $iaAcl = $this->_iaCore->factory('acl');
         if ($iaAcl->isAdmin() && $itemValue) {
             $pictures = $itemValue[1] == ':' ? unserialize($itemValue) : $itemValue;
             $key = null;
             if (is_array($pictures)) {
                 if ($primitive = !is_array($pictures[key($pictures)])) {
                     $pictures = array($pictures);
                 }
                 foreach ($pictures as $k => $v) {
                     if ($path == $v['path']) {
                         $key = $k;
                         break;
                     }
                 }
                 if (!is_null($key)) {
                     unset($pictures[$key]);
                 }
                 $newItemValue = $primitive ? '' : serialize($pictures);
             } else {
                 // single image
                 $newItemValue = '';
                 if ($pictures == $path) {
                     $key = true;
                 }
             }
             if (!is_null($key)) {
                 if ($this->_iaCore->factory('picture')->delete($path)) {
                     if ($this->_iaDb->update(array($field => $newItemValue), iaDb::convertIds($itemId), null, $tableName)) {
                         if (iaUsers::getItemName() == $item) {
                             // update current profile data
                             if ($itemId == iaUsers::getIdentity()->id) {
                                 iaUsers::reloadIdentity();
                             }
                         }
                     }
                     $result['error'] = false;
                     $result['message'] = iaLanguage::get('deleted');
                 } else {
                     $result['message'] = iaLanguage::get('error');
                 }
             }
         }
     }
     return $result;
 }

 public function titleAlias($title)
 {
     $result = iaSanitize::tags($title);
     $this->iaCore->factory('util');
     iaUtil::loadUTF8Functions('ascii', 'validation', 'bad', 'utf8_to_ascii');
     utf8_is_ascii($result) || ($result = utf8_to_ascii($result));
     $result = preg_replace('#' . self::ALIAS_SUFFIX . '$#i', '', $result);
     $result = iaSanitize::alias($result);
     $result = substr($result, 0, 150);
     // the DB scheme applies this limitation
     $result .= self::ALIAS_SUFFIX;
     return $result;
 }

function smarty_function_ia_hooker($params, &$smarty)
{
    if (!isset($params['name'])) {
        return;
    }
    $name = $params['name'];
    iaDebug::debug('smarty', $name, 'hooks');
    iaSystem::renderTime('smarty', $name);
    $iaCore = iaCore::instance();
    $hooks = $iaCore->getHooks();
    if (!array_key_exists($name, $hooks) || empty($hooks[$name])) {
        return;
    }
    foreach ($hooks[$name] as $hook) {
        $hook['type'] = in_array($hook['type'], array('php', 'html', 'plain', 'smarty')) ? $hook['type'] : 'php';
        if (empty($hook['pages']) || in_array($iaCore->iaView->name(), $hook['pages'])) {
            if ($hook['filename']) {
                switch ($hook['type']) {
                    case 'php':
                        if (file_exists(IA_HOME . $hook['filename'])) {
                            include IA_HOME . $hook['filename'];
                        }
                        break;
                    case 'smarty':
                        echo $smarty->fetch(IA_HOME . $hook['filename']);
                }
            } else {
                switch ($hook['type']) {
                    case 'php':
                        eval($hook['code']);
                        break;
                    case 'smarty':
                        echo $smarty->fetch('eval:' . $hook['code']);
                        break;
                    case 'html':
                        echo $hook['code'];
                        break;
                    case 'plain':
                        echo iaSanitize::html($hook['code']);
                }
            }
        }
    }
}

