如果需要调用，可以在对应文件中加入以下代码：

/* 防sql注入，xss攻击*/function actionClean($str){$str=trim($str);$str=strip_tags($str);$str=stripslashes($str);$str=addslashes($str);$str=rawurldecode($str);$str=quotemeta($str);$str=htmlspecialchars($str);//去除特殊字符$str=preg_replace("//|~|!|@|#|\$|%|^|&|*|(|)|_|+|{|}|:||?|[|]|,|.|/|;|'|`|-|=|\||/", "" , $str);$str=preg_replace("/s/", "", $str);//去除空格、换行符、制表符return $str;}//防止sql注入public function actionFilterArr($arr){if(is_array($arr)){foreach($arr as $k => $v){$arr[$k] = $this->actionFilterWords($v);}}else{$arr = $this->actionFilterWords($arr);}return $arr;}//防止xss攻击public function actionFilterWords($str){$farr = array("/]*?)>/isU","/(]*)on[a-zA-Z]+s*=([^>]*>)/isU","/select|insert|update|delete|drop|'|/*|*|+|-|"|../|./|union|into|load_file|outfile|dump/is");$str = preg_replace($farr,'',$str);return $str;}//防止sql注入，xss攻击(2)public function post_check($post) {if(!get_magic_quotes_gpc()) {foreach($post as $key=>$val){$post[$key] = addslashes($val);}}foreach($post as $key=>$val){//把"_"过滤掉$post[$key] = str_replace("_", "_", $val);//把"%"过滤掉$post[$key] = str_replace("%", "%", $val); //sql注入$post[$key] = nl2br($val);//转换html$post[$key] = htmlspecialchars($val); //xss攻击}return $post;}