PHP security::check_token方法代码示例

 public function upload()
 {
     // security check first
     $token_handler = new security();
     $token_handler->check_token();
     // receives data from input form:
     /*
     *  <form action="upload.php" method="post" enctype="multipart/form-data">
            Select image to upload:
            <input type="file" name="fileToUpload" id="fileToUpload">
            <input type="submit" value="Upload Image" name="submit">
        </form>
     */
     $target_dir = PHOTO_DIR;
     $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
     $uploadOk = 1;
     $imageFileType = pathinfo($target_file, PATHINFO_EXTENSION);
     // actual photo/image ?
     $msg = '';
     if (isset($_POST["submit"])) {
         $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
         if ($check !== false) {
             $msg .= "File is an image - " . $check["mime"] . ".";
             $uploadOk = 1;
         } else {
             $msg .= "File is not an image.";
             $uploadOk = 0;
         }
     }
     // Check if file already exists
     if (file_exists($target_file)) {
         $msg .= "Sorry, file already exists.";
         $uploadOk = 0;
     }
     // Check file size
     if ($_FILES["fileToUpload"]["size"] > 500000) {
         $msg .= "Sorry, your file is too large.";
         $uploadOk = 0;
     }
     // Allow certain file formats
     if ($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif") {
         $msg .= "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
         $uploadOk = 0;
     }
     // Check if $uploadOk is set to 0 by an error
     if ($uploadOk == 0) {
         $msg .= "Sorry, your file was not uploaded.";
         // if everything is ok, try to upload file
     } else {
         if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
             $msg .= "The file " . basename($_FILES["fileToUpload"]["name"]) . " has been uploaded.";
         } else {
             $msg .= "Sorry, there was an error uploading your file.";
         }
     }
     $result = array('message' => $msg, 'ok' => $uploadOk);
     return $result;
 }

 public function reset()
 {
     $token_handler = new security();
     $token_handler->check_token();
     $content = '';
     // resets users password
     // sends an email containing a link + token with 6h validity
     // from this link, access this same method, but with confirm=yes in url
     if (isset($_GET['confirm'])) {
         if ($_GET['confirm'] == 'yes') {
             // check token with database
             // will arrive here from user's mail - show form to enter new password and UPDATE it in the database
         }
     } else {
         // send email to user with link to reset, redirecting here
         // ?controller=users&action=reset&confirm=yes&token=ETC
         // 1st, check if user + email exist in database
         $connection = new database();
         $sql = "SELECT username, email FROM users WHERE username=?";
         $data[] = $_POST['username'];
         $user_results = $connection->fetchAll($sql, $data);
         if ($connection->row_count = 1) {
             // ok, found one user with this username
             // but, does he/she has an email?
             if ($_POST['email'] != '') {
                 if ($user_results[0]['email'] == $_POST['email']) {
                     // send email with proper link to reset password
                     $content .= "<p>Dear {$_POST['username']}, an email was sent to {$_POST['email']} with instructions on how to reset your password.";
                     $content .= "<p>It should arrive momentarily; if not, check your spam box or contact the administrator.";
                     // TODO: send email to reset password.
                     // Contains a link with a token that redirects to a special page - this only confirms that user has acces to the concerned email
                 } else {
                     $content .= "<p>Email not found or invalid. Please, try again.";
                     $content .= "<p>Contact the administrator if you think you do not have a registered email.";
                 }
             } else {
                 $content .= "<p>Email is obligatory. Please, try again.";
             }
         } else {
             $content .= "User not found. Please, try again!";
         }
     }
     $output['page'] = 'views/forgot.php';
     $output['content'] = $content;
     return $output;
 }

 public function update()
 {
     /* UPDATE multiple tables:
             //  UPDATE tables SET table1.col1=table2.col2
             //  WHERE condition;
     
             // needs:
             //      1. column names - $this->cols
             //      2. table name   - $this->table_name
             //      3. id           - $_GET['id'] from action form
             example:
             $sql = " UPDATE {$this->table_name} SET
                     nom=?, prenom=?, nom_khmer=?, prenom_khmer=?, sex_id=?, matricule=?, dob=?, program_id=?
                     WHERE student_id=?";
             /********************************************/
     $security_handler = new security();
     $security_handler->check_token();
     $id = $_GET['id'];
     $i = 0;
     $cols = '';
     $values = array();
     foreach ($this->cols as $column) {
         array_push($values, $_POST[$column]);
         $cols .= $column . '=?,';
         $i++;
     }
     array_push($values, $id);
     // add last value to the array, which corresponds to the record id number.
     $cols = substr($cols, 0, -1);
     $sql = "UPDATE " . $this->table_name . " SET " . $cols . " WHERE " . $this->id_column . "=?";
     //echo "<p>sql: ".$sql."<br>";
     //echo "<p>values: ";
     //var_dump ($values);
     $connection = new database();
     if ($connection->update($sql, $values)) {
         $_SESSION['log'] .= new timestamp("Affected rows: " . $connection->get_row_num());
     } else {
         $_SESSION['log'] .= new timestamp("Record was not updated in {$_GET['controller']}!");
     }
     //die();
 }