dedecms虽然有诸多漏洞，但不可否认确实是一个很不错的内容管理系统(cms)，其他也不乏很多功能实用性的函数，以下就部分列举，持续更新，不作过多说明。使用时需部分修改，你懂的

1.XSS过滤。

  1. function XSSClean($val) {
  2.     global $cfg_soft_lang;
  3.     if($cfg_soft_lang=='gb2312') gb2utf8($val);
  4.     if (is_array($val))
  5.     {
  6.         while (list($key) = each($val))
  7.         {
  8.             if(in_array($key,array('tags','body','dede_fields','dede_addonfields','dopost','introduce'))) continue;
  9.             $val[$key] = XSSClean($val[$key]);
  10.         }
  11.         return $val;
  12.     }
  13.     $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);
  14.     $search = 'abcdefghijklmnopqrstuvwxyz';
  15.     $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  16.     $search .= '1234567890!@#$%^&*()';
  17.     $search .= '~`";:?+/={}[]-_|\'\\';
  18.     for ($i = 0; $i < strlen($search); $i++) {
  19.       $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;
  20.       $val = preg_replace('/(&#0{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;
  21.     }
  23.     $val = str_replace("`","‘",$val);
  24.     $val = str_replace("'","‘",$val);
  25.     $val = str_replace("\"","“",$val);
  26.     $val = str_replace(",","，",$val);
  27.     $val = str_replace("(","（",$val);
  28.     $val = str_replace(")","）",$val);
  30.     $ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');
  31.     $ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
  32.     $ra = array_merge($ra1, $ra2);
  34.     $found = true;
  35.     while ($found == true) {
  36.       $val_before = $val;
  37.       for ($i = 0; $i < sizeof($ra); $i++) {
  38.          $pattern = '/';
  39.          for ($j = 0; $j < strlen($ra[$i]); $j++) {
  40.             if ($j > 0) {
  41.                $pattern .= '(';
  42.                $pattern .= '(&#[xX]0{0,8}([9ab]);)';
  43.                $pattern .= '|';
  44.                $pattern .= '|(&#0{0,8}([9|10|13]);)';
  45.                $pattern .= ')*';
  46.             }
  47.             $pattern .= $ra[$i][$j];
  48.          }
  49.          $pattern .= '/i';
  50.          $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2);
  51.          $val = preg_replace($pattern, $replacement, $val);
  52.          if ($val_before == $val) {
  53.             $found = false;
  54.          }
  55.       }
  56.     }
  57.     if($cfg_soft_lang=='gb2312') utf82gb($val);
  58.     return $val;
  59. }
  60. $_GET = XSSClean($_GET);
  61. $_POST = XSSClean($_POST);
  62. $_REQUEST = XSSClean($_REQUEST);
  63. $_COOKIE = XSSClean($_COOKIE);

