ThinkPHP的使用(五)富文本编辑器的使用以及防xss攻击

• 将下载好的htmlpurifier及ueditor文件夹放入Plugin文件夹下
• 在模板页中引入以下js文件

<script type="text/javascript" charset="utf-8" src="{$Think.config.PLUGIN_URL}ueditor/ueditor.config.js"></script>
<script type="text/javascript" charset="utf-8" src="{$Think.config.PLUGIN_URL}ueditor/ueditor.all.min.js"> </script>
<script type="text/javascript" charset="utf-8" src="{$Think.config.PLUGIN_URL}ueditor/lang/zh-cn/zh-cn.js"></script>
<script type="text/javascript" src="{$Think.config.BACK_JS_URL}jquery-1.7.2.min.js"></script>
<script type="text/javascript">
    UEDITOR_CONFIG.toolbars=[[
        "fullscreen", "source", "|", "undo", "redo", "|",
           "bold", "italic", "underline", "fontborder", "strikethrough", "superscript", "subscript", "removeformat", "formatmatch", "autotypeset", "blockquote", "pasteplain", "|", "forecolor", "backcolor", "insertorderedlist", "insertunorderedlist", "selectall", "cleardoc", "|",
           "rowspacingtop", "rowspacingbottom", "lineheight", "|",
           "customstyle", "paragraph", "fontfamily", "fontsize", "|",
           "directionalityltr", "directionalityrtl", "indent", "|",
           "justifyleft", "justifycenter", "justifyright", "justifyjustify", "|", "touppercase", "tolowercase", "|",
           "link", "unlink", "anchor", "|", "imagenone", "imageleft", "imageright", "imagecenter", "|",
           "simpleupload", "insertimage", "emotion", "scrawl", "insertvideo", "music", "attachment", "map", "gmap", "insertframe", "insertcode", "webapp", "pagebreak", "template", "background", "|",
           "horizontal", "date", "time", "spechars", "snapscreen", "wordimage",
    ]]
</script>
<!--下面是富文本编辑器展示区域-->
 <table border="1" width="100%" class="table_a" id="detail-tab-tb" style="display: none;">
    <tr>
        <td>
            <textarea name="news_content" id="news_content" style="width:730px;height:320px;"></textarea>
        </td>
    </tr>
    <script>
        var ue = UE.getEditor("news_content");                  
    </script>
</table>

• 在function.php文件中引入如下代码:

function fanXSS($string)
{
    require_once "./Plugin/htmlpurifier/HTMLPurifier.auto.php";
    // 生成配置对象
    $cfg = HTMLPurifier_Config::createDefault();
    // 以下就是配置：
    $cfg->set("Core.Encoding", "UTF-8");
    // 设置允许使用的HTML标签
    $cfg->set("HTML.Allowed","div,b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]");
    // 设置允许出现的CSS样式属性
    $cfg->set("CSS.AllowedProperties", "font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align");
    // 设置a标签上是否允许使用target="_blank"
    $cfg->set("HTML.TargetBlank", TRUE);
    // 使用配置生成过滤用的对象
    $obj = new HTMLPurifier($cfg);
    // 过滤字符串
    return $obj->purify($string);    
}

• 然后在Controller中使用：

//添加新闻
public function add(){
    if(IS_POST){
        $news=new ModelNewsModel();
        $data=$news->create();
        $data["news_content"]=fanXSS($_POST["news_content"]);
        if($news->add($data)){
            $this->success("添加新闻成功",U("showlist"),2);
        }else{
            $this->error("添加新闻失败",U("tianjia"),2);
        }
    }else{
        $this->display();
    }
}