global.func.php 37 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208
  1. <?php
  2. /**
  3. * [WeEngine System] Copyright (c) 2014 WE7.CC
  4. * WeEngine is NOT a free software, it under the license terms, visited http://www.we7.cc/ for more details.
  5. */
  6. defined('IN_IA') or exit('Access Denied');
  7. function ver_compare($version1, $version2) {
  8. $version1 = str_replace('.', '', $version1);
  9. $version2 = str_replace('.', '', $version2);
  10. $oldLength = istrlen($version1);
  11. $newLength = istrlen($version2);
  12. if(is_numeric($version1) && is_numeric($version2)) {
  13. if ($oldLength > $newLength) {
  14. $version2 .= str_repeat('0', $oldLength - $newLength);
  15. }
  16. if ($newLength > $oldLength) {
  17. $version1 .= str_repeat('0', $newLength - $oldLength);
  18. }
  19. $version1 = intval($version1);
  20. $version2 = intval($version2);
  21. }
  22. return version_compare($version1, $version2);
  23. }
  24. function istripslashes($var) {
  25. if (is_array($var)) {
  26. foreach ($var as $key => $value) {
  27. $var[stripslashes($key)] = istripslashes($value);
  28. }
  29. } else {
  30. $var = stripslashes($var);
  31. }
  32. return $var;
  33. }
  34. function ihtmlspecialchars($var) {
  35. if (is_array($var)) {
  36. foreach ($var as $key => $value) {
  37. $var[htmlspecialchars($key)] = ihtmlspecialchars($value);
  38. }
  39. } else {
  40. $var = str_replace('&amp;', '&', htmlspecialchars($var, ENT_QUOTES));
  41. }
  42. return $var;
  43. }
  44. function isetcookie($key, $value, $expire = 0, $httponly = false) {
  45. global $_W;
  46. $expire = $expire != 0 ? (TIMESTAMP + $expire) : 0;
  47. $secure = $_SERVER['SERVER_PORT'] == 443 ? 1 : 0;
  48. return setcookie($_W['config']['cookie']['pre'] . $key, $value, $expire, $_W['config']['cookie']['path'], $_W['config']['cookie']['domain'], $secure, $httponly);
  49. }
  50. function getip() {
  51. static $ip = '';
  52. $ip = $_SERVER['REMOTE_ADDR'];
  53. if(isset($_SERVER['HTTP_CDN_SRC_IP'])) {
  54. $ip = $_SERVER['HTTP_CDN_SRC_IP'];
  55. } elseif (isset($_SERVER['HTTP_CLIENT_IP'])) {
  56. $ip = $_SERVER['HTTP_CLIENT_IP'];
  57. } elseif(isset($_SERVER['HTTP_X_FORWARDED_FOR']) && preg_match_all('#\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}#s', $_SERVER['HTTP_X_FORWARDED_FOR'], $matches)) {
  58. foreach ($matches[0] AS $xip) {
  59. if (!preg_match('#^(10|172\.16|192\.168)\.#', $xip)) {
  60. $ip = $xip;
  61. break;
  62. }
  63. }
  64. }
  65. if (preg_match('/^([0-9]{1,3}\.){3}[0-9]{1,3}$/', $ip)) {
  66. return $ip;
  67. } else {
  68. return '127.0.0.1';
  69. }
  70. }
  71. function token($specialadd = '') {
  72. global $_W;
  73. if(!defined('IN_MOBILE')) {
  74. return substr(md5($_W['config']['setting']['authkey'] . $specialadd), 8, 8);
  75. } else {
  76. if(!empty($_SESSION['token'])) {
  77. $count = count($_SESSION['token']) - 5;
  78. asort($_SESSION['token']);
  79. foreach($_SESSION['token'] as $k => $v) {
  80. if(TIMESTAMP - $v > 300 || $count > 0) {
  81. unset($_SESSION['token'][$k]);
  82. $count--;
  83. }
  84. }
  85. }
  86. $key = substr(random(20), 0, 4);
  87. $_SESSION['token'][$key] = TIMESTAMP;
  88. return $key;
  89. }
  90. }
  91. function random($length, $numeric = FALSE) {
  92. $seed = base_convert(md5(microtime() . $_SERVER['DOCUMENT_ROOT']), 16, $numeric ? 10 : 35);
  93. $seed = $numeric ? (str_replace('0', '', $seed) . '012340567890') : ($seed . 'zZ' . strtoupper($seed));
  94. if ($numeric) {
  95. $hash = '';
  96. } else {
  97. $hash = chr(rand(1, 26) + rand(0, 1) * 32 + 64);
  98. $length--;
  99. }
  100. $max = strlen($seed) - 1;
  101. for ($i = 0; $i < $length; $i++) {
  102. $hash .= $seed{mt_rand(0, $max)};
  103. }
  104. return $hash;
  105. }
  106. function checksubmit($var = 'submit', $allowget = false) {
  107. global $_W, $_GPC;
  108. if (empty($_GPC[$var])) {
  109. return FALSE;
  110. }
  111. if(defined('IN_SYS')) {
  112. if ($allowget || (($_W['ispost'] && !empty($_W['token']) && $_W['token'] == $_GPC['token']) && (empty($_SERVER['HTTP_REFERER']) || preg_replace("/https?:\/\/([^\:\/]+).*/i", "\\1", $_SERVER['HTTP_REFERER']) == preg_replace("/([^\:]+).*/", "\\1", $_SERVER['HTTP_HOST'])))) {
  113. return TRUE;
  114. }
  115. } else {
  116. if(empty($_W['isajax']) && empty($_SESSION['token'][$_GPC['token']])) {
  117. exit("<script type=\"text/javascript\">history.go(-1);</script>");
  118. } else {
  119. unset($_SESSION['token'][$_GPC['token']]);
  120. }
  121. return TRUE;
  122. }
  123. return FALSE;
  124. }
  125. function checkcaptcha($code) {
  126. global $_W, $_GPC;
  127. session_start();
  128. $codehash = md5(strtolower($code) . $_W['config']['setting']['authkey']);