2.编码函数

  1. $UC2GBTABLE = $CODETABLE = $BIG5_DATA = $GB_DATA = '';
  2. $GbkUniDic = null;
  4. /**
  5.  *  UTF-8 转GB编码
  6.  *
  7.  * @access    public
  8.  * @param     string  $utfstr  需要转换的字符串
  9.  * @return    string
  10.  */
  11. if ( ! function_exists('utf82gb'))
  12. {
  13.     function utf82gb($utfstr)
  14.     {
  15.         if(function_exists('iconv'))
  16.         {
  17.             return iconv('utf-8','gbk//ignore',$utfstr);
  18.         }
  19.         global $UC2GBTABLE;
  20.         $okstr = "";
  21.         if(trim($utfstr)=="")
  22.         {
  23.             return $utfstr;
  24.         }
  25.         if(empty($UC2GBTABLE))
  26.         {
  27.             $filename = DEDEINC."/data/gb2312-utf8.dat";
  28.             $fp = fopen($filename,"r");
  29.             while($l = fgets($fp,15))
  30.             {
  31.                 $UC2GBTABLE[hexdec(substr($l, 7, 6))] = hexdec(substr($l, 0, 6));
  32.             }
  33.             fclose($fp);
  34.         }
  35.         $okstr = "";
  36.         $ulen = strlen($utfstr);
  37.         for($i=0;$i<$ulen;$i++)
  38.         {
  39.             $c = $utfstr[$i];
  40.             $cb = decbin(ord($utfstr[$i]));
  41.             if(strlen($cb)==8)
  42.             {
  43.                 $csize = strpos(decbin(ord($cb)),"0");
  44.                 for($j=0;$j < $csize;$j++)
  45.                 {
  46.                     $i++; $c .= $utfstr[$i];
  47.                 }
  48.                 $c = utf82u($c);
  49.                 if(isset($UC2GBTABLE[$c]))
  50.                 {
  51.                     $c = dechex($UC2GBTABLE[$c]+0x8080);
  52.                     $okstr .= chr(hexdec($c[0].$c[1])).chr(hexdec($c[2].$c[3]));
  53.                 }
  54.                 else
  55.                 {
  56.                     $okstr .= "&#".$c.";";
  57.                 }
  58.             }
  59.             else
  60.             {
  61.                 $okstr .= $c;
  62.             }
  63.         }
  64.         $okstr = trim($okstr);
  65.         return $okstr;
  66.     }
  67. }
  69. /**
  70.  *  GB转UTF-8编码
  71.  *
  72.  * @access    public
  73.  * @param     string  $gbstr  gbk的字符串
  74.  * @return    string
  75.  */
  76. if ( ! function_exists('gb2utf8'))
  77. {
  78.     function gb2utf8($gbstr)
  79.     {
  80.         if(function_exists('iconv'))
  81.         {
  82.             return iconv('gbk','utf-8//ignore',$gbstr);
  83.         }
  84.         global $CODETABLE;
  85.         if(trim($gbstr)=="")
  86.         {
  87.             return $gbstr;
  88.         }
  89.         if(empty($CODETABLE))
  90.         {
  91.             $filename = DEDEINC."/data/gb2312-utf8.dat";
  92.             $fp = fopen($filename,"r");
  93.             while ($l = fgets($fp,15))
  94.             {
  95.                 $CODETABLE[hexdec(substr($l, 0, 6))] = substr($l, 7, 6);
  96.             }
  97.             fclose($fp);
  98.         }
  99.         $ret = "";
  100.         $utf8 = "";
  101.         while ($gbstr != '')
  102.         {
  103.             if (ord(substr($gbstr, 0, 1)) > 0x80)
  104.             {
  105.                 $thisW = substr($gbstr, 0, 2);
  106.                 $gbstr = substr($gbstr, 2, strlen($gbstr));
  107.                 $utf8 = "";
  108.                 @$utf8 = u2utf8(hexdec($CODETABLE[hexdec(bin2hex($thisW)) - 0x8080]));
  109.                 if($utf8!="")
  110.                 {
  111.                     for ($i = 0;$i < strlen($utf8);$i += 3)
  112.                     $ret .= chr(substr($utf8, $i, 3));
  113.                 }
  114.             }
  115.             else
  116.             {
  117.                 $ret .= substr($gbstr, 0, 1);
  118.                 $gbstr = substr($gbstr, 1, strlen($gbstr));
  119.             }
  120.         }
  121.         return $ret;
  122.     }
  123. }
  125. /**
  126.  *  Unicode转utf8
  127.  *
  128.  * @access    public
  129.  * @param     string  $c  Unicode的字符串内容
  130.  * @return    string
  131.  */
  132. if ( ! function_exists('u2utf8'))
  133. {
  134.     function u2utf8($c)
  135.     {
