protected function _checkParameters(array $params, array $posts)
    {
        foreach ($params as $key => $value) {
            $rest = strpbrk($key, '<>=%&"\'');
            if (false !== $rest) {
                $this->setError(
                        $this->_('Illegal request parameter'),
                        422,
                        sprintf($this->_('Illegal character %s in parameter name.'), $rest[0]),
                        true
                );
            }
            if ($value && (!is_object($value)) && (!array_key_exists($key, $posts))) {
                foreach ((array) $value as $val) {
                    // Quickfix
                    // If $val is an array preg_match fails. This is true for export options
                    // If the elements of the array should be checked too, feel free to do so
                    if (is_array($val)) {
                        continue;
                    }
                    // Find not allowed words after <>%&
                    $checks  = ['iframe', 'img', 'script'];
                    $pattern = '/([<>%&])(' . join('|', $checks) . ')/i';
                    if (preg_match($pattern, $val, $matches)) {
                        $this->setError(
                                $this->_('Illegal request parameter'),
                                422,
                                sprintf($this->_('Illegal parameter value containing the text "%s" after a %s character.'), $matches[2], $matches[1]),
                                true
                        );
                    }
                }
            }
        }
    }
protected function _checkParameters(array $params, array $posts)
    {
        foreach ($params as $key => $value) {
            $rest = strpbrk($key, '<>=%&"\'');
            if (false !== $rest) {
                $this->setError(
                        $this->_('Illegal request parameter'),
                        422,
                        sprintf($this->_('Illegal character %s in parameter name.'), $rest[0]),
                        true
                );
            }
            if ($value && (!is_object($value)) && (!array_key_exists($key, $posts))) {
                foreach ((array) $value as $val) {
                    // Quickfix
                    // If $val is an array preg_match fails. This is true for export options
                    // If the elements of the array should be checked too, feel free to do so
                    if (is_array($val)) {
                        continue;
                    }
                    // Find not allowed words after <>%&
                    $checks  = ['iframe', 'img', 'script'];
                    $pattern = '/([<>%&])(' . join('|', $checks) . ')/i';
                    if (preg_match($pattern, $val, $matches)) {
                        $this->setError(
                                $this->_('Illegal request parameter'),
                                422,
                                sprintf($this->_('Illegal parameter value containing the text "%s" after a %s character.'), $matches[2], $matches[1]),
                                true
                        );
                    }
                }
            }
        }
    }
protected function _checkParameters ( array $ params , array $ posts ) { foreach ( $ params as $ key => $ value ) { $ rest = strpbrk ( $ key , '<>=%&"\'' ) ; if ( false !== $ rest ) { $ this -> setError ( $ this -> _ ( 'Illegal request parameter' ) , 422 , sprintf ( $ this -> _ ( 'Illegal character %s in parameter name.' ) , $ rest [ 0 ] ) , true ) ; } if ( $ value && ( ! is_object ( $ value ) ) && ( ! array_key_exists ( $ key , $ posts ) ) ) { foreach ( ( array ) $ value as $ val ) { // Quickfix // If $val is an array preg_match fails. This is true for export options // If the elements of the array should be checked too, feel free to do so if ( is_array ( $ val ) ) { continue ; } // Find not allowed words after <>%& $ checks = [ 'iframe' , 'img' , 'script' ] ; $ pattern = '/([<>%&])(' . join ( '|' , $ checks ) . ')/i' ; if ( preg_match ( $ pattern , $ val , $ matches ) ) { $ this -> setError ( $ this -> _ ( 'Illegal request parameter' ) , 422 , sprintf ( $ this -> _ ( 'Illegal parameter value containing the text "%s" after a %s character.' ) , $ matches [ 2 ] , $ matches [ 1 ] ) , true ) ; } } } } }
Check all parameters for security violations

All variables are checked for name contents: the <>=%&"' characters should not occur in the name.

The non-post variables are checked for value contents as well: after a <>&% there should not occur
a frame, script or img stext.

@param array $params
@param array $posts
Check all parameters for security violations