  129. if (!empty($_GPC['__code']) && $codehash == $_SESSION['__code']) {
  130. $return = true;
  131. } else {
  132. $return = false;
  133. }
  134. $_SESSION['__code'] = '';
  135. isetcookie('__code', '');
  136. return $return;
  137. }
  138. function tablename($table) {
  139. if(empty($GLOBALS['_W']['config']['db']['master'])) {
  140. return "`{$GLOBALS['_W']['config']['db']['tablepre']}{$table}`";
  141. }
  142. return "`{$GLOBALS['_W']['config']['db']['master']['tablepre']}{$table}`";
  143. }
  144. function array_elements($keys, $src, $default = FALSE) {
  145. $return = array();
  146. if(!is_array($keys)) {
  147. $keys = array($keys);
  148. }
  149. foreach($keys as $key) {
  150. if(isset($src[$key])) {
  151. $return[$key] = $src[$key];
  152. } else {
  153. $return[$key] = $default;
  154. }
  155. }
  156. return $return;
  157. }
  158. function iarray_sort($array, $keys, $type='asc'){
  159. $keysvalue = $new_array = array();
  160. foreach ($array as $k => $v){
  161. $keysvalue[$k] = $v[$keys];
  162. }
  163. if($type == 'asc'){
  164. asort($keysvalue);
  165. }else{
  166. arsort($keysvalue);
  167. }
  168. reset($keysvalue);
  169. foreach ($keysvalue as $k => $v){
  170. $new_array[$k] = $array[$k];
  171. }
  172. return $new_array;
  173. }
  174. function range_limit($num, $downline, $upline, $returnNear = true) {
  175. $num = intval($num);
  176. $downline = intval($downline);
  177. $upline = intval($upline);
  178. if($num < $downline){
  179. return empty($returnNear) ? false : $downline;
  180. } elseif ($num > $upline) {
  181. return empty($returnNear) ? false : $upline;
  182. } else {
  183. return empty($returnNear) ? true : $num;
  184. }
  185. }
  186. function ijson_encode($value, $options = 0) {
  187. if (empty($value)) {
  188. return false;
  189. }
  190. if (version_compare(PHP_VERSION, '5.4.0', '<') && $options == JSON_UNESCAPED_UNICODE) {
  191. $str = json_encode($value);
  192. $json_str = preg_replace_callback("#\\\u([0-9a-f]{4})#i", function($matchs){
  193. return iconv('UCS-2BE', 'UTF-8', pack('H4', $matchs[1]));
  194. }, $str);
  195. } else {
  196. $json_str = json_encode($value, $options);
  197. }
  198. return addslashes($json_str);
  199. }
  200. function iserializer($value) {
  201. return serialize($value);
  202. }
  203. function iunserializer($value) {
  204. if (empty($value)) {
  205. return array();
  206. }
  207. if (!is_serialized($value)) {
  208. return $value;
  209. }
  210. $result = unserialize($value);
  211. if ($result === false) {
  212. $temp = preg_replace_callback('!s:(\d+):"(.*?)";!s', function ($matchs){
  213. return 's:'.strlen($matchs[2]).':"'.$matchs[2].'";';
  214. }, $value);
  215. return unserialize($temp);
  216. } else {
  217. return $result;
  218. }
  219. }
  220. function is_base64($str){
  221. if(!is_string($str)){
  222. return false;
  223. }
  224. return $str == base64_encode(base64_decode($str));
  225. }
  226. function is_serialized($data, $strict = true) {
  227. if (!is_string($data)) {
  228. return false;
  229. }
  230. $data = trim($data);
  231. if ('N;' == $data) {
  232. return true;
  233. }
  234. if (strlen($data) < 4) {
  235. return false;
  236. }
  237. if (':' !== $data[1]) {
  238. return false;
  239. }
  240. if ($strict) {
  241. $lastc = substr($data, -1);
  242. if (';' !== $lastc && '}' !== $lastc) {
  243. return false;
  244. }
  245. } else {
  246. $semicolon = strpos($data, ';');
  247. $brace = strpos($data, '}');
  248. if (false === $semicolon && false === $brace)
  249. return false;
  250. if (false !== $semicolon && $semicolon < 3)
  251. return false;
  252. if (false !== $brace && $brace < 4)
  253. return false;
  254. }
  255. $token = $data[0];
  256. switch ($token) {
  257. case 's' :
  258. if ($strict) {
  259. if ('"' !== substr($data, -2, 1)) {
  260. return false;
  261. }
  262. } elseif (false === strpos($data, '"')) {
  263. return false;
  264. }
  265. case 'a' :
  266. case 'O' :
  267. return (bool)preg_match("/^{$token}:[0-9]+:/s", $data);
  268. case 'b' :
  269. case 'i' :
  270. case 'd' :
  271. $end = $strict ? '$' : '';
  272. return (bool)preg_match("/^{$token}:[0-9.E-]+;$end/", $data);
  273. }
  274. return false;
  275. }
  276. function wurl($segment, $params = array()) {
  277. list($controller, $action, $do) = explode('/', $segment);
  278. $url = './index.php?';
  279. if (!empty($controller)) {
  280. $url .= "c={$controller}&";
  281. }
  282. if (!empty($action)) {
  283. $url .= "a={$action}&";
  284. }
  285. if (!empty($do)) {
  286. $url .= "do={$do}&";
  287. }
  288. if (!empty($params)) {
  289. $queryString = http_build_query($params, '', '&');