function lyrics_search($aQuery, $aFields, $aStart, $aLimit, &$aNumAll, $aWhere = '', $cond = 'AND')
{
    $iaCore =& iaCore::instance();
    $iaLyric = $iaCore->factoryPackage('lyric', 'lyrics');
    $ret = array();
    $match = array();
    // additional fields
    if ($aFields && is_array($aFields)) {
        foreach ($aFields as $fname => $data) {
            if ('LIKE' == $data['cond']) {
                $data['val'] = "%{$data['val']}%";
            }
            // for multiple values, like combo or checkboxes
            if (is_array($data['val'])) {
                if ('!=' == $data['cond']) {
                    $data['cond'] = count($data['val']) > 1 ? 'NOT IN' : '!=';
                } else {
                    $data['cond'] = count($data['val']) > 1 ? 'IN' : '=';
                }
                $data['val'] = count($data['val']) > 1 ? '(' . implode(',', $data['val']) . ')' : array_shift($data['val']);
            } else {
                if (preg_match('/^(\\d+)\\s*-\\s*(\\d+)$/', $data['val'], $range)) {
                    // search in range
                    $data['cond'] = sprintf('BETWEEN %d AND %d', $range[1], $range[2]);
                    $data['val'] = '';
                } else {
                    $data['val'] = "'" . iaSanitize::sql($data['val']) . "'";
                }
            }
            $match[] = "t1.`{$fname}` {$data['cond']} {$data['val']} ";
        }
    }
    $lyrics = array();
    $lyrics = $match ? $iaLyric->getSearchLyrics($aStart, $aLimit, ' AND (' . implode(' ' . $cond . ' ', $match) . ')') : array();
    $aNumAll += $iaCore->iaDb->foundRows();
    foreach ($lyrics as $lyric) {
        $iaCore->iaSmarty->assign('lyric', $lyric);
        $lyricinfo = $iaLyric->goToItem(array('item' => $lyric));
        //$ret[] = $iaCore->iaSmarty->fetch(IA_PACKAGES . 'lyrics/templates/common/brief_article.tpl');
        $ret[] = sprintf('<p><a href="%s">%s</a></p>', $lyricinfo[0], $lyric['title']);
    }
    return $ret;
}

 protected function _postSaveEntry(array &$entry, array $data, $action)
 {
     iaUtil::loadUTF8Functions('ascii', 'validation', 'bad', 'utf8_to_ascii');
     foreach ($this->_iaCore->languages as $code => $language) {
         $title = iaSanitize::tags($data['title'][$code]);
         utf8_is_valid($title) || ($title = utf8_bad_replace($title));
         iaLanguage::addPhrase('usergroup_' . $entry['name'], $title, $code);
     }
     // copy privileges
     if ($data['copy_from']) {
         $this->_iaDb->setTable('acl_privileges');
         $where = '`type_id` = :id AND `type` = :type';
         $this->_iaDb->bind($where, array('id' => (int) $data['copy_from'], 'type' => 'group'));
         $rows = $this->_iaDb->all(iaDb::ALL_COLUMNS_SELECTION, $where);
         foreach ($rows as $key => &$row) {
             $row['type_id'] = $this->getEntryId();
             unset($rows[$key]['id']);
         }
         $this->_iaDb->insert($rows);
         $this->_iaDb->resetTable();
     }
 }

 protected function _preSaveEntry(array &$entry, array $data, $action)
 {
     $entry['assignable'] = (int) $data['visible'];
     $entry['visible'] = (int) $data['visible'];
     if (iaCore::ACTION_ADD == $action) {
         if (empty($data['name'])) {
             $this->addMessage('error_usergroup_incorrect');
         } else {
             $entry['name'] = strtolower(iaSanitize::paranoid($data['name']));
             if (!iaValidate::isAlphaNumericValid($entry['name'])) {
                 $this->addMessage('error_usergroup_incorrect');
             } elseif ($this->_iaDb->exists('`name` = :name', array('name' => $entry['name']))) {
                 $this->addMessage('error_usergroup_exists');
             }
         }
     }
     foreach ($this->_iaCore->languages as $code => $language) {
         if (empty($data['title'][$code])) {
             $this->addMessage(iaLanguage::getf('error_lang_title', array('lang' => $language['title'])), false);
         }
     }
     return !$this->getMessages();
 }

 private static function _deepSanitizeHtml($value)
 {
     if (is_array($value)) {
         foreach ($value as $k => $v) {
             $value[$k] = call_user_func(array(__CLASS__, __METHOD__), $v);
         }
         return $value;
     } else {
         return iaSanitize::html($value);
     }
 }

