php var_dump 或 print_r 和 html 编码
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/10056074/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
var_dump or print_r and html encoding
提问by Average Joe
<?php
$x = array("<b>","<i>","b","i","<h1>hello</h1>");
print_r ($x);
echo "<hr>";
var_dump ($x);
outputs this in the html source!
在 html 源代码中输出这个！
Array
(
[0] => <b>
[1] => <i>
[2] => b
[3] => i
[4] => <h1>hello</h1>
)
<hr>array(5) {
[0]=>
string(3) "<b>"
[1]=>
string(3) "<i>"
[2]=>
string(1) "b"
[3]=>
string(1) "i"
[4]=>
string(14) "<h1>hello</h1>"
}
obviously, I could have been XSS'ed by that!
How can I make sure that the array values are htmlencoded?
显然，我可能会被 XSS 攻击！
如何确保数组值是 htmlencoded？
回答by Self Evident
While this question has an accepted answer, I think David Morrow's answer is the best/ simplest/ most practical (uses the print_rtrueflag):
虽然这个问题有一个公认的答案，但我认为 David Morrow 的答案是最好的/最简单的/最实用的（使用print_rtrue标志）：
echo "<pre>".htmlentities(print_r($some_array, true))."</pre>";
Never-the-less, here is another solution that uses output buffering:
无论如何，这是使用输出缓冲的另一种解决方案：
<?php
ob_start();
print_r($some_array);
$buffer = ob_get_clean();
echo "<pre>".htmlentities($buffer)."</pre>";
?>
回答by Frodik
I found that knittl's code does not work. I had to make some small changes to get it to work as follows:
我发现 knittl 的代码不起作用。我必须进行一些小的更改才能使其正常工作，如下所示：
array_walk_recursive($inputarray, function(&$v) { $v = htmlspecialchars($v); });
Now this works fine in PHP5.3+
现在这在 PHP5.3+ 中运行良好
回答by David Morrow
Or you could just save the print_r to a string and then escape it using the second parameter set to true.
或者，您可以将 print_r 保存为字符串，然后使用设置为 true 的第二个参数对其进行转义。
$arr = array('<script>alert("hey");</script>');
$str = print_r($arr, true);
echo htmlentities($str);
outputs:
输出：
Array
(
[0] => <script>alert("hey");</script>
)
script is not executed
脚本未执行
回答by Uwe Keim
A function that works for me is described in this PHP manual comment.
这个 PHP 手册注释中描述了一个对我有用的函数。
His function that replaces var_dumpis implemented as:
他替换的函数var_dump实现为：
function htmlvardump()
{
ob_start();
$var = func_get_args();
call_user_func_array('var_dump', $var);
echo htmlentities(ob_get_clean());
}
This works for me in PHP 5.3+.
这在 PHP 5.3+ 中对我有用。
(Please note that there was a typo in the original source).
（请注意，原始来源中有一个错字）。
回答by knittl
A simple solution would be to use array_walk_recursive:
一个简单的解决方案是使用array_walk_recursive：
array_walk_recursive($inputarray, function(&$v) { $v = htmlspecialchars($v); });
回答by Raymond
echo <pre>;
echo htmlspecialchars(print_r($key['value'], true));
echo '</pre>';
I use this code to output an array value (contains adsense code) from no sql database.
我使用此代码从无 sql 数据库输出数组值（包含 adsense 代码）。
回答by Average Joe
Thanks to Knittl, here is What I came up with. works the way I wanted!
感谢 Knittl，这是我想出的。以我想要的方式工作！
<?php
$x = array("tag1" => "<b>","tag2" => "<i>","tag3" => "b","tag4" => "i","tag5" => "<h1>hello</h1>");
echo "<hr><pre>";
blp_print_r ($x);
echo "<hr>";
print_r($x);
echo "</pre><hr>";
/*
outputs this in the browser normal view
new one...
Array
(
['tag1'] => <b>
['tag2'] => <i>
['tag3'] => b
['tag4'] => i
['tag5'] => <h1>hello</h1>
)
traditional one...
Array
(
[tag1] =>
[tag2] =>
[tag3] => b
[tag4] => i
[tag5] =>
hello
)
*/
function blp_print_r($inputarray){
echo "Array\n(\n";
echo "<blockquote>";
array_walk($inputarray,"html_encoder");
echo "</blockquote>";
echo ")";
}
function html_encoder($current_val,$current_key){
echo "['" , htmlentities($current_key, ENT_QUOTES, "UTF-8") , "']", " => ";
echo htmlentities($current_val, ENT_QUOTES, "UTF-8") , "\n";
}
?>
回答by user1935492
I found this page very helpful, but I did modify the functions to be recursive, the walker handler function checks for an array at the value after echoing the key, and then calls back the original function on that array. I think this makes it a true 'recursive htmlentity function hence the new name...
我发现这个页面非常有帮助，但我确实将函数修改为递归，walker 处理函数在回显键后检查该值处的数组，然后回调该数组上的原始函数。我认为这使它成为真正的“递归 htmlentity 函数”，因此有了新名称...
function htmlentities_print_r( $inputarray ) {
echo "<pre>" ;
array_walk( $inputarray , "html_encoder" ) ;
echo "</pre>";
}
function html_encoder($current_val,$current_key){
echo "['" , htmlentities($current_key, ENT_QUOTES, "UTF-8") , "']", " => ";
if ( is_array( $current_val ) ) {
blp_print_r( $current_val ) ;
} else {
echo htmlentities($current_val, ENT_QUOTES, "UTF-8") , "\n";
}
}