  290. $url .= $queryString;
  291. }
  292. return $url;
  293. }
  294. if (!function_exists('murl')) {
  295. function murl($segment, $params = array(), $noredirect = true, $addhost = false) {
  296. global $_W;
  297. list($controller, $action, $do) = explode('/', $segment);
  298. if (!empty($addhost)) {
  299. $url = $_W['siteroot'] . 'app/';
  300. } else {
  301. $url = './';
  302. }
  303. $str = '';
  304. if(uni_is_multi_acid()) {
  305. $str .= "&j={$_W['acid']}";
  306. }
  307. if (!empty($_W['account']) && $_W['account']['type'] == ACCOUNT_TYPE_WEBAPP_NORMAL) {
  308. $str .= '&a=webapp';
  309. }
  310. if (!empty($_W['account']) && $_W['account']['type'] == ACCOUNT_TYPE_PHONEAPP_NORMAL) {
  311. $str .= '&a=phoneapp';
  312. }
  313. $url .= "index.php?i={$_W['uniacid']}{$str}&";
  314. if (!empty($controller)) {
  315. $url .= "c={$controller}&";
  316. }
  317. if (!empty($action)) {
  318. $url .= "a={$action}&";
  319. }
  320. if (!empty($do)) {
  321. $url .= "do={$do}&";
  322. }
  323. if (!empty($params)) {
  324. $queryString = http_build_query($params, '', '&');
  325. $url .= $queryString;
  326. if ($noredirect === false) {
  327. $url .= '&wxref=mp.weixin.qq.com#wechat_redirect';
  328. }
  329. }
  330. return $url;
  331. }
  332. }
  333. function pagination($total, $pageIndex, $pageSize = 15, $url = '', $context = array('before' => 5, 'after' => 4, 'ajaxcallback' => '', 'callbackfuncname' => '')) {
  334. global $_W;
  335. $pdata = array(
  336. 'tcount' => 0,
  337. 'tpage' => 0,
  338. 'cindex' => 0,
  339. 'findex' => 0,
  340. 'pindex' => 0,
  341. 'nindex' => 0,
  342. 'lindex' => 0,
  343. 'options' => ''
  344. );
  345. if ($context['ajaxcallback']) {
  346. $context['isajax'] = true;
  347. }
  348. if ($context['callbackfuncname']) {
  349. $callbackfunc = $context['callbackfuncname'];
  350. }
  351. $pdata['tcount'] = $total;
  352. $pdata['tpage'] = (empty($pageSize) || $pageSize < 0) ? 1 : ceil($total / $pageSize);
  353. if ($pdata['tpage'] <= 1) {
  354. return '';
  355. }
  356. $cindex = $pageIndex;
  357. $cindex = min($cindex, $pdata['tpage']);
  358. $cindex = max($cindex, 1);
  359. $pdata['cindex'] = $cindex;
  360. $pdata['findex'] = 1;
  361. $pdata['pindex'] = $cindex > 1 ? $cindex - 1 : 1;
  362. $pdata['nindex'] = $cindex < $pdata['tpage'] ? $cindex + 1 : $pdata['tpage'];
  363. $pdata['lindex'] = $pdata['tpage'];
  364. if ($context['isajax']) {
  365. if (empty($url)) {
  366. $url = $_W['script_name'] . '?' . http_build_query($_GET);
  367. }
  368. $pdata['faa'] = 'href="javascript:;" page="' . $pdata['findex'] . '" '. ($callbackfunc ? 'onclick="'.$callbackfunc.'(\'' . $url . '\', \'' . $pdata['findex'] . '\', this);return false;"' : '');
  369. $pdata['paa'] = 'href="javascript:;" page="' . $pdata['pindex'] . '" '. ($callbackfunc ? 'onclick="'.$callbackfunc.'(\'' . $url . '\', \'' . $pdata['pindex'] . '\', this);return false;"' : '');
  370. $pdata['naa'] = 'href="javascript:;" page="' . $pdata['nindex'] . '" '. ($callbackfunc ? 'onclick="'.$callbackfunc.'(\'' . $url . '\', \'' . $pdata['nindex'] . '\', this);return false;"' : '');
  371. $pdata['laa'] = 'href="javascript:;" page="' . $pdata['lindex'] . '" '. ($callbackfunc ? 'onclick="'.$callbackfunc.'(\'' . $url . '\', \'' . $pdata['lindex'] . '\', this);return false;"' : '');
  372. } else {
  373. if ($url) {
  374. $pdata['faa'] = 'href="?' . str_replace('*', $pdata['findex'], $url) . '"';
  375. $pdata['paa'] = 'href="?' . str_replace('*', $pdata['pindex'], $url) . '"';
  376. $pdata['naa'] = 'href="?' . str_replace('*', $pdata['nindex'], $url) . '"';
  377. $pdata['laa'] = 'href="?' . str_replace('*', $pdata['lindex'], $url) . '"';
  378. } else {
  379. $_GET['page'] = $pdata['findex'];
  380. $pdata['faa'] = 'href="' . $_W['script_name'] . '?' . http_build_query($_GET) . '"';
  381. $_GET['page'] = $pdata['pindex'];
  382. $pdata['paa'] = 'href="' . $_W['script_name'] . '?' . http_build_query($_GET) . '"';
  383. $_GET['page'] = $pdata['nindex'];
  384. $pdata['naa'] = 'href="' . $_W['script_name'] . '?' . http_build_query($_GET) . '"';
  385. $_GET['page'] = $pdata['lindex'];
  386. $pdata['laa'] = 'href="' . $_W['script_name'] . '?' . http_build_query($_GET) . '"';
  387. }
  388. }
  389. $html = '<div><ul class="pagination pagination-centered">';
  390. if ($pdata['cindex'] > 1) {
  391. $html .= "<li><a {$pdata['faa']} class=\"pager-nav\">首页</a></li>";
  392. $html .= "<li><a {$pdata['paa']} class=\"pager-nav\">&laquo;上一页</a></li>";
  393. }
  394. if (!$context['before'] && $context['before'] != 0) {
  395. $context['before'] = 5;
  396. }
  397. if (!$context['after'] && $context['after'] != 0) {
