diff --git a/class/Api.php b/class/Api.php
index 9eb6d9c..9c761c0 100755
--- a/class/Api.php
+++ b/class/Api.php
@@ -213,13 +213,22 @@ class Api {
     protected function auth($token){
         // 当方法没有传递token的时候，则先尝试通过POST/GET获取token
         if( empty($token) ) {
-            $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+            if ( !empty($_POST['token']) ) {
+                $token = $_POST['token'];
+            }
+            else if ( isset($_GET['token']) ) {
+                $token = $_GET['token'];
+            }
+            else {
+                $token = '';
+            }
         }
         //计算正确的token：用户名 + TOKEN
-        $SecretKey = @$this->db->get('on_options','*',[ 'key'  =>  'SecretKey' ])['value'];
+        $secret_row = $this->db->get('on_options','*',[ 'key'  =>  'SecretKey' ]);
+        $SecretKey = $secret_row['value'] ?? '';
         $token_yes = md5(USER.$SecretKey);
         //获取header中的X-token
-        $xtoken = $_SERVER['HTTP_X_TOKEN'];
+        $xtoken = $_SERVER['HTTP_X_TOKEN'] ?? '';
 
         //如果通过header传递token，且验证通过
         if( !empty($xtoken) && ($xtoken === $token_yes) ) {
@@ -300,7 +309,7 @@ class Api {
      * 批量修改链接分类
      */
     public function batch_modify_category($data) {
-        $this->auth($token);
+        $this->auth(null);
         //获取链接ID，是一个数组
         $id = implode(',',$data['id']);
         //获取分类ID
@@ -331,7 +340,7 @@ class Api {
      * 批量修改链接属性为公有或私有
      */
     public function set_link_attribute($data) {
-        $this->auth($token);
+        $this->auth(null);
         //获取链接ID，是一个数组
         $ids = implode(',',$data['ids']);
         $property = intval($data['property']);
@@ -352,7 +361,7 @@ class Api {
      * 
      */
     public function set_cat_batch($data) {
-        $this->auth($token);
+        $this->auth(null);
         //获取链接ID，是一个数组
         $ids = implode(',',$data['ids']);
         $property = intval($data['property']);
@@ -466,7 +475,7 @@ class Api {
         //过滤$filename
         $filename = str_replace('../','',$filename);
         $filename = str_replace('./','',$filename);
-        $this->auth($token);
+        $this->auth(null);
         //检查文件是否存在
         if ( !file_exists($filename) ) {
             $this->err_msg(-1016,'File does not exist!');
@@ -623,7 +632,7 @@ class Api {
      */
     public function general_upload($path,$suffixs){
         // 验证权限
-        $this->auth($token);
+        $this->auth(null);
         // 存在错误，上传失败
         if ($_FILES["file"]["error"] > 0)
         {
@@ -1043,7 +1052,7 @@ class Api {
      */
     public function edit_link_row(){
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         
         // 获取POST请求中的JSON数据
         $json_data = file_get_contents('php://input');
@@ -1164,11 +1173,11 @@ class Api {
         $offset = ($page - 1) * $limit;
 
         // 验证登录或 token
-        if ($this->is_login() || (!empty($token) && $this->auth($token))) {
+        if ($this->is_login() || (!empty($token) && $this->auth(null))) {
             $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
             $count = $this->db->count('on_categorys', '*');
         } elseif (!empty($token)) {
-            $this->auth($token);
+            $this->auth(null);
             $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname,(SELECT COUNT(id) FROM on_links WHERE fid = a.id) AS link_num FROM on_categorys as a ORDER BY fid ASC, weight DESC, id ASC";
             $count = $this->db->count('on_categorys', '*');
         } else {
@@ -1253,12 +1262,12 @@ class Api {
         $count = $this->db->count('on_links','*');
         
         //如果成功登录，但token为空，获取所有
-        if( $this->is_login() || ( !empty($token) && $this->auth($token) ) ){
+        if( $this->is_login() || ( !empty($token) && $this->auth(null) ) ){
             $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
         }
         
