织梦DedeCMS实现精美多样的提示信息窗口

 // 字符过滤函数  
 function wwwcms_filter($str,$stype="inject") {
   if ($stype=="inject")  {
    $str = str_replace(
           array( "select", "insert", "update", "delete", "alter", "cas", "union", "into", "load_file", "outfile", "create", "join", "where", "like", "drop", "modify", "rename", "'", "/*", "*", "../", "./"),
        array("","","","","","","","","","","","","","","","","","","","","",""),
        $str);
   } else if ($stype=="xss") {
    $farr = array("/\s+/" ,
                  "/<(\/?)(script|META|STYLE|HTML|HEAD|BODY|STYLE |i?frame|b|strong|style|html|img|P|o:p|iframe|u |em|strike|BR|div|a|TABLE|TBODY|object|tr|td |st1:chsdate|FONT|span|MARQUEE|body|title |\r\n|link |meta|\?|\%)([^>]*?)>/isU",
         "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",
         );
    $tarr = array(" ",
                  "",
         "\\1\\2",
         );
    $str = preg_replace($farr, $tarr, $str);
    $str = str_replace(
           array( "<", ">", "'", "\"", ";", "/*", "*", "../", "./"),
        array("&lt;","&gt;","","","","","","",""),
        $str);
   }
   return $str;
  }
 //   /
 //  载入自定义表单（用于发布）
 //  @access    public
 //  @param     string  $fieldset  字段列表
 //  @param     string  $loadtype  载入类型
 //  @return    string
  function AddFilter($channelid, $type=1, $fieldsnamef, $defaulttid, $loadtype='autofield')
  {
   global $tid,$dsql,$id;
   $tid = $defaulttid ? $defaulttid : $tid;
   if ($id!="")
   {
    $tidsq = $dsql->GetOne(" Select typeid From `# @__archives` where id='$id' ");
    $tid = $tidsq["typeid"];
   }
   $nofilter = (isset($_REQUEST['TotalResult']) ? "&TotalResult=".$_REQUEST['TotalResult'] : '').(isset($_REQUEST['PageNo']) ? "&PageNo=".$_REQUEST['PageNo'] : '');
   $filterarr = wwwcms_filter(stripos($_SERVER['REQUEST_URI'], "list.php?tid=") ? str_replace($nofilter, '', $_SERVER['REQUEST_URI']) : $GLOBALS['cfg_cmsurl']."/plus/list.php?tid=".$tid);
      $cInfos = $dsql->GetOne(" Select * From  `# @__channeltype` where id='$channelid' ");
   $fieldset=$cInfos['fieldset'];
   $dtp = new DedeTagParse();
      $dtp->SetNameSpace('field','<','>');
      $dtp->LoadSource($fieldset);
      $dede_addonfields = '';
      if(is_array($dtp->CTags))
      {
          foreach($dtp->CTags as $tid=>$ctag)
          {
              $fieldsname = $fieldsnamef ? explode(",", $fieldsnamef) : explode(",", $ctag->GetName());
     if(($loadtype!='autofield' || ($loadtype=='autofield' && $ctag->GetAtt('autofield')==1)) && in_array($ctag->GetName(), $fieldsname) )
              {
                  $href1 = explode($ctag->GetName().'=', $filterarr);
      $href2 = explode('&', $href1[1]);
      $fields_value = $href2[0];
      $dede_addonfields .= '<div class="scv-shaixuan"><b>'.$ctag->GetAtt('itemname').'：</b>';
      switch ($type) {
       case 1:
   $lola = $ctag->GetName();
   $dederow = $dsql->GetOne("SELECT count($lola) FROM # @__addonarticle WHERE $lola");
   $dederowz = $dederow["count($lola)"];
        $dede_addonfields .= (preg_match("/&".$ctag->GetName()."=/is",$filterarr,$regm) ? '<a title="全部" href="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部('.$dederowz.')</a>' : '<span>全部('.$dederowz.')</span>').'&nbsp;';
        $addonfields_items = explode(",",$ctag->GetAtt('default')); 
        for ($i=0; $i<count($addonfields_items); $i++)
        {
    $lola = $ctag->GetName();
    $lolb = $addonfields_items[$i];
    $dederow = $dsql->GetOne("SELECT count(*) FROM # @__addonarticle WHERE $lola='$lolb'");
    $dederows = $dederow["count(*)"];
         $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);//echo $href;
         $dede_addonfields .= ($fields_value!=urlencode($addonfields_items[$i]) ? '<a title="'.$addonfields_items[$i].'" href="'.$href.'">'.$addonfields_items[$i].'(<span>'.$dederows.'</span>)</a>' : '<span>'.$addonfields_items[$i].'('.$dederows.')</span>')."&nbsp;";
        }
        $dede_addonfields .= '</div>';
       break;     
       case 2:
        $dede_addonfields .= '<select name="filter"'.$ctag->GetName().' onchange="window.location=this.options[this.selectedIndex].value">
         '.'<option value="'.str_replace("&".$ctag->GetName()."=".$fields_value,"",$filterarr).'">全部</option>';
        $addonfields_items = explode(",",$ctag->GetAtt('default'));
        for ($i=0; $i<count($addonfields_items); $i++)
        {
         $href = stripos($filterarr,$ctag->GetName().'=') ? str_replace("=".$fields_value,"=".urlencode($addonfields_items[$i]),$filterarr) : $filterarr.'&'.$ctag->GetName().'='.urlencode($addonfields_items[$i]);
         $dede_addonfields .= '<option value="'.$href.'"'.($fields_value==urlencode($addonfields_items[$i]) ? ' selected="selected"' : '').'>'.$addonfields_items[$i].'</option>
         ';
        }
        $dede_addonfields .= '</select><br/>
        ';
       break;
      }
              }
          }
      }
   echo $dede_addonfields;
 }