  398. $context['after'] = 4;
  399. }
  400. if ($context['after'] != 0 && $context['before'] != 0) {
  401. $range = array();
  402. $range['start'] = max(1, $pdata['cindex'] - $context['before']);
  403. $range['end'] = min($pdata['tpage'], $pdata['cindex'] + $context['after']);
  404. if ($range['end'] - $range['start'] < $context['before'] + $context['after']) {
  405. $range['end'] = min($pdata['tpage'], $range['start'] + $context['before'] + $context['after']);
  406. $range['start'] = max(1, $range['end'] - $context['before'] - $context['after']);
  407. }
  408. for ($i = $range['start']; $i <= $range['end']; $i++) {
  409. if ($context['isajax']) {
  410. $aa = 'href="javascript:;" page="' . $i . '" '. ($callbackfunc ? 'onclick="'.$callbackfunc.'(\'' . $url . '\', \'' . $i . '\', this);return false;"' : '');
  411. } else {
  412. if ($url) {
  413. $aa = 'href="?' . str_replace('*', $i, $url) . '"';
  414. } else {
  415. $_GET['page'] = $i;
  416. $aa = 'href="?' . http_build_query($_GET) . '"';
  417. }
  418. }
  419. $html .= ($i == $pdata['cindex'] ? '<li class="active"><a href="javascript:;">' . $i . '</a></li>' : "<li><a {$aa}>" . $i . '</a></li>');
  420. }
  421. }
  422. if ($pdata['cindex'] < $pdata['tpage']) {
  423. $html .= "<li><a {$pdata['naa']} class=\"pager-nav\">下一页&raquo;</a></li>";
  424. $html .= "<li><a {$pdata['laa']} class=\"pager-nav\">尾页</a></li>";
  425. }
  426. $html .= '</ul></div>';
  427. return $html;
  428. }
  429. function tomedia($src, $local_path = false){
  430. global $_W;
  431. if (empty($src)) {
  432. return '';
  433. }
  434. if (strexists($src, "c=utility&a=wxcode&do=image&attach=")) {
  435. return $src;
  436. }
  437. if (strexists($src, 'addons/')) {
  438. return $_W['siteroot'] . substr($src, strpos($src, 'addons/'));
  439. }
  440. if (strexists($src, $_W['siteroot']) && !strexists($src, '/addons/')) {
  441. $urls = parse_url($src);
  442. $src = $t = substr($urls['path'], strpos($urls['path'], 'images'));
  443. }
  444. $t = strtolower($src);
  445. if (strexists($t, 'https://mmbiz.qlogo.cn') || strexists($t, 'http://mmbiz.qpic.cn')) {
  446. $url = url('utility/wxcode/image', array('attach' => $src));
  447. return $_W['siteroot'] . 'web' . ltrim($url, '.');
  448. }
  449. if ((substr($t, 0, 7) == 'http://') || (substr($t, 0, 8) == 'https://') || (substr($t, 0, 2) == '//')) {
  450. return $src;
  451. }
  452. if ($local_path || empty($_W['setting']['remote']['type']) || file_exists(IA_ROOT . '/' . $_W['config']['upload']['attachdir'] . '/' . $src)) {
  453. $src = $_W['siteroot'] . $_W['config']['upload']['attachdir'] . '/' . $src;
  454. } else {
  455. $src = $_W['attachurl_remote'] . $src;
  456. }
  457. return $src;
  458. }
  459. function error($errno, $message = '') {
  460. return array(
  461. 'errno' => $errno,
  462. 'message' => $message,
  463. );
  464. }
  465. function is_error($data) {
  466. if (empty($data) || !is_array($data) || !array_key_exists('errno', $data) || (array_key_exists('errno', $data) && $data['errno'] == 0)) {
  467. return false;
  468. } else {
  469. return true;
  470. }
  471. }
  472. function detect_sensitive_word($string) {
  473. $setting = setting_load('sensitive_words');
  474. if (empty($setting['sensitive_words'])) {
  475. return false;
  476. }
  477. $sensitive_words = $setting['sensitive_words'];
  478. $blacklist="/".implode("|",$sensitive_words)."/";
  479. if(preg_match($blacklist, $string, $matches)){
  480. return $matches[0];
  481. }
  482. return false;
  483. }
  484. function referer($default = '') {
  485. global $_GPC, $_W;
  486. $_W['referer'] = !empty($_GPC['referer']) ? $_GPC['referer'] : $_SERVER['HTTP_REFERER'];;
  487. $_W['referer'] = substr($_W['referer'], -1) == '?' ? substr($_W['referer'], 0, -1) : $_W['referer'];
  488. if (strpos($_W['referer'], 'member.php?act=login')) {
  489. $_W['referer'] = $default;
  490. }
  491. $_W['referer'] = $_W['referer'];
  492. $_W['referer'] = str_replace('&amp;', '&', $_W['referer']);
  493. $reurl = parse_url($_W['referer']);
  494. if (!empty($reurl['host']) && !in_array($reurl['host'], array($_SERVER['HTTP_HOST'], 'www.' . $_SERVER['HTTP_HOST'])) && !in_array($_SERVER['HTTP_HOST'], array($reurl['host'], 'www.' . $reurl['host']))) {
  495. $_W['referer'] = $_W['siteroot'];
  496. } elseif (empty($reurl['host'])) {
  497. $_W['referer'] = $_W['siteroot'] . './' . $_W['referer'];
  498. }
  499. return strip_tags($_W['referer']);
  500. }
  501. function strexists($string, $find) {
  502. return !(strpos($string, $find) === FALSE);
  503. }
  504. function cutstr($string, $length, $havedot = false, $charset = '') {
  505. global $_W;
  506. if (empty($charset)) {