  136.         for ($i = 0;$i < count($c);$i++)
  137.         {
  138.             $str = "";
  139.         }
  140.         if ($c < 0x80)
  141.         {
  142.             $str .= $c;
  143.         }
  144.         else if ($c < 0x800)
  145.         {
  146.             $str .= (0xC0 | $c >> 6);
  147.             $str .= (0x80 | $c & 0x3F);
  148.         }
  149.         else if ($c < 0x10000)
  150.         {
  151.             $str .= (0xE0 | $c >> 12);
  152.             $str .= (0x80 | $c >> 6 & 0x3F);
  153.             $str .= (0x80 | $c & 0x3F);
  154.         }
  155.         else if ($c < 0x200000)
  156.         {
  157.             $str .= (0xF0 | $c >> 18);
  158.             $str .= (0x80 | $c >> 12 & 0x3F);
  159.             $str .= (0x80 | $c >> 6 & 0x3F);
  160.             $str .= (0x80 | $c & 0x3F);
  161.         }
  162.         return $str;
  163.     }
  164. }
  166. /**
  167.  *  utf8转Unicode
  168.  *
  169.  * @access    public
  170.  * @param     string  $c  UTF-8的字符串信息
  171.  * @return    string
  172.  */
  173. if ( ! function_exists('utf82u'))
  174. {
  175.     function utf82u($c)
  176.     {
  177.         switch(strlen($c))
  178.         {
  179.             case 1:
  180.                 return ord($c);
  181.             case 2:
  182.                 $n = (ord($c[0]) & 0x3f) << 6;
  183.                 $n += ord($c[1]) & 0x3f;
  184.                 return $n;
  185.             case 3:
  186.                 $n = (ord($c[0]) & 0x1f) << 12;
  187.                 $n += (ord($c[1]) & 0x3f) << 6;
  188.                 $n += ord($c[2]) & 0x3f;
  189.                 return $n;
  190.             case 4:
  191.                 $n = (ord($c[0]) & 0x0f) << 18;
  192.                 $n += (ord($c[1]) & 0x3f) << 12;
  193.                 $n += (ord($c[2]) & 0x3f) << 6;
  194.                 $n += ord($c[3]) & 0x3f;
  195.                 return $n;
  196.         }
  197.     }
  198. }
  200. /**
  201.  *  Big5码转换成GB码
  202.  *
  203.  * @access    public
  204.  * @param     string   $Text  字符串内容
  205.  * @return    string
  206.  */
  207. if ( ! function_exists('big52gb'))
  208. {
  209.     function big52gb($Text)
  210.     {
  211.         if(function_exists('iconv'))
  212.         {
  213.             return iconv('big5','gbk//ignore',$Text);
  214.         }
  215.         global $BIG5_DATA;
  216.         if(empty($BIG5_DATA))
  217.         {
  218.             $filename = DEDEINC."/data/big5-gb.dat";
  219.             $fp = fopen($filename, "rb");
  220.             $BIG5_DATA = fread($fp,filesize($filename));
  221.             fclose($fp);
  222.         }
  223.         $max = strlen($Text)-1;
  224.         for($i=0;$i<$max;$i++)
  225.         {
  226.             $h = ord($Text[$i]);
  227.             if($h>=0x80)
  228.             {
  229.                 $l = ord($Text[$i+1]);
  230.                 if($h==161 && $l==64)
  231.                 {
  232.                     $gbstr = "　";
  233.                 }
  234.                 else
  235.                 {
  236.                     $p = ($h-160)*510+($l-1)*2;
  237.                     $gbstr = $BIG5_DATA[$p].$BIG5_DATA[$p+1];
  238.                 }
  239.                 $Text[$i] = $gbstr[0];
  240.                 $Text[$i+1] = $gbstr[1];
  241.                 $i++;
  242.             }
  243.         }
  244.         return $Text;
  245.     }
  246. }
  248. /**
  249.  *  GB码转换成Big5码
  250.  *
  251.  * @access    public
  252.  * @param     string  $Text 字符串内容
  253.  * @return    string
  254.  */
  255. if ( ! function_exists('gb2big5'))
  256. {
  257.     function gb2big5($Text)
  258.     {
  259.         if(function_exists('iconv'))
  260.         {
  261.             return iconv('gbk','big5//ignore',$Text);
  262.         }
  263.         global $GB_DATA;
  264.         if(empty($GB_DATA))
  265.         {
  266.             $filename = DEDEINC."/data/gb-big5.dat";
  267.             $fp = fopen($filename, "rb");
  268.             $gb = fread($fp,filesize($filename));
  269.             fclose($fp);
  270.         }
  271.         $max = strlen($Text)-1;
