XSS注入我也不怕不怕啦--PHP从框架层面屏蔽XSS的思考和实践

    extract($this->params);    ob_start();    //include template    $file = sprintf('%s/template/%s.tpl.php', TXApp::$app_root, $this->view);    include $file;    $content = ob_get_clean();    return $content;}

public function __construct($storage=array()){    $this->storage = $storage;}public function getIterator(){    foreach ($this->storage as $key => $value){        $key = $this->encode($key);        if (!isset($this->encodes[$key])){            $this->encodes[$key] = $this->encode($value);        }    }    return new ArrayIterator($this->encodes);}public function offsetGet($k){    if (isset($this->storage[$k])){        $key = $this->encode($k);        if (!isset($this->encodes[$key])){            $this->encodes[$key] = $this->encode($this->storage[$k]);        }        return $this->encodes[$key];    }    return null;}public function offsetExists($k){    return isset($this->storage[$k]);}public function offsetUnset($k){            unset($this->storage[$k]);    $k = $this->encode($k);    unset($this->encodes[$k]);}public function offsetSet($k, $value){    $this->storage[$k] = $value;    $this->encodes[$k] = $this->encode($value);}public function count(){    return count($this->storage);}private function encode($value){    if (is_string($value)){        $value = is_string($value) ? htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE) : $value    } elseif (is_array($value)){        $value = new self($value);    }    return $value;}

public function __get($k){    return isset($this->storage[$k]) ? $this->storage[$k] : null;}public function get($key){    return $this->__get($key);}

public function __call($method, $args){    $args[] = &$this->storage;    return call_user_func_array($method, $args);}public function serialize(){    return serialize($this->storage);}public function __invoke(){    return $this->storage ? true : false;}public function keys(){    return array_keys($this->values(false));}