         //如果token验证通过
-        elseif( (!empty($token)) && ($this->auth($token)) ) {
+        elseif( (!empty($token)) && ($this->auth(null)) ) {
             $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
         }
         //如果通过header传递的token验证成功，则获取所有
@@ -1320,7 +1329,7 @@ class Api {
         // }
         
         //如果token验证通过
-        elseif( (!empty($token)) && ($this->auth($token)) ) {
+        elseif( (!empty($token)) && ($this->auth(null)) ) {
             $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = on_links.fid) AS category_name FROM on_links WHERE fid = $fid ORDER BY weight DESC,id DESC LIMIT {$limit} OFFSET {$offset}";
         }
         //如果即没有登录成功，又没有token，则默认为游客,游客查询链接属性为公有，分类为公有，不查询私有
@@ -1365,7 +1374,7 @@ class Api {
             //分类属性为1，则说明是私有链接，则未认证用户不允许查询
             if( $category_property === 1 ){
                 //进行认证
-                $this->auth($token);
+                $this->auth(null);
             }
             $datas = [
                 'code'      =>  0,
@@ -1375,7 +1384,7 @@ class Api {
         }
         //如果是私有链接，并且认证通过
         elseif( $link_info['property'] == "1" ) {
-            if ( ( $this->auth($token) ) || ( $this->is_login() ) ) {
+            if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
                 $datas = [
                     'code'      =>  0,
                     'data'      =>  $link_info
@@ -1418,7 +1427,7 @@ class Api {
         }
         //如果是私有链接，并且认证通过
         elseif( $category_info['property'] == "1" ) {
-            if ( ( $this->auth($token) ) || ( $this->is_login() ) ) {
+            if ( ( $this->auth(null) ) || ( $this->is_login() ) ) {
                 $datas = [
                     'code'      =>  0,
                     'data'      =>  $category_info
@@ -1441,9 +1450,9 @@ class Api {
      * 验证是否登录
      */
     protected function is_login(){
-        $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']);
+        $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
         //获取session
-        $session = $_COOKIE['key'];
+        $session = $_COOKIE['key'] ?? '';
         //如果已经成功登录
         if($session == $key) {
             return true;
@@ -1806,7 +1815,7 @@ class Api {
             if( $insert_re ) {
                 $data = [
                     "code"      =>  0,
-                    "data"      =>  $name."更新完成！总数${num}，成功：${init_num}"
+                    "data"      =>  $name."更新完成！总数{$num}，成功：{$init_num}"
                 ];
                 exit(json_encode($data));
             }
@@ -1822,7 +1831,7 @@ class Api {
      * 保存主题参数
      */
     public function save_theme_config($data) {
-        $this->auth($token);
+        $this->auth(null);
         //获取主题名称
         $name = $data['name'];
         //获取config参数,是一个对象
@@ -1850,7 +1859,7 @@ class Api {
      */
     public function delete_theme($name) {
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         //正则判断主题名称是否合法
         $pattern = "/^[a-zA-Z0-9][a-zA-Z0-9-_]+[a-zA-Z0-9]$/";
         if ( !preg_match($pattern,$name) ) {
@@ -1973,7 +1982,7 @@ class Api {
      */
     public function set_option($key,$value = '') {
         // 验证授权
-        $this->auth($token);
+        $this->auth(null);
         $key = htmlspecialchars(trim($key));
         //如果key是空的
         if( empty($key) ) {
@@ -2025,7 +2034,7 @@ class Api {
      */
     public function new_set_option(){
         // 验证授权
-        $this->auth($token);
+        $this->auth(null);
         // 获取key
         $key = trim(@$_POST['key']);
         // 获取value
@@ -2132,7 +2141,7 @@ class Api {
      */
     public function check_subscribe() {
         //验证token是否合法
-        $this->auth($token);
+        $this->auth(null);
         //获取订阅信息
         //获取当前站点信息
         $subscribe = $this->db->get('on_options','value',[ 'key'  =>  "s_subscribe" ]);
@@ -2191,9 +2200,9 @@ class Api {
         $key = $data['key'];
         $value = $data['value'];
         //拼接主题URL
-        $url = API_URL."/v1/down_theme.php?name=${name}&key=${key}&value=${value}";
+        $url = API_URL."/v1/down_theme.php?name={$name}&key={$key}&value={$value}";
         //验证token是否合法
-        $this->auth($token);
+        $this->auth(null);
         //检查主题是否已经存在
         if ( $data['type'] == 'download' ) {
             $theme1 = "templates/".$name;
@@ -2223,7 +2232,7 @@ class Api {
             $theme_dir = "templates";
         }
         //主题完整压缩包路径
-        $file_name = $theme_dir."/${name}.tar.gz";
+        $file_name = $theme_dir."/{$name}.tar.gz";
         if( !is_dir($theme_dir) ) {
             mkdir($theme_dir,0755);
         }
@@ -2233,7 +2242,7 @@ class Api {
             //下载主题，并设置超时时间为120s
             $content = $this->curl_get($url,120);
             //写入主题
-            $re = file_put_contents($theme_dir."/${name}.tar.gz",$content);
+            $re = file_put_contents($theme_dir."/{$name}.tar.gz",$content);
             //如果写入主题失败了，说明权限不粗糙
             if( !$re ) {
                 $this->return_json(-2000,'','主题写入失败，请检查目录权限！');
@@ -2242,7 +2251,7 @@ class Api {
                 //解压文件
                 $phar = new PharData($file_name);
                 //路径 要解压的文件 是否覆盖
-                $phar->extractTo($theme_dir."/${name}", null, true);
+                $phar->extractTo($theme_dir."/{$name}", null, true);
                 //删除主题
                 unlink($file_name);
                 $this->return_json(200,'','主题下载成功！');
@@ -2263,16 +2272,19 @@ class Api {
         //获取订阅SESSION状态
         session_start();
         //获取session订阅状态
-        $is_subscribe = $_SESSION['subscribe'];
+        $is_subscribe = $_SESSION['subscribe'] ?? null;
         //如果订阅是空的，则请求接口获取订阅状态
         if ( !isset($is_subscribe) ) {
             //获取当前站点信息
             $subscribe = $this->db->get('on_options','value',[ 'key'  =>  "s_subscribe" ]);
-            $domain = $_SERVER['HTTP_HOST'];
+            $domain = $_SERVER['HTTP_HOST'] ?? '';
         
