php函数的参数的过滤方法,php过滤字符函数的几种方法代码

该楼层疑似违规已被系统折叠 隐藏此楼查看此楼

+----------------------------------------------------------

*/

static public function safeHtml($text, $tags = null)

{

$text = trim($text);

//完全过滤注释

$text = preg_replace('//','',$text);

//完全过滤动态代码

$text = preg_replace('//','',$text);

//完全过滤js

$text = preg_replace('/

$text = str_replace('[','[',$text);

$text = str_replace(']',']',$text);

$text = str_replace('|','|',$text);

//过滤换行符

$text = preg_replace('/\r?\n/','',$text);

//br

$text = preg_replace('/
/i','

',$text);

$text = preg_replace('/(\
\s*){10,}/i','

',$text);

//过滤危险的属性，如：过滤on事件lang js

while(preg_match('/(<[^><]+)(lang|on|action|background|codebase|dynsrc|lowsrc)[^><]+/i',$text,$mat)){

$text=str_replace($mat[0],$mat[1],$text);

}

while(preg_match('/(<[^><]+)(window\.|javascript:|js:|about:|file:|document\.|vbs:|cookie)([^><]*)/i',$text,$mat)){

$text=str_replace($mat[0],$mat[1].$mat[3],$text);

}

if( empty($allowTags) ) { $allowTags = self::$htmlTags['allow']; }

//允许的HTML标签

$text = preg_replace('/<('.$allowTags.')( [^><\[\]]*)>/i','[\1\2]',$text);

//过滤多余html

if ( empty($banTag) ) { $banTag = self::$htmlTags['ban']; }

$text = preg_replace('/<\/?('.$banTag.')[^><]*>/i','',$text);

//过滤合法的html标签

while(preg_match('/<([a-z]+)[^><\[\]]*>[^><]*<\/\1>/i',$text,$mat)){

$text=str_replace($mat[0],str_replace('>',']',str_replace('<','[',$mat[0])),$text);

}

//转换引号

while(preg_match('/(\[[^\[\]]*=\s*)(\"|\')([^\2=\[\]]+)\2([^\[\]]*\])/i',$text,$mat)){

$text=str_replace($mat[0],$mat[1].'|'.$mat[3].'|'.$mat[4],$text);

}

//空属性转换

$text = str_replace('\'\'','||',$text);

$text = str_replace('""','||',$text);

//过滤错误的单个引号

while(preg_match('/\[[^\[\]]*(\"|\')[^\[\]]*\]/i',$text,$mat)){

$text=str_replace($mat[0],str_replace($mat[1],'',$mat[0]),$text);

}

//转换其它所有不合法的 < >

$text = str_replace('<','<',$text);

$text = str_replace('>','>',$text);

$text = str_replace('"','"',$text);

//反转换

$text = str_replace('[','<',$text);

$text = str_replace(']','>',$text);

$text = str_replace('|','"',$text);

//过滤多余空格

$text = str_replace(' ',' ',$text);

return $text;

}

?>\>