<?php  if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class MY_Input extends CI_Input
{
	function _clean_input_keys($str)
	{
		if(preg_match("/^,_[a-z0-9:_\/-]+$/",$str)){
			$str = preg_replace("/,_/","",$str);
		}
                
    	if ( ! preg_match("/^[a-z0-9:_\/-]+$/i", $str))
     	{
     		exit('Disallowed Key Characters.'.$str);
  	 	}
		// Clean UTF-8 if supported
		if (UTF8_ENABLED === TRUE)
		{
			$str = $this->uni->clean_string($str);
		}

		return $str;
	}

	function _fetch_from_array(&$array, $index = '', $xss_clean = FALSE)
	{
		if ( ! isset($array[$index]))
		{
			return FALSE;
		}
		if ($xss_clean === TRUE)
		{
                     if(!is_array($array[$index])){
                            return $this->security->xss_clean($this->Safe($array[$index],$index));
                     }else{
                            foreach($array[$index] as $key => $val) $array[$index][$key] = $this->security->xss_clean($this->Safe($val,$index));
                     }
		}
		return $this->Safe_swf($array[$index]);
	}

	function Safe_swf($string) { 
        		if(is_array($string)) { //如果其为一个数组则循环执行此函数 
            			foreach($string as $key => $val) { 
                			$string[$key] = $this->Safe_swf($val); 
            			} 
        		} else { 
	                   $string = str_replace("allowfullscreen='true'","",$string);
	                   $string = str_replace('allowfullscreen="true"',"",$string);
	                   $string = str_replace("allownetworking='all'","",$string);
	                   $string = str_replace('allownetworking="all"',"",$string);
	                   $string = str_replace("allowscriptaccess='always'","",$string);
	                   $string = str_replace('allowscriptaccess="always"',"",$string);
        		} 
		        return $string;
	}

	function Safe($arr,$index=''){

                 if($index == 'username' || $index == 'useremail' || $index=='uid' || $index=='usernichen' || $index=='user' || $index == 'cs_usera' || $index == 'v_oid' || $index == 'out_trade_no'){
                      $arr=$this->daddslashes($arr);
                 }

		 //正则条件
		 $getfilter = "'|<[^>]*?>|^\\+\/v(8|9)|\\b(and|or)\\b.+?(>|<|=|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
		 $postfilter = "^\\+\/v(8|9)|\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|<\\s*img\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";

		 if (preg_match ( "/" . $getfilter . "/is", $arr ) == 1) { //过滤GET参数
			$arr=''; 
		 }
		 if (preg_match ( "/" . $postfilter . "/is", $arr ) == 1) { //过滤POST参数
			$arr=''; 
		 }
		 return $arr;
	}

	function daddslashes($string) { 
         if(is_array($string)) { //如果其为一个数组则循环执行此函数 
            	foreach($string as $key => $val) { 
                	$string[$key] = $this->daddslashes($val); 
            	} 
		 } else { 
            	$string = htmlspecialchars(addslashes($string),ENT_QUOTES); 
		 }
   		 return $string; 
	} 

} // END class MY_Input