-            $subscribe = unserialize($subscribe);
+            $subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
+            if ( !is_array($subscribe) ) {
+                $subscribe = [];
+            }
             //api请求地址
-            $api_url = API_URL."/v1/check_subscribe.php?order_id=".$subscribe['order_id']."&email=".$subscribe['email']."&domain=".$domain;
+            $api_url = API_URL."/v1/check_subscribe.php?order_id=".($subscribe['order_id'] ?? '')."&email=".($subscribe['email'] ?? '')."&domain=".$domain;
             // echo $api_url;
             try {
                 #GET HTTPS
@@ -2466,7 +2478,7 @@ class Api {
      */
     public function backup_db(){
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         //验证订阅
         $this->check_is_subscribe();
@@ -2500,7 +2512,7 @@ class Api {
      */
     public function backup_db_list() {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
         //验证订阅
         $this->check_is_subscribe();
 
@@ -2577,7 +2589,7 @@ class Api {
      */
     public function del_backup_db($name) {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         //验证订阅
         $this->check_is_subscribe();
@@ -2607,7 +2619,7 @@ class Api {
      */
     public function restore_db($name) {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         //验证订阅
         $this->check_is_subscribe();
@@ -2659,7 +2671,7 @@ class Api {
      */
     public function down_db($name) {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         //使用正则表达式判断数据库名称是否合法
         $pattern = '/^onenav_[0-9\-]+_[0-9.]+(db3)$/';
@@ -2704,7 +2716,7 @@ class Api {
      */
     public function create_share($data) {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         //如果订阅不存在
         if ( $this->is_subscribe() === FALSE ) {
@@ -2753,7 +2765,7 @@ class Api {
      */
     public function share_list($data){
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         $limit = $data['limit'];
         $offset = ($data['page'] - 1) * $data['limit'];
@@ -2856,7 +2868,7 @@ class Api {
      */
     public function del_share($data) {
         //验证请求
-        $this->auth($token);
+        $this->auth(null);
 