  272.         for($i=0;$i<$max;$i++)
  273.         {
  274.             $h = ord($Text[$i]);
  275.             if($h>=0x80)
  276.             {
  277.                 $l = ord($Text[$i+1]);
  278.                 if($h==161 && $l==64)
  279.                 {
  280.                     $big = "　";
  281.                 }
  282.                 else
  283.                 {
  284.                     $p = ($h-160)*510+($l-1)*2;
  285.                     $big = $GB_DATA[$p].$GB_DATA[$p+1];
  286.                 }
  287.                 $Text[$i] = $big[0];
  288.                 $Text[$i+1] = $big[1];
  289.                 $i++;
  290.             }
  291.         }
  292.         return $Text;
  293.     }
  294. }
  296. /**
  297.  *  unicode url编码转gbk编码函数
  298.  *
  299.  * @access    public
  300.  * @param     string  $str  转换的内容
  301.  * @return    string
  302.  */
  303. if ( ! function_exists('UnicodeUrl2Gbk'))
  304. {
  305.     function UnicodeUrl2Gbk($str)
  306.     {
  307.         //载入对照词典
  308.         if(!isset($GLOBALS['GbkUniDic']))
  309.         {
  310.             $fp = fopen(DEDEINC.'/data/gbk-unicode.dat','rb');
  311.             while(!feof($fp))
  312.             {
  313.                 $GLOBALS['GbkUniDic'][bin2hex(fread($fp,2))] = fread($fp,2);
  314.             }
  315.             fclose($fp);
  316.         }
  318.         //处理字符串
  319.         $str = str_replace('$#$','+',$str);
  320.         $glen = strlen($str);
  321.         $okstr = "";
  322.         for($i=0; $i < $glen; $i++)
  323.         {
  324.             if($glen-$i > 4)
  325.             {
  326.                 if($str[$i]=='%' && $str[$i+1]=='u')
  327.                 {
  328.                     $uni = strtolower(substr($str,$i+2,4));
  329.                     $i = $i+5;
  330.                     if(isset($GLOBALS['GbkUniDic'][$uni]))
  331.                     {
  332.                         $okstr .= $GLOBALS['GbkUniDic'][$uni];
  333.                     }
  334.                     else
  335.                     {
  336.                         $okstr .= "&#".hexdec('0x'.$uni).";";
  337.                     }
  338.                 }
  339.                 else
  340.                 {
  341.                     $okstr .= $str[$i];
  342.                 }
  343.             }
  344.             else
  345.             {
  346.                 $okstr .= $str[$i];
  347.             }
  348.         }
  349.         return $okstr;
  350.     }
  351. }
  353. /**
  354.  *  自动转换字符集 支持数组转换
  355.  *
  356.  * @access    public
  357.  * @param     string  $str  转换的内容
  358.  * @return    string
  359.  */
  360. if ( ! function_exists('AutoCharset'))
  361. {
  362.     function AutoCharset($fContents, $from='gbk', $to='utf-8')
  363.     {
  364.         $from   =  strtoupper($from)=='UTF8'? 'utf-8' : $from;
  365.         $to       =  strtoupper($to)=='UTF8'? 'utf-8' : $to;
  366.         if( strtoupper($from) === strtoupper($to) || empty($fContents) || (is_scalar($fContents) && !is_string($fContents)) ){
  367.             //如果编码相同或者非字符串标量则不转换
  368.             return $fContents;
  369.         }
  370.         if(is_string($fContents) )
  371.         {
  372.             if(function_exists('mb_convert_encoding'))
  373.             {
  374.                 return mb_convert_encoding ($fContents, $to, $from);
  375.             } elseif (function_exists('iconv'))
  376.             {
  377.                 return iconv($from, $to, $fContents);
  378.             } else {
  379.                 return $fContents;
  380.             }
  381.         }
  382.         elseif(is_array($fContents))
  383.         {
  384.             foreach ( $fContents as $key => $val )
  385.             {
  386.                 $_key =     AutoCharset($key,$from,$to);
  387.                 $fContents[$_key] = AutoCharset($val,$from,$to);
  388.                 if($key != $_key )
  389.                     unset($fContents[$key]);
  390.             }
  391.             return $fContents;
  392.         }
  393.         else{
  394.             return $fContents;
  395.         }
  396.     }
  397. }

