Input variable I ()

In the process of web development, we often need to obtain system variables or user-submitted data, these variable data is complicated, and it is easy to cause security risks, but if you take advantage of the variable thinkphp provided by the function, you can easily get and ride the variable.

Get variable

Although you can still use the traditional way to obtain various system variables during the development process, for example:

2. $id = $_GET[‘id‘]; // 获取get变量
4. $name = $_POST[‘name‘]; // 获取post变量
6. $value = $_SESSION[‘var‘]; // 获取session变量
8. $name = $_COOKIE[‘name‘]; // 获取cookie变量
10. $file = $_SERVER[‘PHP_SELF‘]; // 获取server变量

However, we do not recommend the direct use of traditional methods to obtain, because there is no unified security processing mechanism, later if the adjustment, the change will be more troublesome. Therefore, a better approach is to use the I function uniformly in the framework for variable acquisition and filtering.

The I method is thinkphp for more convenient and secure access to the system input variables, which can be used anywhere, in the following format:

I (' Variable type ', ' variable name/modifier ', [' Default '],[' Filter method '],[' extra data source '])

The type of the variable refers to the type of request or input, including:

Variable Type	meaning
Get	Get Get Parameters
Post	Get Post Parameters
Param	Automatically determine request type get get, post or put parameters
Request	Get the request parameter
Put	Get put parameters
Session	Get $_session parameter
Cookies	Get $_cookie parameter
Server	Get $_server parameter
Globals	Get $GLOBALS parameters
Path	Gets the URL parameter for the pathinfo mode (3.2.2 New)
Data	Get other types of parameters that need to mate with additional data source parameters (3.2.2 New)

Note: Variable types are not case-sensitive.
Variable names are strictly case-sensitive.
Both the default and filtering methods are optional parameters.

The variable modifier is 3.2. Version 3 added

We take the get variable type as an example to illustrate the use of the next I method:

1. echo I(‘get.id‘); // 相当于 $_GET[‘id‘]
2. echo I(‘get.name‘); // 相当于 $_GET[‘name‘]

Default values are supported:

1. echo I(‘get.id‘,0); // 如果不存在$_GET[‘id‘] 则返回0
2. echo I(‘get.name‘,‘‘); // 如果不存在$_GET[‘name‘] 则返回空字符串

Filter by Method:

1. // 采用htmlspecialchars方法对$_GET[‘name‘] 进行过滤，如果不存在则返回空字符串
2. echo I(‘get.name‘,‘‘,‘htmlspecialchars‘);

Supports direct access to the entire variable type, for example:

1. // 获取整个$_GET 数组
2. I(‘get.‘);

In the same way, we can get the variables of post or other input types, for example:

2. I(‘post.name‘,‘‘,‘htmlspecialchars‘); // 采用htmlspecialchars方法对$_POST[‘name‘] 进行过滤，如果不存在则返回空字符串
4. I(‘session.user_id‘,0); // 获取$_SESSION[‘user_id‘] 如果不存在则默认为0
6. I(‘cookie.‘); // 获取整个 $_COOKIE 数组
8. I(‘server.REQUEST_METHOD‘); // 获取 $_SERVER[‘REQUEST_METHOD‘]

The Param variable type is a framework-specific method of obtaining a variable that automatically determines the current request type, for example:

echo I(‘param.id‘);

If the current request type is get, then it is equivalent to $_get[' ID '), if the current request type is POST or put, then it is equivalent to getting $_post[' id ' or put parameter ID.

Because the Param type is the variable type that is obtained by default for the I function, the fact that the Param variable type can be simplified to:

1. I(‘id‘); // 等同于 I(‘param.id‘)
2. I(‘name‘); // 等同于 I(‘param.name‘)

3.2.2 has been added path和data两个变量类型 with the following usage:

The path type variable can be used to get the URL parameter (the pathinfo mode parameter must be valid, either get or post), for example: the current Access URL address ishttp://serverName/index.php/New/2013/06/01

Then we can pass

1. echo I(‘path.1‘); // 输出2013
2. echo I(‘path.2‘); // 输出06
3. echo I(‘path.3‘); // 输出01

The data type variable can be used to get a read of an unsupported variable type, for example:

1. I(‘data.file1‘,‘‘,‘‘,$_FILES);

Variable filtering

If you do not specify a filtering method when invoking the I function, the system will use the default filtering mechanism (configured by Default_filter), in fact, the default setting for this parameter is:

1. // 系统默认的变量过滤机制
2. ‘DEFAULT_FILTER‘ => ‘htmlspecialchars‘

It is also said that all the acquired variables of the I method will be htmlspecialchars filtered if no filtering method is set, then:

1. // 等同于 htmlspecialchars($_GET[‘name‘])
2. I(‘get.name‘);

Similarly, this parameter can also be set to support multiple filters, for example:

1. ‘DEFAULT_FILTER‘ => ‘strip_tags,htmlspecialchars‘

After setting up, we are using:

1. // 等同于 htmlspecialchars(strip_tags($_GET[‘name‘]))
2. I(‘get.name‘);

If we specify a filtering method when using the I method, the Default_filter setting is ignored, for example:

1. // 等同于 strip_tags($_GET[‘name‘])
2. echo I(‘get.name‘,‘‘,‘strip_tags‘);

The third parameter of the I method, if passed in the function name, means that the function is called to filter the variable and returns (automatically used for filtering if the variable is an array array_map ), otherwise the PHP built-in method is called for filter_var filtering processing, for example:

1. I(‘post.email‘,‘‘,FILTER_VALIDATE_EMAIL);

Indicates that the $_POST[‘email‘] format is validated and an empty string is returned if the requirement is not met. (For more verification formats, you can refer to the usage of the official manual filter_var .) ) or you can use the following characters to identify the way:

1. I(‘post.email‘,‘‘,‘email‘);

The filter names that can be supported must be filter_list valid values in the method (different server environments may vary) and may support the following:

2. int
4. boolean
6. float
8. validate_regexp
10. validate_url
12. validate_email
14. validate_ip
16. string
18. stripped
20. encoded
22. special_chars
24. unsafe_raw
26. email
28. url
30. number_int
32. number_float
34. magic_quotes
36. callback

The 3.2.3 version begins to support regular match filtering, for example:

1. // 采用正则表达式进行变量过滤
2. I(‘get.name‘,‘‘,‘/^[A-Za-z]+$/‘);
3. I(‘get.id‘,0,‘/^\d+$/‘);

If the regular match does not pass, the default value is returned.

In some special cases, we do not want to do any filtering, even if the default_filter has been set, you can use:

1. // 下面两种方式都不采用任何过滤方法
2. I(‘get.name‘,‘‘,‘‘);
3. I(‘get.id‘,‘‘,false);

Once the filter parameter is set to an empty string or false, any filtering is no longer performed.

Variable modifiers

Beginning with the 3.2.3 version, the I function supports the use of modifiers on variables, which allows for better filtering of variables.

Usage is as follows: I (' variable type. Variable name/modifier ');

For example:

1. I(‘get.id/d‘);
2. I(‘post.name/s‘);
3. I(‘post.ids/a‘);

The modifiers you can use include:

modifier	function
S	Cast to String type
D	Cast to shaping type
B	Cast to Boolean type
A	Cast to array type
F	Cast to floating-point type

Input variable I ()