XSS攻击

app/home/common_search.php

@@ -12,7 +12,11 @@ function dropParam($param) {
             $purl['param'][$val] = 0;
         }
     }
-    return urldecode(url('home/'.request()->controller().'/'.request()->action(),$purl['param']));
+    $url_param = [];
+    foreach ($purl['param'] as $k => $v) {
+        $url_param[$k] = urlencode($v);
+    }
+    return url('home/'.request()->controller().'/'.request()->action(),$url_param);
 }
 
 /**
@@ -28,7 +32,7 @@ function replaceParam($param) {
         }
     }
 
-    return urldecode(url('home/'.request()->controller().'/'.request()->action(),$purl['param']));
+    return url('home/'.request()->controller().'/'.request()->action(),$purl['param']);
 }
 
 /**
@@ -49,7 +53,7 @@ function replaceAndDropParam($paramToReplace, $paramToDrop) {
         }
     }
 
-    return urldecode(url('home/'.request()->controller().'/'.request()->action(),$purl['param']));
+    return url('home/'.request()->controller().'/'.request()->action(),$purl['param']);
 }
 
 /**
@@ -77,7 +81,7 @@ function removeParam($param) {
             }
         }
     }
-    return urldecode(url('home/'.request()->controller().'/'.request()->action(),$purl['param']));
+    return url('home/'.request()->controller().'/'.request()->action(),$purl['param']);
 }
 
 function getParam() {

app/home/controller/Search.php

@@ -30,7 +30,6 @@ class Search extends BaseMall {
     }
 
     public function index() {
-
         $this->_model_search = model('search');
         //显示左侧分类
         //默认分类，从而显示相应的属性和品牌