         $id = $data['id'];
 
@@ -2894,7 +2906,7 @@ class Api {
      */
     public function del_link_icon(){
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
 
         //获取图标路径
         $icon_path = trim($_POST['icon_path']);
@@ -2929,7 +2941,7 @@ class Api {
         } elseif(isset($_GET[$param])) {
             return $_GET[$param];
         } else {
-            return null;
+            return '';
         }
     }
 
@@ -2938,7 +2950,7 @@ class Api {
      */
     public function global_search() {
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         // 获取关键词
         $keyword = htmlspecialchars( $this->getData("keyword") );
 
@@ -2999,7 +3011,7 @@ class Api {
      */
     public function update_link_order(){
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         // 获取分类ID
         $cid = intval($this->getData("category_id"));
         // 获取json对象数据
@@ -3031,7 +3043,7 @@ class Api {
      */
     public function get_subscribe() {
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         //获取当前站点信息
         $subscribe = $this->db->get('on_options','value',[ 'key'  =>  "s_subscribe" ]);
         $subscribe = unserialize($subscribe);
@@ -3045,7 +3057,7 @@ class Api {
     public function get_subscribe_status(){
         // var_dump($_SERVER['HTTP_HOST']);
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         // 获取订阅结果
         $result = $this->is_subscribe();
 
@@ -3064,7 +3076,7 @@ class Api {
     public function batch_check_links(){
         set_time_limit(1200); // 设置执行最大时间为20分钟
         // 验证授权
-        $this->auth($token);
+        $this->auth(null);
 
         // 验证订阅
         $this->check_is_subscribe();
@@ -3226,7 +3238,7 @@ class Api {
         // 设置超时时间为120s
         set_time_limit(120);
         // 验证授权
-        $this->auth($token);
+        $this->auth(null);
 
         // 验证订阅
         $this->check_is_subscribe();
@@ -3406,7 +3418,7 @@ class Api {
      */
     private function get_options($key) {
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         //获取当前站点信息
         $options = $this->db->get('on_options','value',[ 'key'  =>  $key ]);
         // 判断查询结果是否为空
@@ -3424,7 +3436,7 @@ class Api {
      */
     public function get_option_base(){
         //验证授权
-        $this->auth($token);
+        $this->auth(null);
         // 获取key 
         $key = htmlspecialchars( trim( $_GET['key'] ));
         $options = $this->db->get('on_options','value',[ 'key'  =>  $key ]);
@@ -3442,7 +3454,7 @@ class Api {
      */
     public function forward_order(){
         //验证token是否合法
-        $this->auth($token);
+        $this->auth(null);
         // 声明一个空数组，作为请求体
         $data = [];
         if (!empty($_GET)) {
@@ -3533,7 +3545,7 @@ class Api {
 
