php 对输入信息的进行安全过滤的函数代码

// define constannts for input reading
define('input_get', 0x0101);
define('input_post', 0x0102);
define('input_gpc', 0x0103);

/**
* read input value and convert it for internal use
* performs stripslashes() and charset conversion if necessary
*
* @param string field name to read
* @param int source to get value from (gpc)
* @param boolean allow html tags in field value
* @param string charset to convert into
* @return string field value or null if not available
*/
function get_input_value($fname, $source, $allow_html=false, $charset=null) {
$value = null;

if ($source == input_get && isset($_get[$fname]))
$value = $_get[$fname];
else if ($source == input_post && isset($_post[$fname]))
$value = $_post[$fname];
else if ($source == input_gpc) {
if (isset($_post[$fname]))
$value = $_post[$fname];
else if (isset($_get[$fname]))
$value = $_get[$fname];
else if (isset($_cookie[$fname]))
$value = $_cookie[$fname];
}

if (empty($value))
return $value;

// strip single quotes if magic_quotes_sybase is enabled
if (ini_get('magic_quotes_sybase'))
$value = str_replace("''", "'", $value);
// strip slashes if magic_quotes enabled
else if (get_magic_quotes_gpc() || get_magic_quotes_runtime())
$value = stripslashes($value);

// remove html tags if not allowed
if (!$allow_html)
$value = strip_tags($value);

// convert to internal charset
return $value;
}

用法：get_input_value('_uid', input_get)