  507. $charset = $_W['charset'];
  508. }
  509. if (strtolower($charset) == 'gbk') {
  510. $charset = 'gbk';
  511. } else {
  512. $charset = 'utf8';
  513. }
  514. if (istrlen($string, $charset) <= $length) {
  515. return $string;
  516. }
  517. if (function_exists('mb_strcut')) {
  518. $string = mb_substr($string, 0, $length, $charset);
  519. } else {
  520. $pre = '{%';
  521. $end = '%}';
  522. $string = str_replace(array('&amp;', '&quot;', '&lt;', '&gt;'), array($pre . '&' . $end, $pre . '"' . $end, $pre . '<' . $end, $pre . '>' . $end), $string);
  523. $strcut = '';
  524. $strlen = strlen($string);
  525. if ($charset == 'utf8') {
  526. $n = $tn = $noc = 0;
  527. while ($n < $strlen) {
  528. $t = ord($string[$n]);
  529. if ($t == 9 || $t == 10 || (32 <= $t && $t <= 126)) {
  530. $tn = 1;
  531. $n++;
  532. $noc++;
  533. } elseif (194 <= $t && $t <= 223) {
  534. $tn = 2;
  535. $n += 2;
  536. $noc++;
  537. } elseif (224 <= $t && $t <= 239) {
  538. $tn = 3;
  539. $n += 3;
  540. $noc++;
  541. } elseif (240 <= $t && $t <= 247) {
  542. $tn = 4;
  543. $n += 4;
  544. $noc++;
  545. } elseif (248 <= $t && $t <= 251) {
  546. $tn = 5;
  547. $n += 5;
  548. $noc++;
  549. } elseif ($t == 252 || $t == 253) {
  550. $tn = 6;
  551. $n += 6;
  552. $noc++;
  553. } else {
  554. $n++;
  555. }
  556. if ($noc >= $length) {
  557. break;
  558. }
  559. }
  560. if ($noc > $length) {
  561. $n -= $tn;
  562. }
  563. $strcut = substr($string, 0, $n);
  564. } else {
  565. while ($n < $strlen) {
  566. $t = ord($string[$n]);
  567. if ($t > 127) {
  568. $tn = 2;
  569. $n += 2;
  570. $noc++;
  571. } else {
  572. $tn = 1;
  573. $n++;
  574. $noc++;
  575. }
  576. if ($noc >= $length) {
  577. break;
  578. }
  579. }
  580. if ($noc > $length) {
  581. $n -= $tn;
  582. }
  583. $strcut = substr($string, 0, $n);
  584. }
  585. $string = str_replace(array($pre . '&' . $end, $pre . '"' . $end, $pre . '<' . $end, $pre . '>' . $end), array('&amp;', '&quot;', '&lt;', '&gt;'), $strcut);
  586. }
  587. if ($havedot) {
  588. $string = $string . "...";
  589. }
  590. return $string;
  591. }
  592. function istrlen($string, $charset = '') {
  593. global $_W;
  594. if (empty($charset)) {
  595. $charset = $_W['charset'];
  596. }
  597. if (strtolower($charset) == 'gbk') {
  598. $charset = 'gbk';
  599. } else {
  600. $charset = 'utf8';
  601. }
  602. if (function_exists('mb_strlen') && extension_loaded('mbstring')) {
  603. return mb_strlen($string, $charset);
  604. } else {
  605. $n = $noc = 0;
  606. $strlen = strlen($string);
  607. if ($charset == 'utf8') {
  608. while ($n < $strlen) {
  609. $t = ord($string[$n]);
  610. if ($t == 9 || $t == 10 || (32 <= $t && $t <= 126)) {
  611. $n++;
  612. $noc++;
  613. } elseif (194 <= $t && $t <= 223) {
  614. $n += 2;
  615. $noc++;
  616. } elseif (224 <= $t && $t <= 239) {
  617. $n += 3;
  618. $noc++;
  619. } elseif (240 <= $t && $t <= 247) {
  620. $n += 4;
  621. $noc++;
  622. } elseif (248 <= $t && $t <= 251) {
  623. $n += 5;
  624. $noc++;
  625. } elseif ($t == 252 || $t == 253) {
  626. $n += 6;
  627. $noc++;
  628. } else {
  629. $n++;
  630. }
  631. }
  632. } else {
  633. while ($n < $strlen) {
  634. $t = ord($string[$n]);
  635. if ($t > 127) {
  636. $n += 2;
  637. $noc++;
  638. } else {
  639. $n++;
  640. $noc++;
  641. }
  642. }
  643. }
  644. return $noc;
  645. }
  646. }
  647. function emotion($message = '', $size = '24px') {
  648. $emotions = array(
  649. "/::)","/::~","/::B","/::|","/:8-)","/::<","/::$","/::X","/::Z","/::'(",
  650. "/::-|","/::@","/::P","/::D","/::O","/::(","/::+","/:--b","/::Q","/::T",
  651. "/:,@P","/:,@-D","/::d","/:,@o","/::g","/:|-)","/::!","/::L","/::>","/::,@",
  652. "/:,@f","/::-S","/:?","/:,@x","/:,@@","/::8","/:,@!","/:!!!","/:xx","/:bye",
  653. "/:wipe","/:dig","/:handclap","/:&-(","/:B-)","/:<@","/:@>","/::-O","/:>-|",
  654. "/:P-(","/::'|","/:X-)","/::*","/:@x","/:8*","/:pd","/:<W>","/:beer","/:basketb",
  655. "/:oo","/:coffee","/:eat","/:pig","/:rose","/:fade","/:showlove","/:heart",
  656. "/:break","/:cake","/:li","/:bome","/:kn","/:footb","/:ladybug","/:shit","/:moon",
  657. "/:sun","/:gift","/:hug","/:strong","/:weak","/:share","/:v","/:@)","/:jj","/:@@",
  658. "/:bad","/:lvu","/:no","/:ok","/:love","/:<L>","/:jump","/:shake","/:<O>","/:circle",
  659. "/:kotow","/:turn","/:skip","/:oY","/:#-0","/:hiphot","/:kiss","/:<&","/:&>"
  660. );
  661. foreach ($emotions as $index => $emotion) {
  662. $message = str_replace($emotion, '<img style="width:'.$size.';vertical-align:middle;" src="http://res.mail.qq.com/zh_CN/images/mo/DEFAULT2/'.$index.'.gif" />', $message);
  663. }
  664. return $message;
  665. }