     // 获取相临的版本
     public function getNextVersion(){
-        $this->auth($token);
+        $this->auth(null);
         // 获取当前版本
         $version = trim($_GET['version']);
         // 正则判断版本是否合法，只能是数组或.组成
diff --git a/controller/admin.php b/controller/admin.php
index 9bd6b9f..cf8d1b8 100755
--- a/controller/admin.php
+++ b/controller/admin.php
@@ -41,10 +41,11 @@ if( $page == 'index' ) {
 //如果页面是修改edit_category
 if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == 'add_category_new') ) {
     //获取id
-    $id = intval($_GET['id']);
+    $id = intval($_GET['id'] ?? 0);
     //查询单条分类信息
     $sql = "SELECT *,(SELECT name FROM on_categorys WHERE id = a.fid LIMIT 1) AS fname FROM on_categorys AS a WHERE id = $id";
-    $category_one = $db->query($sql)->fetchAll()[0];
+    $category_rows = $db->query($sql)->fetchAll();
+    $category_one = $category_rows[0] ?? [];
     //$category_one = $db->get('on_categorys','*',[ 'id'  =>  $id ]);
     //查询父级分类
     $categorys = $db->select('on_categorys','*',[
@@ -52,7 +53,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
         'ORDER' =>  ['weight'    =>  'DESC'] 
     ]);
     //checked按钮
-    if( $category_one['property'] == 1 ) {
+    if( !empty($category_one['property']) ) {
         $category_one['checked'] = 'checked';
     }
     else{
@@ -63,7 +64,7 @@ if ( ($page == 'edit_category') || ($page == 'edit_category_new') || ($page == '
 //如果是主题设置页面
 if ( $page == "setting/theme_config" ){
     //获取主题名称
-    $name = trim($_GET['name']);
+    $name = trim($_GET['name'] ?? '');
     //获取主题目录
     if ( is_dir("templates/".$name) ) {
         $theme_dir = "templates/".$name;
@@ -77,11 +78,14 @@ if ( $page == "setting/theme_config" ){
         $config_content = @file_get_contents("data/templates/".$name."/info.json");
     }
     $configs = json_decode($config_content);
-    $configs = $configs->config;
+    $configs = ( is_object($configs) && isset($configs->config) ) ? $configs->config : (object) [];
     //获取当前的配置参数
-    $current_configs = file_get_contents($theme_dir."/config.json");
+    $current_configs = @file_get_contents($theme_dir."/config.json");
     
     $current_configs = json_decode($current_configs);
+    if ( !is_object($current_configs) ) {
+        $current_configs = (object) [];
+    }
 
     
     //var_dump($current_configs);
@@ -99,7 +103,8 @@ if ( $page == 'add_category' ) {
 //API设置页面
 if( $page == 'setting/api' ) {
     //查询SecretKey
-    $SecretKey = $db->get('on_options','*',[ 'key'  =>  'SecretKey' ])['value'];
+    $secret_row = $db->get('on_options','*',[ 'key'  =>  'SecretKey' ]);
+    $SecretKey = $secret_row['value'] ?? '';
     
 }
 
@@ -114,15 +119,16 @@ if ( ( $page == 'edit_link' ) || ( $page === 'edit_link_new' ) ) {
     //查询所有分类信息，用于分类框选择
     $categorys = $db->select('on_categorys','*',[ 'ORDER'  =>  ['weigth'    =>  'DESC'] ]);
     //获取id
-    $id = intval($_GET['id']);
+    $id = intval($_GET['id'] ?? 0);
     //查询单条链接信息
     $link = $db->get('on_links','*',[ 'id'  =>  $id ]);
+    $link = $link ?: [];
     //查询单个分类信息
-    $cat_name = $db->get('on_categorys',['name'],[ 'id' =>  $link['fid'] ]);
-    $cat_name = $cat_name['name'];
+    $cat_name = $db->get('on_categorys',['name'],[ 'id' =>  $link['fid'] ?? 0 ]);
+    $cat_name = $cat_name['name'] ?? '';
     
     //checked按钮
-    if( $link['property'] == 1 ) {
+    if( !empty($link['property']) ) {
         $link['checked'] = 'checked';
     }
     else{
@@ -141,7 +147,7 @@ if ( ($page == 'add_link') || ($page == 'add_link_tpl') || ($page == 'add_quick_
     //查询所有分类信息
     $categorys = $db->select('on_categorys','*',[ 'ORDER'  =>  ['weight'    =>  'DESC'] ]);
     //checked按钮
-    if( $category['property'] == 1 ) {
+    if( !empty($category['property']) ) {
         $category['checked'] = 'checked';
     }
     else{
@@ -154,7 +160,7 @@ if ( $page == 'imp_link' ) {
     //查询所有分类信息
     $categorys = $db->select('on_categorys','*',[ 'ORDER'  =>  ['weight'    =>  'DESC'] ]);
     //checked按钮
-    if( $category['property'] == 1 ) {
+    if( !empty($category['property']) ) {
         $category['checked'] = 'checked';
     }
     else{
@@ -176,6 +182,16 @@ if ( $page == 'setting/theme_detail' ) {
         $info = file_get_contents($tpl_dir2.'/info.json');
     }
     $theme = json_decode($info);
+    $theme_defaults = [
+        'name'          =>  '',
+        'screenshot'    =>  '',
+        'description'   =>  '',
+        'author'        =>  '',
+        'update'        =>  '',
+        'help_url'      =>  '',
+        'homepage'      =>  ''
+    ];
+    $theme = (object) array_merge($theme_defaults, is_object($theme) ? (array) $theme : []);
     //var_dump($theme);
 }
 