3.修复浏览器XSS hack的函数

  1. /**
  2.  *  XSS hack的函数
  3.  *
  4.  * @param     string   $val  需要处理的内容
  5.  * @return    string
  6.  */
  7. if ( ! function_exists('RemoveXSS'))
  8. {
  9.     function RemoveXSS($val) {
  10.        $val = preg_replace('/([\x00-\x08,\x0b-\x0c,\x0e-\x19])/', '', $val);
  11.        $search = 'abcdefghijklmnopqrstuvwxyz';
  12.        $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  13.        $search .= '1234567890!@#$%^&*()';
  14.        $search .= '~`";:?+/={}[]-_|\'\\';
  15.        for ($i = 0; $i < strlen($search); $i++) {
  16.           $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val); // with a ;
  17.           $val = preg_replace('/(&#0{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ;
  18.        }
  20.        $ra1 = array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base');
  21.        $ra2 = array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload');
  22.        $ra = array_merge($ra1, $ra2);
  24.        $found = true;
  25.        while ($found == true) {
  26.           $val_before = $val;
  27.           for ($i = 0; $i < sizeof($ra); $i++) {
  28.              $pattern = '/';
  29.              for ($j = 0; $j < strlen($ra[$i]); $j++) {
  30.                 if ($j > 0) {
  31.                    $pattern .= '(';
  32.                    $pattern .= '(&#[xX]0{0,8}([9ab]);)';
  33.                    $pattern .= '|';
  34.                    $pattern .= '|(&#0{0,8}([9|10|13]);)';
  35.                    $pattern .= ')*';
  36.                 }
  37.                 $pattern .= $ra[$i][$j];
  38.              }
  39.              $pattern .= '/i';
  40.              $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2);
  41.              $val = preg_replace($pattern, $replacement, $val);
  42.              if ($val_before == $val) {
  43.                 $found = false;
  44.              }
  45.           }
  46.        }
  47.        return $val;
  48.     }
  49. }

