等可能引入恶意内容或恶意改变显示布局的代码,如果不需要插入flash等,还可以加入的过滤 "/<(\/?)(script|i?frame|style|html|body|title|link|meta|\?|\%)([^>]*?)>/isU", "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",//过滤javascript的on事件 ); $tarr = array( " ", "＜\1\2\3＞",//如果要直接清除不安全的标签，这里可以留空 "\1\2", ); $str = preg_replace($farr, $tarr, $str); //$str = addslashes($str); // return addslashes($str); } // 获取参数 type,token $query = check_form($_GET['query']); $token = check_form($_GET['token']); $host = "https://yzms.fsecity.com"; //$host = "http://127.0.0.1:9021"; $apiUrl = $host . "/api/Dishes/noticelist?token=".$token; $userInfo = httpGet($apiUrl); $userInfo = json_decode($userInfo, 1); if(empty($userInfo)){ echo " "; exit; } $user = $userInfo['data']['user']; if(empty($user)){ echo " "; exit; } ?>