CI框架的安全性分析

echo form_input('username', 'johndoe');

function form_prep($str = '')
{
  if ($str === '')
  {
    return '';
  }
  $temp = '__TEMP_AMPERSANDS__';
  // Replace entities to temporary markers so that
  // htmlspecialchars won't mess them up
  $str = preg_replace("/&#(\d+);/", "$temp\\1;", $str);
  $str = preg_replace("/&(\w+);/", "$temp\\1;", $str);
  $str = htmlspecialchars($str);
  // In case htmlspecialchars misses these.
  $str = str_replace(array("'", '"'), array("'", """), $str);
  // Decode the temp markers back to entities
  $str = preg_replace("/$temp(\d+);/","&#\\1;",$str);
  $str = preg_replace("/$temp(\w+);/","&\\1;",$str);
  return $str;
}

echo form_input('username', 'johndoe');