post_filter_variables.php

См. документацию.

<?php
 
class CSecurityXSSDetectVariables
{
    private $parsed = false;
    private $searchValuesWithQuotes = array();
    private $searchValuesWithoutQuotes = array();
    private $originalValues = array();

    public function addVariable($name, $value)
    {
        $this->originalValues[$name] = $value;
    }

    public function getQuoteSearchValues()
    {
        $this->lazyParseVariables();
        return $this->searchValuesWithQuotes;
    }

    public function getSearchValues()
    {
        $this->lazyParseVariables();
        return $this->searchValuesWithoutQuotes;
    }

    public function isEmpty()
    {
        return (empty($this->originalValues));
    }

    protected function pushValue($name, $value, $containsQuote = false)
    {
        if($containsQuote)
            $this->searchValuesWithQuotes[] = array("name" => $name, "value" => $value);
        else
            $this->searchValuesWithoutQuotes[] = array("name" => $name, "value" => $value);
 
        return true;
    }

    protected function parseVariable($name, $value)
    {
        if(!$value)
            return;
 
        if(preg_match("/[^\\\](((\\\‍)(\\\‍))*+')+/s"," ".$value))
        {
            $encodedValue = htmlspecialcharsbx($value);
            $this->pushValue(
                $name,
                $value,
                true
            );
 
            if ($encodedValue && $encodedValue !== $value)
            {
                $this->pushValue(
                    $name,
                    $encodedValue,
                    true
                );
            }
        }
        elseif(preg_match("/[^\\\](((\\\‍)(\\\‍))*+\")+/s"," ".$value))
        {
            $this->pushValue(
                $name,
                $value,
                true
            );
        }
        else
        {
            $encodedValue = htmlspecialcharsbx($value);
            $this->pushValue(
                    $name,
                    $value,
                    false
            );
 
            if ($encodedValue && $encodedValue !== $value)
            {
                $this->pushValue(
                    $name,
                    $encodedValue,
                    false
                );
            }
        }
    }

    protected function lazyParseVariables()
    {
        if ($this->parsed)
            return;
 
        $this->parsed = true;
        foreach($this->originalValues as $name => $value)
        {
            $this->parseVariable($name, $value);
        }
    }
}