function the_search_query() {
global $s;
echo wp_specialchars( stripslashes($s), 1 );
}怎么过滤的，找函数wp_specialchars：
formatting.php 107行：
function wp_specialchars( $text, $quotes = 0 ) {
// Like htmlspecialchars except don't double-encode HTML entities
$text = str_replace('&&', '&&', $text);
$text = str_replace('&&', '&&', $text);
$text = preg_replace('/&(?:$|([^#])(?![a-z1-4]{1,8};))/', '&$1', $text);
$text = str_replace('<', '<', $text);
$text = str_replace('>', '>', $text);
if ( 'double' === $quotes ) {
$text = str_replace('"', '"', $text);
} elseif ( 'single' === $quotes ) {
$text = str_replace("'", ''', $text);
} elseif ( $quotes ) {
$text = str_replace('"', '"', $text);
$text = str_replace("'", ''', $text);
}
return $text;
} 过滤的很好但不是关键，看报错找rawurlencode()函数：
classes.php 222行：
function build_query_string() {
$this->query_string = '';
foreach (array_keys($this->query_vars) as $wpvar) {
if ( '' != $this->query_vars[$wpvar] ) {
$this->query_string .= (strlen($this->query_string) < 1) ? '' : '&';
$this->query_string .= $wpvar . '=' . rawurlencode($this->query_vars[$wpvar]);
}
} |
安全中国首页 > 新闻中心 > 其他漏洞