 private function _queryPage(&$iaView)
 {
     if (isset($_SESSION['queries'])) {
         $iaView->assign('history', $_SESSION['queries']);
     }
     if (isset($_POST['exec_query'])) {
         iaUtil::loadUTF8Functions('ascii', 'validation', 'bad', 'utf8_to_ascii');
         $sql = $_POST['query'];
         $outerData = '';
         utf8_is_valid($sql) || ($sql = utf8_bad_replace($sql));
         $queries = false === strpos($sql, ';' . PHP_EOL) ? array($sql) : explode(";\r\n", $sql);
         foreach ($queries as $key => $sqlQuery) {
             $sql = trim(str_replace('{prefix}', $this->_iaDb->prefix, $sqlQuery));
             $this->_iaCore->startHook('phpAdminBeforeRunSqlQuery', array('query' => $sql));
             $result = $this->_iaDb->query($sql);
             $this->_iaCore->startHook('phpAdminAfterRunSqlQuery');
             $numrows = 0;
             if ($result) {
                 isset($_SESSION['queries']) || ($_SESSION['queries'] = array());
                 if (!in_array($sqlQuery, $_SESSION['queries'])) {
                     if (count($_SESSION['queries']) >= 5) {
                         array_shift($_SESSION['queries']);
                     }
                     $_SESSION['queries'][] = $sqlQuery;
                 }
                 $numrows = $rows = $this->_iaDb->getNumRows($result);
                 if ($rows) {
                     $rows .= $rows > 1 ? ' rows' : ' row';
                     $this->addMessage("<b>Query OK:</b> {$rows} selected.", false);
                 } else {
                     $this->addMessage('<b>Query OK:</b> ' . $this->_iaDb->getAffected() . ' rows affected.', false);
                 }
             } else {
                 $this->_error = true;
                 $this->addMessage('<b>Query Failed:</b><br />' . $this->_iaDb->getError());
             }
             if ($numrows) {
                 // get field names
                 $fieldNames = $this->_iaDb->getFieldNames($result);
                 $outerData .= '<table class="table table-hover table-condensed"><thead><tr>';
                 $i = 0;
                 foreach ($fieldNames as $field) {
                     $outerData .= '<th ' . (!$i ? 'class="first"' : '') . '>' . $field->name . '</th>';
                     $i++;
                 }
                 $outerData .= '</tr></thead><tbody>';
                 $numFields = $this->_iaDb->getNumFields($result);
                 while ($row = $this->_iaDb->fetchRow($result)) {
                     $outerData .= '<tr>';
                     for ($i = 0; $i < $numFields; $i++) {
                         $outerData .= '<td' . (!$i ? ' class="first"' : '') . '>' . iaSanitize::html($row[$i]) . '</td>';
                     }
                     $outerData .= '</tr>';
                 }
                 $outerData .= '</tbody></table>';
             }
         }
         $iaView->assign('sql', $sql);
         $iaView->assign('queryOut', $outerData);
     }
     $iaView->assign('tables', $this->getHelper()->getTables());
 }

 protected function _modifyGridResult(array &$entries)
 {
     foreach ($entries as $key => &$entry) {
         $entry['title'] = iaLanguage::get(self::PATTERN_TITLE . $entry['id']);
         $entry['description'] = iaSanitize::tags(iaLanguage::get(self::PATTERN_DESCRIPTION . $entry['id']));
         $entry['item'] = iaLanguage::get($entry['item']);
         $entry['duration'] .= ' ' . iaLanguage::get($entry['unit'] . ($entry['duration'] > 1 ? 's' : ''));
         if ($entry['recurring'] && $entry['cycles'] != -1) {
             $entry['duration'] .= ' (' . $entry['cycles'] . ' ' . iaLanguage::get('cycles') . ')';
         }
         $entry['duration'] = strtolower($entry['duration']);
         unset($entries[$key]['unit'], $entries[$key]['cycles']);
     }
 }

