+ $transfer = new ftp(request_var('host', ''), request_var('username', ''), $request->untrimed_variable('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));

+ $transfer = new ftp_fsock(request_var('host', ''), request_var('username', ''), $request->untrimed_variable('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));

+ $transfer = new $method(request_var('host', ''), request_var('username', ''), $request->untrimed_variable('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));

+ global $phpbb_dispatcher, $request;

+ 'new_password' => $request->untrimed_variable('new_password', '', true),

+ 'password_confirm' => $request->untrimed_variable('password_confirm', '', true),

+ $password = $request->untrimed_variable('password_' . $credential, '', true);

+ $password = $request->untrimed_variable('password', '', true);

+ * Get a variable, but without trimming strings

+ * Same functionality as variable(), except does not run trim() on strings

+ * All variables in GET or POST requests should be retrieved through this function to maximise security.

+ *

+ * @param string|array $var_name The form variable's name from which data shall be retrieved.

+ * If the value is an array this may be an array of indizes which will give

+ * direct access to a value at any depth. E.g. if the value of "var" is array(1 => "a")

+ * then specifying array("var", 1) as the name will return "a".

+ * @param mixed $default A default value that is returned if the variable was not set.

+ * This function will always return a value of the same type as the default.

+ * @param bool $multibyte If $default is a string this paramater has to be true if the variable may contain any UTF-8 characters

+ * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks

+ * @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global

+ * Specifies which super global should be used

+ *

+ * @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the

+ * the same as that of $default. If the variable is not set $default is returned.

+ */

+ public function untrimed_variable($var_name, $default, $multibyte, $super_global = phpbb_request_interface::REQUEST)

+ {

+ $path = false;

+

+ // deep direct access to multi dimensional arrays

+ if (is_array($var_name))

+ {

+ $path = $var_name;

+ // make sure at least the variable name is specified

+ if (empty($path))

+ {

+ return (is_array($default)) ? array() : $default;

+ }

+ // the variable name is the first element on the path

+ $var_name = array_shift($path);

+ }

+

+ if (!isset($this->input[$super_global][$var_name]))

+ {

+ return (is_array($default)) ? array() : $default;

+ }

+ $var = $this->input[$super_global][$var_name];

+

+ if ($path)

+ {

+ // walk through the array structure and find the element we are looking for

+ foreach ($path as $key)

+ {

+ if (is_array($var) && isset($var[$key]))

+ {

+ $var = $var[$key];

+ }

+ else

+ {

+ return (is_array($default)) ? array() : $default;

+ }

+ }

+ }

+

+ $this->type_cast_helper->recursive_set_var($var, $default, $multibyte, false);

+

+ return $var;

+ }

+

+ /**

+ * @param bool $trim Indicates whether string values will be be parsed with trim()

+ * Default is true

+ public function set_var(&$result, $var, $type, $multibyte = false, $trim = true)

+ $result = str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result);

+

+ if ($trim)

+ {

+ $result = trim($result);

+ }

+

+ * @param bool $trim Indicates whether string values will be be parsed with trim()

+ * Default is true

+ public function recursive_set_var(&$var, $default, $multibyte, $trim = true)

+ $this->set_var($var, $var, $type, $multibyte, $trim);

+ $this->set_var($k, $k, $key_type, $multibyte, $trim);

+ $this->recursive_set_var($v, $default_value, $multibyte, $trim);

+ 'new_password' => $request->untrimed_variable('new_password', '', true),

+ 'cur_password' => $request->untrimed_variable('cur_password', '', true),

+ 'password_confirm' => $request->untrimed_variable('password_confirm', '', true),

+ 'new_password' => $request->untrimed_variable('new_password', '', true),

+ 'password_confirm' => $request->untrimed_variable('password_confirm', '', true),

+ $transfer = new $method(request_var('host', ''), request_var('username', ''), $request->untrimed_variable('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));

+ $transfer = new $method(request_var('host', ''), request_var('username', ''), $request->untrimed_variable('password', ''), request_var('root_path', ''), request_var('port', ''), request_var('timeout', ''));

+

+ public function test_untrimmed_strings()

+ {

+ $data = array(' eviL<3 ');

+ $expected = array(' eviL&lt;3 ');

+

+ $this->type_cast_helper->recursive_set_var($data, '', true, false);

+

+ $this->assertEquals($expected, $data);

+ }