4.字符操作函数

  1. <?php  if(!defined('DEDEINC')) exit('dedecms');
  2. //拼音的缓冲数组
  3. $pinyins = Array();
  5. /**
  6.  *  中文截取2，单字节截取模式
  7.  *  如果是request的内容，必须使用这个函数
  8.  *
  9.  * @access    public
  10.  * @param     string  $str  需要截取的字符串
  11.  * @param     int  $slen  截取的长度
  12.  * @param     int  $startdd  开始标记处
  13.  * @return    string
  14.  */
  15. if ( ! function_exists('cn_substrR'))
  16. {
  17.     function cn_substrR($str, $slen, $startdd=0)
  18.     {
  19.         $str = cn_substr(stripslashes($str), $slen, $startdd);
  20.         return addslashes($str);
  21.     }
  22. }
  24. /**
  25.  *  中文截取2，单字节截取模式
  26.  *
  27.  * @access    public
  28.  * @param     string  $str  需要截取的字符串
  29.  * @param     int  $slen  截取的长度
  30.  * @param     int  $startdd  开始标记处
  31.  * @return    string
  32.  */
  33. if ( ! function_exists('cn_substr'))
  34. {
  35.     function cn_substr($str, $slen, $startdd=0)
  36.     {
  37.         global $cfg_soft_lang;
  38.         if($cfg_soft_lang=='utf-8')
  39.         {
  40.             return cn_substr_utf8($str, $slen, $startdd);
  41.         }
  42.         $restr = '';
  43.         $c = '';
  44.         $str_len = strlen($str);
  45.         if($str_len < $startdd+1)
  46.         {
  47.             return '';
  48.         }
  49.         if($str_len < $startdd + $slen || $slen==0)
  50.         {
  51.             $slen = $str_len - $startdd;
  52.         }
  53.         $enddd = $startdd + $slen - 1;
  54.         for($i=0;$i<$str_len;$i++)
  55.         {
  56.             if($startdd==0)
  57.             {
  58.                 $restr .= $c;
  59.             }
  60.             else if($i > $startdd)
  61.             {
  62.                 $restr .= $c;
  63.             }
  65.             if(ord($str[$i])>0x80)
  66.             {
  67.                 if($str_len>$i+1)
  68.                 {
  69.                     $c = $str[$i].$str[$i+1];
  70.                 }
  71.                 $i++;
  72.             }
  73.             else
  74.             {
  75.                 $c = $str[$i];
  76.             }
  78.             if($i >= $enddd)
  79.             {
  80.                 if(strlen($restr)+strlen($c)>$slen)
  81.                 {
  82.                     break;
  83.                 }
  84.                 else
  85.                 {
  86.                     $restr .= $c;
  87.                     break;
  88.                 }
  89.             }
  90.         }
  91.         return $restr;
  92.     }
  93. }
  95. /**
  96.  *  utf-8中文截取，单字节截取模式
  97.  *
  98.  * @access    public
  99.  * @param     string  $str  需要截取的字符串
  100.  * @param     int  $slen  截取的长度
  101.  * @param     int  $startdd  开始标记处
  102.  * @return    string
  103.  */
  104. if ( ! function_exists('cn_substr_utf8'))
  105. {
  106.     function cn_substr_utf8($str, $length, $start=0)
  107.     {
  108.         if(strlen($str) < $start+1)
  109.         {
  110.             return '';
  111.         }
  112.         preg_match_all("/./su", $str, $ar);
  113.         $str = '';
  114.         $tstr = '';
  116.         //为了兼容mysql4.1以下版本,与数据库varchar一致,这里使用按字节截取
  117.         for($i=0; isset($ar[0][$i]); $i++)
  118.         {
  119.             if(strlen($tstr) < $start)
  120.             {
  121.                 $tstr .= $ar[0][$i];
  122.             }
  123.             else
  124.             {
  125.                 if(strlen($str) < $length + strlen($ar[0][$i]) )
  126.                 {
  127.                     $str .= $ar[0][$i];
  128.                 }
  129.                 else
  130.                 {
  131.                     break;
  132.                 }
  133.             }
  134.         }
  135.         return $str;
  136.     }
  137. }
  139. /**
  140.  *  HTML转换为文本
  141.  *
  142.  * @param    string  $str 需要转换的字符串
  143.  * @param    string  $r   如果$r=0直接返回内容,否则需要使用反斜线引用字符串
  144.  * @return   string
  145.  */
  146. if ( ! function_exists('Html2Text'))
  147. {
  148.     function Html2Text($str,$r=0)
  149.     {
  150.         if(!function_exists('SpHtml2Text'))
  151.         {
  152.             require_once(DEDEINC."/inc/inc_fun_funString.php");
  153.         }
  154.         if($r==0)
  155.         {
  156.             return SpHtml2Text($str);
  157.         }
  158.         else
  159.         {
  160.             $str = SpHtml2Text(stripslashes($str));
  161.             return addslashes($str);
  162.         }
  163.     }
  164. }
  166. /**
  167.  *  文本转HTML
  168.  *
  169.  * @param    string  $txt 需要转换的文本内容
  170.  * @return   string
  171.  */
  172. if ( ! function_exists('Text2Html'))
  173. {
  174.     function Text2Html($txt)
  175.     {
  176.         $txt = str_replace("  ", "　", $txt);
  177.         $txt = str_replace("<", "&lt;", $txt);
  178.         $txt = str_replace(">", "&gt;", $txt);
  179.         $txt = preg_replace("/[\r\n]{1,}/isU", "<br/>\r\n", $txt);
  180.         return $txt;
  181.     }
  182. }
  184. /**
  185.  *  获取半角字符
  186.  *
  187.  * @param     string  $fnum  数字字符串
  188.  * @return    string
  189.  */
  190. if ( ! function_exists('GetAlabNum'))
  191. {
  192.     function GetAlabNum($fnum)
  193.     {
  194.         $nums = array("０","１","２","３","４","５","６","７","８","９");
