WooYun.org

public function info_save()
    {
        $rules = array('name:required:昵称不能为空!','real_name:required:真实姓名不能为空!','sex:int:性别必需选择！','birthday:date:生日日期格式不正确！','mobile:mobi:手机格式不正确','phone:phone:电话格式不正确');
        $info = Validator::check($rules);
        if(is_array($info)){
            $this->redirect("info",false,array('msg'=>array("info",$info['msg'])));
        }else{
            $data = array(
                    'name'=>Filter::str(Req::args('name')),
                    'real_name'=>Filter::str(Req::args('real_name')),
                    'sex'=>Filter::int(Req::args('sex')),
                    'birthday'=>Req::args('birthday'),
                    'mobile'=>Req::args('mobile'),
                    'phone'=>Req::args('phone'),
                    'province'=>Req::args('province'),
                    'city'=>Req::args('city'),
                    'county'=>Req::args('county'),
                    'addr'=>Filter::text(Req::args('addr'))//上面几个参数都没有过滤，直接赋值了，但是Validator::check($rules)函数会队一些参数做验证，看看addr吧，用Filter::text函数过滤了，我们跟一下
                );
        }
        $name = Filter::sql(Req::args("name"));
        $id = $this->user['id'];
        $this->model->table("user")->data(array("name"=>$name))->where("id=$id")->update();
        $this->model->table("customer")->data($data)->where("user_id=$id")->update();
。。。
    }

/**@param $str 字符串
	* @return 字符串
	*@note 处理HTML编辑器的内容，主要是解决JavaScript的注入问题
	*/
	
	public static function text($str)
	{
		$config = HTMLPurifier_Config::createDefault();
	    $cache_dir=Tiny::getPath('cache')."/htmlpurifier/";
		if(!file_exists($cache_dir))
		{
			File::mkdir($cache_dir);
		}
		$config = HTMLPurifier_Config::createDefault();
		//配置 缓存目录
		$config->set('Cache.SerializerPath',$cache_dir); //设置cache目录
			
		//配置 允许flash
		$config->set('HTML.SafeEmbed',true);
		$config->set('HTML.SafeObject',true);
		$config->set('Output.FlashCompat',true);
		//$config->set('HTML.Allowed', 'p');
		//$config->set('AutoFormat.AutoParagraph', true);
		//$config->set('AutoFormat.RemoveEmpty', true);
		//允许<a>的target属性
		$def = $config->getHTMLDefinition(true);
		$def->addAttribute('a', 'target', 'Enum#_blank,_self,_target,_top');
		
		$purifier = new HTMLPurifier($config);
		if (get_magic_quotes_gpc())$str = stripslashes($str);
		$str = $purifier->purify($str);
	    return  $str;
	}