  666. function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
  667. $ckey_length = 4;
  668. $key = md5($key != '' ? $key : $GLOBALS['_W']['config']['setting']['authkey']);
  669. $keya = md5(substr($key, 0, 16));
  670. $keyb = md5(substr($key, 16, 16));
  671. $keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length) : substr(md5(microtime()), -$ckey_length)) : '';
  672. $cryptkey = $keya . md5($keya . $keyc);
  673. $key_length = strlen($cryptkey);
  674. $string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;
  675. $string_length = strlen($string);
  676. $result = '';
  677. $box = range(0, 255);
  678. $rndkey = array();
  679. for ($i = 0; $i <= 255; $i++) {
  680. $rndkey[$i] = ord($cryptkey[$i % $key_length]);
  681. }
  682. for ($j = $i = 0; $i < 256; $i++) {
  683. $j = ($j + $box[$i] + $rndkey[$i]) % 256;
  684. $tmp = $box[$i];
  685. $box[$i] = $box[$j];
  686. $box[$j] = $tmp;
  687. }
  688. for ($a = $j = $i = 0; $i < $string_length; $i++) {
  689. $a = ($a + 1) % 256;
  690. $j = ($j + $box[$a]) % 256;
  691. $tmp = $box[$a];
  692. $box[$a] = $box[$j];
  693. $box[$j] = $tmp;
  694. $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
  695. }
  696. if ($operation == 'DECODE') {
  697. if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)) {
  698. return substr($result, 26);
  699. } else {
  700. return '';
  701. }
  702. } else {
  703. return $keyc . str_replace('=', '', base64_encode($result));
  704. }
  705. }
  706. function sizecount($size) {
  707. if($size >= 1073741824) {
  708. $size = round($size / 1073741824 * 100) / 100 . ' GB';
  709. } elseif($size >= 1048576) {
  710. $size = round($size / 1048576 * 100) / 100 . ' MB';
  711. } elseif($size >= 1024) {
  712. $size = round($size / 1024 * 100) / 100 . ' KB';
  713. } else {
  714. $size = $size . ' Bytes';
  715. }
  716. return $size;
  717. }
  718. function bytecount($str) {
  719. if (strtolower($str[strlen($str) -1]) == 'b') {
  720. $str = substr($str, 0, -1);
  721. }
  722. if(strtolower($str[strlen($str) -1]) == 'k') {
  723. return floatval($str) * 1024;
  724. }
  725. if(strtolower($str[strlen($str) -1]) == 'm') {
  726. return floatval($str) * 1048576;
  727. }
  728. if(strtolower($str[strlen($str) -1]) == 'g') {
  729. return floatval($str) * 1073741824;
  730. }
  731. }
  732. function array2xml($arr, $level = 1) {
  733. $s = $level == 1 ? "<xml>" : '';
  734. foreach ($arr as $tagname => $value) {
  735. if (is_numeric($tagname)) {
  736. $tagname = $value['TagName'];
  737. unset($value['TagName']);
  738. }
  739. if (!is_array($value)) {
  740. $s .= "<{$tagname}>" . (!is_numeric($value) ? '<![CDATA[' : '') . $value . (!is_numeric($value) ? ']]>' : '') . "</{$tagname}>";
  741. } else {
  742. $s .= "<{$tagname}>" . array2xml($value, $level + 1) . "</{$tagname}>";
  743. }
  744. }
  745. $s = preg_replace("/([\x01-\x08\x0b-\x0c\x0e-\x1f])+/", ' ', $s);
  746. return $level == 1 ? $s . "</xml>" : $s;
  747. }
  748. function xml2array($xml) {
  749. if (empty($xml)) {
  750. return array();
  751. }
  752. $result = array();
  753. $xmlobj = isimplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOCDATA);
  754. if($xmlobj instanceof SimpleXMLElement) {
  755. $result = json_decode(json_encode($xmlobj), true);
  756. if (is_array($result)) {
  757. return $result;
  758. } else {
  759. return '';
  760. }
  761. } else {
  762. return $result;
  763. }
  764. }
  765. function scriptname() {
  766. global $_W;
  767. $_W['script_name'] = basename($_SERVER['SCRIPT_FILENAME']);
  768. if(basename($_SERVER['SCRIPT_NAME']) === $_W['script_name']) {
  769. $_W['script_name'] = $_SERVER['SCRIPT_NAME'];
  770. } else {
  771. if(basename($_SERVER['PHP_SELF']) === $_W['script_name']) {
  772. $_W['script_name'] = $_SERVER['PHP_SELF'];
  773. } else {
  774. if(isset($_SERVER['ORIG_SCRIPT_NAME']) && basename($_SERVER['ORIG_SCRIPT_NAME']) === $_W['script_name']) {
  775. $_W['script_name'] = $_SERVER['ORIG_SCRIPT_NAME'];
  776. } else {
  777. if(($pos = strpos($_SERVER['PHP_SELF'], '/' . $scriptName)) !== false) {
  778. $_W['script_name'] = substr($_SERVER['SCRIPT_NAME'], 0, $pos) . '/' . $_W['script_name'];
  779. } else {
  780. if(isset($_SERVER['DOCUMENT_ROOT']) && strpos($_SERVER['SCRIPT_FILENAME'], $_SERVER['DOCUMENT_ROOT']) === 0) {
  781. $_W['script_name'] = str_replace('\\', '/', str_replace($_SERVER['DOCUMENT_ROOT'], '', $_SERVER['SCRIPT_FILENAME']));
  782. } else {
  783. $_W['script_name'] = 'unknown';
  784. }
  785. }
  786. }
  787. }
  788. }
  789. return $_W['script_name'];
  790. }
  791. function utf8_bytes($cp) {
  792. if ($cp > 0x10000){
  793. return chr(0xF0 | (($cp & 0x1C0000) >> 18)).
