dedecms联动筛选_织梦DEDE分类信息实现联动筛选(支持多条件多级选项)解决方案...

博客内容涉及到PHP中的一个函数wwwcms_filter(),该函数用于字符过滤,针对SQL注入和XSS攻击提供了防护。同时,文章提到了AddFilter()函数,该函数用于动态加载自定义表单,并根据筛选条件生成筛选选项。整个过程涉及到URL参数处理、正则表达式以及表单元素的生成。
摘要由CSDN通过智能技术生成

}

第二步:打开extend.func.php文件在底部加入以下代码:

/*联动筛选字符过滤函数*/

function wwwcms_filter($str,$stype="inject") {

if ($stype=="inject")  {

$str = str_replace(

array( "select", "insert", "update", "delete", "alter",

"cas", "union", "into", "load_file", "outfile", "create", "join",

"where", "like", "drop", "modify", "rename", "'", "/*", "*", "../",

"./"),

array("","","","","","","","","","","","","","","","","","","","","",""),

$str);

} else if ($stype=="xss") {

$farr = array("/\s+/" ,

"/

|i?frame|b|strong|style|html|img|P|o:p|iframe|u

|em|strike|BR|div|a|TABLE|TBODY|object|tr|td

|st1:chsdate|FONT|span|MARQUEE|body|title |\r\n|link

|meta|\?|\%)([^>]*?)>/isU",

"/(]*)on[a-zA-Z]+\s*=([^>]*>)/isU",

);

$tarr = array(" ",

"",

"\\1\\2",

);

$str = preg_replace($farr, $tarr, $str);

$str = str_replace(

array( "", "'", "\"", ";", "/*", "*", "../", "./"),

array("<",">","","","","","","",""),

$str);

}

return $str;

}

/**

*  载入自定义表单(用于发布)

*

* @access    public

* @param     string  $fieldset  字段列表

* @param     string  $loadtype  载入类型

* @return    string

*/

function AddFilter($channelid, $type=1, $fieldsnamef, $defaulttid, $loadtype='autofield')

{

global $tid,$dsql,$id;

$tid = $defaulttid ? $defaulttid : $tid;

if ($id!="")

{

$tidsq = $dsql->GetOne(" Select typeid From `dede_archives` where id='$id' ");

$tid = $tidsq["typeid"];

}

$nofilter = (isset($_REQUEST['TotalResult']) ?

"&TotalResult=".$_REQUEST['TotalResult'] :

'').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] :

'');

$filterarr = wwwcms_filter(stripos($_SERVER['REQUEST_URI'],

"list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) :

$GLOBALS['cfg_cmsurl']."/plus/list.php?tid=".$tid);

$cInfos = $dsql->GetOne(" Select * From  `dede_channeltype` where id='$channelid' ");

$fieldset=$cInfos['fieldset'];

$dtp = new DedeTagParse();

$dtp->SetNameSpace('field','');

$dtp->LoadSource($fieldset);

$dede_addonfields = '';

if(is_array($dtp->CTags))

{

foreach($dtp->CTags as $tid=>$ctag)

{

$fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName());

if(($loadtype!='autofield' || ($loadtype=='autofield' &&

$ctag->GetAtt('autofield')==1)) &&

in_array($ctag->GetName(), $fieldsname) )

{

$href1 = explode($ctag->GetName().'=', $filterarr);

$href2 = explode('&', $href1[1]);

$fields_value = $href2[0];

$dede_addonfields .= '

'.$ctag->GetAtt('itemname').':
';

switch ($type) {

case 1:

$dede_addonfields .=

(preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ?

'

href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部

'

: '

全部').'';

$addonfields_items = explode(",",$ctag->GetAtt('default'));

for ($i=0; $i

{

$href = stripos($filterarr,$ctag->GetName().'=') ?

str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr)

:

$filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);//echo

$href;

$dede_addonfields .=

($fields_value!=urlencode($addonfields_items[$i]) ? '

title="'.$addonfields_items[$i].'"

href="'.$href.'">'.$addonfields_items[$i].'

' : '

class="on">'.$addonfields_items[$i].'

');

}

$dede_addonfields .= '

';

break;

case 2:

$dede_addonfields .= '

name="filter"'.$ctag->GetName().'

οnchange="window.location=this.options[this.selectedIndex].value">

'.'

value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部

';

$addonfields_items = explode(",",$ctag->GetAtt('default'));

for ($i=0; $i

{

$href = stripos($filterarr,$ctag->GetName().'=') ?

str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr)

:

$filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);

$dede_addonfields .= '

value="'.$href.'"'.($fields_value==urlencode($addonfields_items[$i]) ? '

selected="selected"' :

'').'>'.$addonfields_items[$i].'

';

}

$dede_addonfields .= '

';

break;

}

}

}

}

echo $dede_addonfields;

}

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值