@@ -201,7 +217,7 @@ if( $page == 'setting/theme' ) {
                 case 'admin':
                 case 'mobile':
                 case 'universal':
-                    continue;
+                    continue 2;
                     break;
                 default:
                     array_push($tpl_one,$value);
@@ -224,7 +240,7 @@ if( $page == 'setting/theme' ) {
                     case '.':
                     case '..':
                     case 'admin':
-                        continue;
+                        continue 2;
                         break;
                     default:
                         array_push($tpl_two,$value);
@@ -272,8 +288,7 @@ if( $page == 'setting/theme' ) {
 //站点设置页面
 if( $page == 'setting/site' ) {
     //获取当前站点信息
-    $site = $db->get('on_options','value',[ 'key'  =>  "s_site" ]);
-    $site = unserialize($site);
+    $site = get_site_setting();
 }
 
 //站点订阅页面
@@ -281,7 +296,15 @@ if( $page == 'setting/subscribe' ) {
     //获取当前站点信息
     $subscribe = $db->get('on_options','value',[ 'key'  =>  "s_subscribe" ]);
     
-    $subscribe = unserialize($subscribe);
+    $subscribe = is_string($subscribe) ? unserialize($subscribe) : [];
+    if ( !is_array($subscribe) ) {
+        $subscribe = [];
+    }
+    $subscribe = array_merge([
+        'order_id'  =>  '',
+        'email'     =>  '',
+        'end_time'  =>  ''
+    ], $subscribe);
 
     //获取当前版本信息
     $current_version = explode("-",file_get_contents("version.txt"));
diff --git a/controller/api.php b/controller/api.php
index d805b75..ab07dc2 100755
--- a/controller/api.php
+++ b/controller/api.php
@@ -11,10 +11,42 @@ header("Access-Control-Allow-Origin: *");
 header("Access-Control-Allow-Headers: Access-Control-Allow-Private-Network,Content-Type, AccessToken, X-CSRF-Token, Authorization, Token,X-Token,X-Cid");
 require('./class/Api.php');
 
+/**
+ * 读取请求参数，缺失时返回默认值
+ * 避免 PHP 8 下未定义索引和 null 传入字符串函数的弃用警告
+ */
+function req_param($key, $default = '')
+{
+    if ( array_key_exists($key, $_POST) ) {
+        return $_POST[$key];
+    }
+    if ( array_key_exists($key, $_GET) ) {
+        return $_GET[$key];
+    }
+    if ( array_key_exists($key, $_REQUEST) ) {
+        return $_REQUEST[$key];
+    }
+    return $default;
+}
+
+/**
+ * 获取 API token，POST 优先，其次 GET
+ */
+function req_token()
+{
+    if ( !empty($_POST['token']) ) {
+        return $_POST['token'];
+    }
+    if ( isset($_GET['token']) ) {
+        return $_GET['token'];
+    }
+    return '';
+}
+
 $api = new Api($db);
 