  794. chr(0x80 | (($cp & 0x3F000) >> 12)).
  795. chr(0x80 | (($cp & 0xFC0) >> 6)).
  796. chr(0x80 | ($cp & 0x3F));
  797. }else if ($cp > 0x800){
  798. return chr(0xE0 | (($cp & 0xF000) >> 12)).
  799. chr(0x80 | (($cp & 0xFC0) >> 6)).
  800. chr(0x80 | ($cp & 0x3F));
  801. }else if ($cp > 0x80){
  802. return chr(0xC0 | (($cp & 0x7C0) >> 6)).
  803. chr(0x80 | ($cp & 0x3F));
  804. }else{
  805. return chr($cp);
  806. }
  807. }
  808. function media2local($media_id, $all = false){
  809. global $_W;
  810. load()->model('material');
  811. $data = material_get($media_id);
  812. if (!is_error($data)) {
  813. $data['attachment'] = tomedia($data['attachment'], true);
  814. if (!$all) {
  815. return $data['attachment'];
  816. }
  817. return $data;
  818. } else {
  819. return '';
  820. }
  821. }
  822. function aes_decode($message, $encodingaeskey = '', $appid = '') {
  823. $key = base64_decode($encodingaeskey . '=');
  824. $ciphertext_dec = base64_decode($message);
  825. $module = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
  826. $iv = substr($key, 0, 16);
  827. mcrypt_generic_init($module, $key, $iv);
  828. $decrypted = mdecrypt_generic($module, $ciphertext_dec);
  829. mcrypt_generic_deinit($module);
  830. mcrypt_module_close($module);
  831. $block_size = 32;
  832. $pad = ord(substr($decrypted, -1));
  833. if ($pad < 1 || $pad > 32) {
  834. $pad = 0;
  835. }
  836. $result = substr($decrypted, 0, (strlen($decrypted) - $pad));
  837. if (strlen($result) < 16) {
  838. return '';
  839. }
  840. $content = substr($result, 16, strlen($result));
  841. $len_list = unpack("N", substr($content, 0, 4));
  842. $contentlen = $len_list[1];
  843. $content = substr($content, 4, $contentlen);
  844. $from_appid = substr($content, $xml_len + 4);
  845. if (!empty($appid) && $appid != $from_appid) {
  846. return '';
  847. }
  848. return $content;
  849. }
  850. function aes_encode($message, $encodingaeskey = '', $appid = '') {
  851. $key = base64_decode($encodingaeskey . '=');
  852. $text = random(16) . pack("N", strlen($message)) . $message . $appid;
  853. $size = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
  854. $module = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
  855. $iv = substr($key, 0, 16);
  856. $block_size = 32;
  857. $text_length = strlen($text);
  858. $amount_to_pad = $block_size - ($text_length % $block_size);
  859. if ($amount_to_pad == 0) {
  860. $amount_to_pad = $block_size;
  861. }
  862. $pad_chr = chr($amount_to_pad);
  863. $tmp = '';
  864. for ($index = 0; $index < $amount_to_pad; $index++) {
  865. $tmp .= $pad_chr;
  866. }
  867. $text = $text . $tmp;
  868. mcrypt_generic_init($module, $key, $iv);
  869. $encrypted = mcrypt_generic($module, $text);
  870. mcrypt_generic_deinit($module);
  871. mcrypt_module_close($module);
  872. $encrypt_msg = base64_encode($encrypted);
  873. return $encrypt_msg;
  874. }
  875. function aes_pkcs7_decode($encrypt_data, $key, $iv = false) {
  876. load()->library('pkcs7');
  877. $encrypt_data = base64_decode($encrypt_data);
  878. if (!empty($iv)) {
  879. $iv = base64_decode($iv);
  880. }
  881. $pc = new Prpcrypt($key);
  882. $result = $pc->decrypt($encrypt_data, $iv);
  883. if ($result[0] != 0) {
  884. return error($result[0], '解密失败');
  885. }
  886. return $result[1];
  887. }
  888. function isimplexml_load_string($string, $class_name = 'SimpleXMLElement', $options = 0, $ns = '', $is_prefix = false) {
  889. libxml_disable_entity_loader(true);
  890. if (preg_match('/(\<\!DOCTYPE|\<\!ENTITY)/i', $string)) {
  891. return false;
  892. }
  893. return simplexml_load_string($string, $class_name, $options, $ns, $is_prefix);
  894. }
  895. function ihtml_entity_decode($str) {
  896. $str = str_replace('&nbsp;', '#nbsp;', $str);
  897. return str_replace('#nbsp;', '&nbsp;', html_entity_decode(urldecode($str)));
  898. }
  899. function iarray_change_key_case($array, $case = CASE_LOWER){
  900. if (!is_array($array) || empty($array)){
  901. return array();
  902. }
  903. $array = array_change_key_case($array, $case);
  904. foreach ($array as $key => $value){
  905. if (empty($value) && is_array($value)) {
  906. $array[$key] = '';
  907. }
  908. if (!empty($value) && is_array($value)) {
  909. $array[$key] = iarray_change_key_case($value, $case);
  910. }
  911. }
  912. return $array;
  913. }
  914. function strip_gpc($values, $type = 'g') {
  915. $filter = array(
  916. 'g' => "'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)",
  917. 'p' => "\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)",
  918. 'c' => "\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)",
  919. );
  920. if (!isset($values)) {
  921. return '';
  922. }
  923. if(is_array($values)) {
  924. foreach($values as $key => $val) {
  925. $values[addslashes($key)] = strip_gpc($val, $type);
  926. }
  927. } else {
  928. if (preg_match("/".$filter[$type]."/is", $values, $match) == 1) {
  929. $values = '';
  930. }
  931. }
  932. return $values;
  933. }
  934. function parse_path($path) {
