original_string: protected function _checkParameters(array $params, array $posts)
      {
          foreach ($params as $key => $value) {
              $rest = strpbrk($key, '<>=%&"\'');
              if (false !== $rest) {
                  $this->setError(
                          $this->_('Illegal request parameter'),
                          422,
                          sprintf($this->_('Illegal character %s in parameter name.'), $rest[0]),
                          true
                  );
              }
              if ($value && (!is_object($value)) && (!array_key_exists($key, $posts))) {
                  foreach ((array) $value as $val) {
                      // Quickfix
                      // If $val is an array preg_match fails. This is true for export options
                      // If the elements of the array should be checked too, feel free to do so
                      if (is_array($val)) {
                          continue;
                      }
                      // Find not allowed words after <>%&
                      $checks  = ['iframe', 'img', 'script'];
                      $pattern = '/([<>%&])(' . join('|', $checks) . ')/i';
                      if (preg_match($pattern, $val, $matches)) {
                          $this->setError(
                                  $this->_('Illegal request parameter'),
                                  422,
                                  sprintf($this->_('Illegal parameter value containing the text "%s" after a %s character.'), $matches[2], $matches[1]),
                                  true
                          );
                      }
                  }
              }
          }
      }
code: protected function _checkParameters(array $params, array $posts)
      {
          foreach ($params as $key => $value) {
              $rest = strpbrk($key, '<>=%&"\'');
              if (false !== $rest) {
                  $this->setError(
                          $this->_('Illegal request parameter'),
                          422,
                          sprintf($this->_('Illegal character %s in parameter name.'), $rest[0]),
                          true
                  );
              }
              if ($value && (!is_object($value)) && (!array_key_exists($key, $posts))) {
                  foreach ((array) $value as $val) {
                      // Quickfix
                      // If $val is an array preg_match fails. This is true for export options
                      // If the elements of the array should be checked too, feel free to do so
                      if (is_array($val)) {
                          continue;
                      }
                      // Find not allowed words after <>%&
                      $checks  = ['iframe', 'img', 'script'];
                      $pattern = '/([<>%&])(' . join('|', $checks) . ')/i';
                      if (preg_match($pattern, $val, $matches)) {
                          $this->setError(
                                  $this->_('Illegal request parameter'),
                                  422,
                                  sprintf($this->_('Illegal parameter value containing the text "%s" after a %s character.'), $matches[2], $matches[1]),
                                  true
                          );
                      }
                  }
              }
          }
      }
code_tokens: protected function _checkParameters ( array $ params , array $ posts ) { foreach ( $ params as $ key => $ value ) { $ rest = strpbrk ( $ key , '<>=%&"\'' ) ; if ( false !== $ rest ) { $ this -> setError ( $ this -> _ ( 'Illegal request parameter' ) , 422 , sprintf ( $ this -> _ ( 'Illegal character %s in parameter name.' ) , $ rest [ 0 ] ) , true ) ; } if ( $ value && ( ! is_object ( $ value ) ) && ( ! array_key_exists ( $ key , $ posts ) ) ) { foreach ( ( array ) $ value as $ val ) { // Quickfix // If $val is an array preg_match fails. This is true for export options // If the elements of the array should be checked too, feel free to do so if ( is_array ( $ val ) ) { continue ; } // Find not allowed words after <>%& $ checks = [ 'iframe' , 'img' , 'script' ] ; $ pattern = '/([<>%&])(' . join ( '|' , $ checks ) . ')/i' ; if ( preg_match ( $ pattern , $ val , $ matches ) ) { $ this -> setError ( $ this -> _ ( 'Illegal request parameter' ) , 422 , sprintf ( $ this -> _ ( 'Illegal parameter value containing the text "%s" after a %s character.' ) , $ matches [ 2 ] , $ matches [ 1 ] ) , true ) ; } } } } }
docstring: Check all parameters for security violations
  
  All variables are checked for name contents: the <>=%&"' characters should not occur in the name.
  
  The non-post variables are checked for value contents as well: after a <>&% there should not occur
  a frame, script or img stext.
  
  @param array $params
  @param array $posts
docstring_tokens: Check all parameters for security violations