 //获取请求方法
-$method = $_GET['method'];
+$method = $_GET['method'] ?? '';
 //可变函数变量
 $var_func = htmlspecialchars(trim($method),ENT_QUOTES);
 // 屏蔽的方法，让其不调用class/Api.php 中的方法
@@ -37,7 +69,9 @@ $deny_func = [
     'set_option',
     'set_option_bool',
     'update_link_status',
-    'get_options'
+    'get_options',
+    'req_param',
+    'req_token'
 ];
 // 判断是否在屏蔽列表中
 if( in_array($var_func,$deny_func) ) {
@@ -66,21 +100,21 @@ if ( function_exists($var_func) ) {
  */
 function add_category($api){
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取分类名称
-    $name = $_POST['name'];
+    $name = req_param('name', '');
     //获取私有属性
     $property = empty($_POST['property']) ? 0 : 1;
     //获取分级ID
-    $fid = intval($_POST['fid']);
+    $fid = intval(req_param('fid', ''));
     //获取权重
-    $weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
+    $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
     //获取描述
-    $description = empty($_POST['description']) ? '' : $_POST['description'];
+    $description = empty($_POST['description']) ? '' : req_param('description', '');
     //描述过滤
     $description = htmlspecialchars($description);
     //获取字体图标
-    $font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES);
+    $font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
     //搜索字体图标是否包含'fa '，如果不包含则自动加上
     if( !strstr($font_icon,'fa ') ) {
         $font_icon = 'fa '.$font_icon;
@@ -92,23 +126,23 @@ function add_category($api){
  */
 function edit_category($api){
     //获取ID
-    $id = intval($_POST['id']);
+    $id = intval(req_param('id', ''));
     //获取父级ID
-    $fid = intval($_POST['fid']);
+    $fid = intval(req_param('fid', ''));
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取分类名称
-    $name = $_POST['name'];
+    $name = req_param('name', '');
     //获取私有属性
     $property = empty($_POST['property']) ? 0 : 1;
     //获取权重
-    $weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
+    $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
     //获取描述
-    $description = empty($_POST['description']) ? '' : $_POST['description'];
+    $description = empty($_POST['description']) ? '' : req_param('description', '');
     //描述过滤
     $description = htmlspecialchars($description);
     //字体图标
-    $font_icon = htmlspecialchars($_POST['font_icon'],ENT_QUOTES);
+    $font_icon = htmlspecialchars(req_param('font_icon', ''),ENT_QUOTES);
     //搜索字体图标是否包含'fa '，如果不包含则自动加上
     if( !strstr($font_icon,'fa ') ) {
         $font_icon = 'fa '.$font_icon;
@@ -120,9 +154,9 @@ function edit_category($api){
  */
 function del_category($api){
     //获取ID
-    $id = intval($_POST['id']);
+    $id = intval(req_param('id', ''));
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     $api->del_category($token,$id);
 }
 /**
@@ -131,17 +165,17 @@ function del_category($api){
 function add_link($api){
     //add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     
     //获取fid
-    $fid = intval(@$_POST['fid']);
-    $title = $_POST['title'];
-    $url = $_POST['url'];
-    $url_standby = $_POST['url_standby'];
-    $description = empty($_POST['description']) ? '' : $_POST['description'];
-    $weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
+    $fid = intval(req_param('fid', ''));
+    $title = req_param('title', '');
+    $url = req_param('url', '');
+    $url_standby = req_param('url_standby', '');
+    $description = empty($_POST['description']) ? '' : req_param('description', '');
+    $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
     $property = empty($_POST['property']) ? 0 : 1;
-    $font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon'];
+    $font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
 
     $api->add_link($token,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
     
@@ -152,18 +186,18 @@ function add_link($api){
 function edit_link($api){
     //add_link($token,$fid,$title,$url,$description = '',$weight = 0,$property = 0)
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
-    $id = intval(@$_POST['id']);
+    $token = req_token();
+    $id = intval(req_param('id', ''));
     
     //获取fid
-    $fid = intval(@$_POST['fid']);
-    $title = $_POST['title'];
-    $url = $_POST['url'];
-    $url_standby = $_POST['url_standby'];
-    $description = empty($_POST['description']) ? '' : $_POST['description'];
-    $weight = empty($_POST['weight']) ? 0 : intval($_POST['weight']);
+    $fid = intval(req_param('fid', ''));
+    $title = req_param('title', '');
+    $url = req_param('url', '');
+    $url_standby = req_param('url_standby', '');
+    $description = empty($_POST['description']) ? '' : req_param('description', '');
+    $weight = empty($_POST['weight']) ? 0 : intval(req_param('weight', ''));
     $property = empty($_POST['property']) ? 0 : 1;
-    $font_icon = empty($_POST['font_icon']) ? '' : $_POST['font_icon'];
+    $font_icon = empty($_POST['font_icon']) ? '' : req_param('font_icon', '');
 