  195.         //$fnums = "0123456789";
  196.         $fnums = array("0","1","2","3","4","5","6","7","8","9");
  197.         $fnum = str_replace($nums, $fnums, $fnum);
  198.         $fnum = preg_replace("/[^0-9\.-]/", '', $fnum);
  199.         if($fnum=='')
  200.         {
  201.             $fnum=0;
  202.         }
  203.         return $fnum;
  204.     }
  205. }
  207. /**
  208.  *  获取拼音以gbk编码为准
  209.  *
  210.  * @access    public
  211.  * @param     string  $str     字符串信息
  212.  * @param     int     $ishead  是否取头字母
  213.  * @param     int     $isclose 是否关闭字符串资源
  214.  * @return    string
  215.  */
  216. if ( ! function_exists('GetPinyin'))
  217. {
  218.     function GetPinyin($str, $ishead=0, $isclose=1)
  219.     {
  220.         global $cfg_soft_lang;
  221.         if(!function_exists('SpGetPinyin'))
  222.         {
  223.             //全局函数仅是inc_fun_funAdmin.php文件中函数的一个映射
  224.             require_once(DEDEINC."/inc/inc_fun_funAdmin.php");
  225.         }
  226.         if($cfg_soft_lang=='utf-8')
  227.         {
  228.             return SpGetPinyin(utf82gb($str), $ishead, $isclose);
  229.         }
  230.         else
  231.         {
  232.             return SpGetPinyin($str, $ishead, $isclose);
  233.         }
  234.     }
  235. }
  236. /**
  237.  *  将实体html代码转换成标准html代码（兼容php4）
  238.  *
  239.  * @access    public
  240.  * @param     string  $str     字符串信息
  241.  * @param     long    $options  替换的字符集
  242.  * @return    string
  243.  */
  245. if ( ! function_exists('htmlspecialchars_decode'))
  246. {
  247.         function htmlspecialchars_decode($str, $options=ENT_COMPAT) {
  248.                 $trans = get_html_translation_table(HTML_SPECIALCHARS, $options);
  250.                 $decode = ARRAY();
  251.                 foreach ($trans AS $char=>$entity) {
  252.                         $decode[$entity] = $char;
  253.                 }
  255.                 $str = strtr($str, $decode);
  257.                 return $str;
  258.         }
  259. }
  261. if ( ! function_exists('ubb'))
  262. {
  263.     function ubb($Text) {
  264.           $Text=trim($Text);
  265.           //$Text=htmlspecialchars($Text);
  266.           //$Text=ereg_replace("\n","<br>",$Text);
  267.           $Text=preg_replace("/\\t/is","  ",$Text);
  268.           $Text=preg_replace("/\[hr\]/is","<hr>",$Text);
  269.           $Text=preg_replace("/\[separator\]/is","<br/>",$Text);
  270.           $Text=preg_replace("/\[h1\](.+?)\[\/h1\]/is","<h1>\\1</h1>",$Text);
  271.           $Text=preg_replace("/\[h2\](.+?)\[\/h2\]/is","<h2>\\1</h2>",$Text);
  272.           $Text=preg_replace("/\[h3\](.+?)\[\/h3\]/is","<h3>\\1</h3>",$Text);
  273.           $Text=preg_replace("/\[h4\](.+?)\[\/h4\]/is","<h4>\\1</h4>",$Text);
  274.           $Text=preg_replace("/\[h5\](.+?)\[\/h5\]/is","<h5>\\1</h5>",$Text);
  275.           $Text=preg_replace("/\[h6\](.+?)\[\/h6\]/is","<h6>\\1</h6>",$Text);
  276.           $Text=preg_replace("/\[center\](.+?)\[\/center\]/is","<center>\\1</center>",$Text);
  277.           //$Text=preg_replace("/\[url=([^\[]*)\](.+?)\[\/url\]/is","<a href=\\1 target='_blank'>\\2</a>",$Text);
  278.           $Text=preg_replace("/\[url\](.+?)\[\/url\]/is","<a href=\"\\1\" target='_blank'>\\1</a>",$Text);
  279.           $Text=preg_replace("/\[url=(http:\/\/.+?)\](.+?)\[\/url\]/is","<a href='\\1' target='_blank'>\\2</a>",$Text);
  280.           $Text=preg_replace("/\[url=(.+?)\](.+?)\[\/url\]/is","<a href=\\1>\\2</a>",$Text);
  281.           $Text=preg_replace("/\[img\](.+?)\[\/img\]/is","<img src=\\1>",$Text);
  282.           $Text=preg_replace("/\[img\s(.+?)\](.+?)\[\/img\]/is","<img \\1 src=\\2>",$Text);
  283.           $Text=preg_replace("/\[color=(.+?)\](.+?)\[\/color\]/is","<font color=\\1>\\2</font>",$Text);
  284.           $Text=preg_replace("/\[colorTxt\](.+?)\[\/colorTxt\]/eis","color_txt('\\1')",$Text);
  285.           $Text=preg_replace("/\[style=(.+?)\](.+?)\[\/style\]/is","<div class='\\1'>\\2</div>",$Text);
  286.           $Text=preg_replace("/\[size=(.+?)\](.+?)\[\/size\]/is","<font size=\\1>\\2</font>",$Text);
  287.           $Text=preg_replace("/\[sup\](.+?)\[\/sup\]/is","<sup>\\1</sup>",$Text);
  288.           $Text=preg_replace("/\[sub\](.+?)\[\/sub\]/is","<sub>\\1</sub>",$Text);
  289.           $Text=preg_replace("/\[pre\](.+?)\[\/pre\]/is","<pre>\\1</pre>",$Text);
  290.           $Text=preg_replace("/\[emot\](.+?)\[\/emot\]/eis","emot('\\1')",$Text);
  291.           $Text=preg_replace("/\[email\](.+?)\[\/email\]/is","<a href='mailto:\\1'>\\1</a>",$Text);
  292.           $Text=preg_replace("/\[i\](.+?)\[\/i\]/is","<i>\\1</i>",$Text);
  293.           $Text=preg_replace("/\[u\](.+?)\[\/u\]/is","<u>\\1</u>",$Text);
  294.           $Text=preg_replace("/\[b\](.+?)\[\/b\]/is","<b>\\1</b>",$Text);
  295.           $Text=preg_replace("/\[quote\](.+?)\[\/quote\]/is","<blockquote>引用:<div style='border:1px solid silver;background:#EFFFDF;color:#393939;padding:5px' >\\1</div></blockquote>", $Text);
  296.           $Text=preg_replace("/\[sig\](.+?)\[\/sig\]/is","<div style='text-align: left; color: darkgreen; margin-left: 5%'><br><br>--------------------------<br>\\1<br>--------------------------</div>", $Text);
  297.           return $Text;
  298.     }
  299. }

