Sanitize &去属性多维数组

Question

我有以下课程，我写道：

class Sanitizer {

    public function sanitizeSingle ($string) {  
        if (get_magic_quotes_gpc()) {
            $string = stripslashes($string);
        }

        return trim(htmlspecialchars($string, ENT_QUOTES)); 
    }

    public function sanitize ($string) {
        if (is_array($string)) {
            foreach ($string as $k => $v) {
                $string[$k] = $this->sanitizeSingle($v);
            }
        }
        else {
            $string = $this->sanitizeSingle($string);
        }

        return $string;
    }

    public function desanitize ($string) {
        return trim(htmlspecialchars_decode($string, ENT_QUOTES));
    }

}

问题是，当它在字符串和一维数组上工作时，我在多维数组中得到以下错误：

警告: htmlspecialchars()希望参数1是字符串，在第10行的C:\wamp\www\classes\Sanitizer.php中给出数组

我该怎么解决这个问题？任何帮助都将不胜感激。

Answer 1

您的代码在$v中没有对数组进行评估，而是像这样修改您的foreach块，这种修改将净化任何级别的嵌套数组，

 foreach ($string as $k => $v) {
        if(is_array($v))
        {
            $string[$k] = $this->sanitize($v);
        }
        else
        {
            $string[$k] = $this->sanitizeSingle($v);
        }
 }

Answer 2

只要进行一些小的调整，您就可以利用本机递归函数在数组中的任何级别对标量值进行清理。

array_walk_recursive($data, [$this, 'sanitizeSingle']);

代码：(演示)

class Sanitizer {
    public function sanitizeSingle(&$string) {  
        if (function_exists("get_magic_quotes_gpc") && get_magic_quotes_gpc()) {
            $string = stripslashes($string);
        }
        $string = trim(htmlspecialchars($string, ENT_QUOTES)); 
    }

    public function sanitize($data) {
        if (is_array($data)) {
            array_walk_recursive($data, [$this, 'sanitizeSingle']);  // replace your loop with this line
        } else {
            $this->sanitizeSingle($data);
        }
        return $data;
    }
}

$array = ['one' => ['a ', ' b ', ' c'], 'two' => " <a href='test'>Test</a>"];
$string = ' another "test"';

$sanitizer = new Sanitizer();
var_export($sanitizer->sanitize($array));
echo "\n---\n";
var_export($sanitizer->sanitize($string));

输出：

array (
  'one' => 
  array (
    0 => 'a',
    1 => 'b',
    2 => 'c',
  ),
  'two' => '<a href='test'>Test</a>',
)
---
'another "test"'

sanitizeSingle()通过引用修改输入字符串，以便对变量声明任何调整，并且没有return值。

sanitize()不通过引用进行修改；修改后的数据是return编辑的。