安全过滤说明

输入过滤，对数字类型转码

i($key) 读取int $_REQUEST[$key]
f($key) 读取float $_REQUEST[$key]

SQL注入输入过滤，SQL构造过滤

/**
 * 前后是否加引号
 *
 * @param  mixed  $val
 * @return mixed  $val
 *
 */
function untrim($val)
{
    if (is_array($val))
    {
        $val = array_map('untrim', $val);
    }
    elseif (is_null($val))
    {
        $val = 'NULL';
    }
    else
    {
        $val = '"' . mres($val) . '"';
    }

    return $val;
}

function mres($str)
{
    $str = addslashes($str);
    return $str;
}

XSS攻击过滤

数据库字段，设置fieldType类型数据格式:JSON|DOT|html|source => JSON数据格式|逗号分隔格式|html格式不编码|html格式不过滤 (dt=>JSON, dt=>DOT, dt=>HTML, dt=>SOURCE)

默认数据经过 htmlspecialchars 处理

    private function stringifyValue(&$key, &$value)
    {
        if (isset($this->fieldType[$key]))
        {
            if ('JSON' == strtoupper($this->fieldType[$key]))
            {
                if (is_array($value))
                {
                    $value = encode_json($value, false);
                }
            }
            else if ('DOT' == strtoupper($this->fieldType[$key]))
            {
                require_once LIB_PATH . '/HTMLPurifier.auto.php';
                $purifier = new HTMLPurifier();

                if (is_array($value))
                {
                    foreach ($value as $tid=>$tv)
                    {
                        $value[$tid] = $purifier->purify($tv);
                    }

                    $value = implode(',', $value);
                }
                else
                {
                    $value = $purifier->purify($value);
                }
            }
            else if ('HTML' == strtoupper($this->fieldType[$key]))
            {
                require_once LIB_PATH . '/HTMLPurifier.auto.php';
                $purifier = new HTMLPurifier();
                $value = $purifier->purify($value);
            }
            else
            {
                if ('SOURCE' == strtoupper($this->fieldType[$key]))
                {

                }
                else
                {
                    $value = htmlspecialchars($value);
                }
            }
        }
        else
        {
            $value = htmlspecialchars($value);
        }

        return $value;
    }