  935. $danger_char = array('../', '{php', '<?php', '<%', '<?', '..\\', '\\\\' ,'\\', '..\\\\', '%00', '\0', '\r');
  936. foreach ($danger_char as $char) {
  937. if (strexists($path, $char)) {
  938. return false;
  939. }
  940. }
  941. return $path;
  942. }
  943. function dir_size($dir) {
  944. $size = 0;
  945. if(is_dir($dir)) {
  946. $handle = opendir($dir);
  947. while (false !== ($entry = readdir($handle))) {
  948. if($entry != '.' && $entry != '..') {
  949. if(is_dir("{$dir}/{$entry}")) {
  950. $size += dir_size("{$dir}/{$entry}");
  951. } else {
  952. $size += filesize("{$dir}/{$entry}");
  953. }
  954. }
  955. }
  956. closedir($handle);
  957. }
  958. return $size;
  959. }
  960. function get_first_pinyin($str) {
  961. static $pinyin;
  962. $first_char = '';
  963. $str = trim($str);
  964. if(empty($str)) {
  965. return $first_char;
  966. }
  967. if (empty($pinyin)) {
  968. load()->library('pinyin');
  969. $pinyin = new Pinyin_Pinyin();
  970. }
  971. $first_char = $pinyin->get_first_char($str);
  972. return $first_char;
  973. }
  974. function strip_emoji($nickname) {
  975. $clean_text = "";
  976. $regexEmoticons = '/[\x{1F600}-\x{1F64F}]/u';
  977. $clean_text = preg_replace($regexEmoticons, '', $nickname);
  978. $regexSymbols = '/[\x{1F300}-\x{1F5FF}]/u';
  979. $clean_text = preg_replace($regexSymbols, '', $clean_text);
  980. $regexTransport = '/[\x{1F680}-\x{1F6FF}]/u';
  981. $clean_text = preg_replace($regexTransport, '', $clean_text);
  982. $regexMisc = '/[\x{2600}-\x{26FF}]/u';
  983. $clean_text = preg_replace($regexMisc, '', $clean_text);
  984. $regexDingbats = '/[\x{2700}-\x{27BF}]/u';
  985. $clean_text = preg_replace($regexDingbats, '', $clean_text);
  986. $clean_text = str_replace("'",'',$clean_text);
  987. $clean_text = str_replace('"','',$clean_text);
  988. $clean_text = str_replace('“','',$clean_text);
  989. $clean_text = str_replace('゛','',$clean_text);
  990. $search = array(" "," ","\n","\r","\t");
  991. $replace = array("","","","","");
  992. return str_replace($search, $replace, $clean_text);
  993. }
  994. function emoji_unicode_decode($string) {
  995. preg_match_all('/\[U\+(\\w{4,})\]/i', $string, $match);
  996. if(!empty($match[1])) {
  997. foreach ($match[1] as $emojiUSB) {
  998. $string = str_ireplace("[U+{$emojiUSB}]", utf8_bytes(hexdec($emojiUSB)), $string);
  999. }
  1000. }
  1001. return $string;
  1002. }
  1003. function emoji_unicode_encode($string) {
  1004. $ranges = array(
  1005. '\\\\ud83c[\\\\udf00-\\\\udfff]', '\\\\ud83d[\\\\udc00-\\\\ude4f]', '\\\\ud83d[\\\\ude80-\\\\udeff]' );
  1006. preg_match_all('/' . implode('|', $ranges) . '/i', $string, $match);
  1007. print_r($match);exit;
  1008. }
  1009. function getglobal($key) {
  1010. global $_W;
  1011. $key = explode('/', $key);
  1012. $v = &$_W;
  1013. foreach ($key as $k) {
  1014. if (!isset($v[$k])) {
  1015. return null;
  1016. }
  1017. $v = &$v[$k];
  1018. }
  1019. return $v;
  1020. }
  1021. if (!function_exists('starts_with')) {
  1022. function starts_with($haystack, $needles) {
  1023. foreach ((array) $needles as $needle) {
  1024. if ($needle != '' && substr($haystack, 0, strlen($needle)) === (string) $needle) {
  1025. return true;
  1026. }
  1027. }
  1028. return false;
  1029. }
  1030. }
  1031. function check_url_not_outside_link($redirect) {
  1032. global $_W;
  1033. if(starts_with($redirect, 'http') && !starts_with($redirect, $_W['siteroot'])) {
  1034. $redirect = $_W['siteroot'];
  1035. }
  1036. return $redirect;
  1037. }
  1038. function remove_xss($val) {
  1039. $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);
  1040. $search = 'abcdefghijklmnopqrstuvwxyz';
  1041. $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  1042. $search .= '1234567890!@#$%^&*()';
  1043. $search .= '~`";:?+/={}[]-_|\'\\';
  1044. for ($i = 0; $i < strlen($search); $i++) {
  1045. $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val);
  1046. $val = preg_replace('/(�{0,8}'.ord($search[$i]).';?)/', $search[$i], $val);
  1047. }
  1048. $ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'script', 'embed', 'object', 'frameset', 'ilayer', 'bgsound', 'title', 'base');
  1049. $ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload', 'import');
  1050. $ra = array_merge($ra1, $ra2);
  1051. $found = true;
  1052. while ($found == true) {
  1053. $val_before = $val;
  1054. for ($i = 0; $i < sizeof($ra); $i++) {
  1055. $pattern = '/';
  1056. for ($j = 0; $j < strlen($ra[$i]); $j++) {
  1057. if ($j > 0) {
  1058. $pattern .= '(';
  1059. $pattern .= '(&#[xX]0{0,8}([9ab]);)';
  1060. $pattern .= '|';
  1061. $pattern .= '|(�{0,8}([9|10|13]);)';
  1062. $pattern .= ')*';
  1063. }
  1064. $pattern .= $ra[$i][$j];
  1065. }
  1066. $pattern .= '/i';
  1067. $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2);
  1068. $val = preg_replace($pattern, $replacement, $val);
  1069. if ($val_before == $val) {
  1070. $found = false;
  1071. }
  1072. }
  1073. }
  1074. return $val;
  1075. }
  1076. load()->func('safe');