谈CI框架的安全性

PHP 代码

echo form_input('username', 'johndoe');

function form_prep($str = '')
{
    if ($str === '')
    {
        return '';
    }
 
    $temp = '__TEMP_AMPERSANDS__';
 
    // Replace entities to temporary markers so that
    // htmlspecialchars won't mess them up
    $str = preg_replace("/&＃(\d+);/", "$temp\\1;", $str);
    $str = preg_replace("/&(\w+);/", "$temp\\1;", $str);
 
    $str = htmlspecialchars($str);
 
    // In case htmlspecialchars misses these.
    $str = str_replace(array("'", '"'), array("&＃39;", """), $str);
 
    // Decode the temp markers back to entities
    $str = preg_replace("/$temp(\d+);/","&＃\\1;",$str);
    $str = preg_replace("/$temp(\w+);/","&\\1;",$str);
 
    return $str;
}

echo form_input('username', 'johndoe');