 public function output()
 {
     $outputValues = $this->getValues();
     switch ($this->getRequestType()) {
         case self::REQUEST_JSON:
             header('Content-Type: application/json');
             $iaUtil = $this->iaCore->factory('util');
             if (isset($outputValues[self::JSON_MAGIC_KEY]) && 1 == count($outputValues)) {
                 $outputValues = array_values($outputValues[self::JSON_MAGIC_KEY]);
             }
             echo $iaUtil->jsonEncode($outputValues);
             break;
         case self::REQUEST_HTML:
             header('Content-Type: text/html');
             $iaSmarty =& $this->iaSmarty;
             foreach ($outputValues as $key => $value) {
                 $iaSmarty->assign($key, $value);
             }
             // set page notifications
             $messages = $this->getMessages();
             $notifications = array();
             foreach (array(self::ERROR, self::SUCCESS, self::ALERT, self::SYSTEM) as $type) {
                 empty($messages[$type]) || ($notifications[$type] = is_array($messages[$type]) ? $messages[$type] : array($messages[$type]));
             }
             $pageName = $this->name();
             if (iaCore::ACCESS_ADMIN == $this->iaCore->getAccessType()) {
                 $adminActions = self::PAGE_ERROR == $pageName ? array() : $this->_getAdminToolbarActions();
                 $this->set('toolbarActions', $adminActions);
             }
             $iaSmarty->assign('member', iaUsers::hasIdentity() ? iaUsers::getIdentity(true) : array());
             // define smarty super global $core
             $core = array('actions' => $this->_setActions(), 'config' => $this->iaCore->getConfig(), 'customConfig' => $this->iaCore->getCustomConfig(), 'language' => $this->iaCore->languages[$this->language], 'languages' => $this->iaCore->languages, 'notifications' => $notifications, 'packages' => $this->iaCore->packagesData, 'page' => array('breadcrumb' => iaBreadcrumb::render(), 'info' => $this->getParams(), 'nonProtocolUrl' => $this->assetsUrl, 'name' => $pageName, 'title' => $this->get('caption', $this->get('title', 'Subrion CMS'))), 'providers' => iaUsers::getAuthProviders());
             if (iaCore::ACCESS_FRONT == $this->iaCore->getAccessType()) {
                 // get meta-description
                 $value = $this->get('description');
                 $metaDescription = empty($value) && iaLanguage::exists('page_metadescr_' . $pageName) ? iaLanguage::get('page_metadescr_' . $pageName) : $value;
                 $core['page']['meta-description'] = iaSanitize::html($metaDescription);
                 // get meta-keywords
                 $value = $this->get('keywords');
                 $metaKeywords = empty($value) && iaLanguage::exists('page_metakeyword_' . $pageName) ? iaLanguage::get('page_metakeyword_' . $pageName) : $value;
                 $core['page']['meta-keywords'] = iaSanitize::html($metaKeywords);
                 $this->_logStatistics();
                 header('X-Powered-CMS: Subrion CMS');
             }
             $iaSmarty->assignByRef('core', $core);
             $this->iaCore->startHook('phpCoreDisplayBeforeShowBody');
             $content = '';
             if ($this->get('body', self::NONE) != self::NONE) {
                 $content = $iaSmarty->fetch($this->_retrieveTemplatePath($this->get('body')));
             }
             if ($this->_layoutEnabled) {
                 $iaSmarty->assign('_content_', $content);
                 $content = $iaSmarty->fetch('layout' . self::TEMPLATE_FILENAME_EXT);
             }
             echo $content;
             break;
         case self::REQUEST_XML:
             header('Content-Type: text/xml');
             function htmldecode($text)
             {
                 $text = html_entity_decode($text);
                 $text = htmlspecialchars($text);
                 return $text;
             }
             function xmlEncode(array $array, &$parentObject)
             {
                 static $section;
                 foreach ($array as $key => $value) {
                     switch (true) {
                         case is_array($array[key($array)]):
                             if (!is_numeric($key)) {
                                 $node = $parentObject->addChild($key);
                                 xmlEncode($value, $node);
                             } else {
                                 $node = $parentObject->addChild($section);
                                 foreach ($value as $k => $v) {
                                     $node->addChild($k, htmldecode($v));
                                 }
                             }
                             break;
                         case is_array($value):
                             $section = $key;
                             xmlEncode($value, $parentObject);
                             break;
                         default:
                             $parentObject->addChild($key, htmldecode($value));
                     }
                 }
             }
             $xmlObject = new SimpleXMLElement('<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/"></rss>');
             xmlEncode($outputValues, $xmlObject);
             echo $xmlObject->asXML();
             break;
         default:
             header('HTTP/1.1 501');
             exit;
     }
 }