部分内容引自：

http://www.neatstudio.com/show-378-1.shtml

附件下载地址:

http://files.cnblogs.com/mengdejun/data.zip

dedecms功能性函数封装(XSS过滤、编码、浏览器XSS hack、字符操作函数)的更多相关文章

  1. SQL_字符操作函数

    原创作品.出自 "深蓝的blog" 博客.欢迎转载,转载时请务必注明下面出处,否则追究版权法律责任. 深蓝的blog:http://blog.csdn.net/huangyanlo ...

  2. ctype.h库函数----字符操作函数

    在c++中使用时:  #include <cctype> 字符判断函数 1.isalnum函数--判断是否是英文字母或数字字符,如果是,则返回非0值,如果不是,则返回0. 函数参数 :可以 ...

  3. C语言-字符操作函数

    1字符数组的初始化: 1.1 char string={'c','h','i','n','a'} 1.2char string={"china"}或者去掉{}即char strin ...

  4. ACM编程技巧--常用字符操作函数

    字符串与基本数据类型的转换 int sscanf(buff,"%d%d",&a,&b); //返回值是参数个数 int sprintf(buff,"%d% ...

  5. js cookie创建读取删除函数封装

    js cookie创建读取删除函数封装 一.总结 都是为了方便操作,这样弄了很方便 1.创建cookie的函数封装的作用:方便设置过期时间expire,方便设置键和值 2.查询cookie的数据封装的 ...

  6. MYSQL常用操作函数的封装

    1.mysql常用函数封装文件:mysql.func.php <?php /** * 连接MYSQL函数 * @param string $host * @param string $usern ...

  7. linux makefile字符串操作函数 替换subst、模式替换patsubst、去首尾空格strip、查找字符串findstring、过滤filter、反过滤filter-out、排序函数sort、取单词word、取单词串wordlist、个数统计words

    1.1       字符操作函数使用 在Makefile中可以使用函数来处理变量,从而让我们的命令或是规则更为的灵活和具有智能.make所支持的函数也不算很多,不过已经足够我们的操作了.函数调用后,函 ...

  8. 跟着ALEX 学python day3集合 文件操作 函数和函数式编程 内置函数

    声明 : 文档内容学习于 http://www.cnblogs.com/xiaozhiqi/  一. 集合 集合是一个无序的,不重复的数据组合,主要作用如下 1.去重 把一个列表变成集合 ,就自动去重 ...

  9. 文件操作(FILE)与常用文件操作函数

    文件 1.文件基本概念 C程序把文件分为ASCII文件和二进制文件,ASCII文件又称文本文件,二进制文件和文本文件(也称ASCII码文件)二进制文件中,数值型数据是以二进制形式存储的, 而在文本文件 ...

随机推荐

  1. 设计模式--命令模式Command（对象行为型）

    一.命令模式 将一个请求封装为一个对象,从而让你使用不同的请求把客户端参数化,对请求排队或者记录请求日志,可以提供命令的撤销和恢复功能. (1)Command类:是一个抽象类,类中对需要执行的命令进行 ...

  2. java反射

    知识点1:获取类字节码的三种形式 1.Class date = Date.class;//根据类名获取字节码 2.Date date= new Date(); date.getClass();//对象 ...

  3. 在js中获取在css中设置的background-image值

    1. html部分 <div class="bg-color-two" id="bg_color_two" onclick="setBg(thi ...

  4. 关于Response.Redirect 端口不一致的跳转

    如果内网和外网的端口号设置的不相同,那在使用Response.Redirect跳转的时候会无法成功.需要做以下设置: <system.web> <httpRuntime useFul ...

  5. MySql卸载重新安装出现Start service没有响应的解决办法（64位）

    昨天因为自己手欠,不小心把mysql卸载了,于是又得重新安装,但是每次到了最后一步就报没有响应,于是就去寻找解决办法,如下就是啦! 安装Mysql卸载后又重新安装,每次到最后Start service ...

  6. 读取Simulink中Dataset类型的数据

    http://files.cnblogs.com/files/pursuiting/%E5%80%92%E7%AB%8B%E6%91%86%E6%8E%A7%E5%88%B6%E7%B3%BB%E7% ...

  7. Linux更改计算机名称

    1.修改:vim /etc/hosts 2.修改:vim /etc/sysconfig/network 3.重启:reboot 如不重启可以输入:hostname  新改的计算机名称,然后su

  8. JS中，！=， ！== 和 ！的区别和使用场景

    var num = 1; var str = '1'; var test = 1;   test == num   //true 相同类型 相同值 test === num  //true 相同类型 ...

  9. tif文件导入postgresql

    raster2pgsql -I -F -N -999  文件名  数据库名 | psql -U postgres -d postgres

  10. laravel5笔记

    数据库表创建E:\PHP\learnlaravel5>php artisan migrate 创建modelE:\PHP\learnlaravel5>php artisan make:mo ...