     $api->edit_link($token,$id,$fid,$title,$url,$description,$weight,$property,$url_standby,$font_icon);
     
@@ -173,16 +207,16 @@ function edit_link($api){
  * 删除链接
  */
 function del_link($api){
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
-    $id = intval(@$_POST['id']);
+    $token = req_token();
+    $id = intval(req_param('id', ''));
     $api->del_link($token,$id);
 }
 /**
  * 查询分类目录列表
  */
 function category_list($api){
-    $page = empty(intval($_GET['page'])) ? 1 : intval($_GET['page']);
-    $limit = empty(intval($_GET['limit'])) ? 10 : intval($_GET['limit']);
+    $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
+    $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
     $api->category_list($page,$limit);
 }
 
@@ -190,12 +224,12 @@ function category_list($api){
  * 查询链接列表
  */
 function link_list($api){
-    $page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
-    $limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
+    $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
+    $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取分类ID
-    $category_id = empty($_POST['category_id']) ? null : intval($_POST['category_id']);
+    $category_id = empty($_POST['category_id']) ? null : intval(req_param('category_id', ''));
     $data = [
         'page'          =>  $page,
         'limit'         =>  $limit,
@@ -209,12 +243,12 @@ function link_list($api){
  * 查询分类下的链接
  */
 function q_category_link($api){
-    $page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
-    $limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
+    $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
+    $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取分类ID
-    $category_id = empty($_REQUEST['category_id']) ? null : intval($_REQUEST['category_id']);
+    $category_id = empty($_REQUEST['category_id']) ? null : intval(req_param('category_id', ''));
     $data = [
         'page'          =>  $page,
         'limit'         =>  $limit,
@@ -229,9 +263,9 @@ function q_category_link($api){
  */
 function get_link_info($api) {
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取URL
-    $url = @$_POST['url'];
+    $url = req_param('url', '');
     $api->get_link_info($token,$url);
 }
 
@@ -240,9 +274,9 @@ function get_link_info($api) {
  */
 function get_a_category($api) {
     //获取token
-    $data['token'] = @empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $data['token'] = req_token();
     //获取分类ID
-    $data['id'] = intval(trim($_POST['id']));
+    $data['id'] = intval(trim(req_param('id', '')));
     //var_dump($data);
     $api->get_a_category($data);
 }
@@ -252,9 +286,9 @@ function get_a_category($api) {
  */
 function get_a_link($api) {
     //获取token
-    $data['token'] = htmlspecialchars(empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token']);
+    $data['token'] = htmlspecialchars(req_token());
     //获取链接的ID
-    $data['id'] = intval(htmlspecialchars($_GET['id']));
+    $data['id'] = intval(htmlspecialchars(req_param('id', '')));
     $api->get_a_link($data);
 }
 
@@ -263,50 +297,50 @@ function get_a_link($api) {
  */
 function add_js($api) {
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
-    $content = @$_POST['content'];
+    $token = req_token();
+    $content = req_param('content', '');
     $api->add_js($token,$content);
 }
 // 上传书签
 function upload($api){
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取上传类型
-    $type = $_GET['type'];
+    $type = req_param('type', '');
     $api->upload($token,$type);
 }
 // 上传图标
 function uploadImages(){
     global $api;
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取上传类型
     $api->uploadImages($token);
 }
 //书签导入
 function imp_link($api) {
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取书签路径
-    $filename = trim($_POST['filename']);
-    $fid = intval($_POST['fid']);
-    $property = intval(@$_POST['property']);
+    $filename = trim(req_param('filename', ''));
+    $fid = intval(req_param('fid', ''));
+    $property = intval(req_param('property', ''));
     $api->imp_link($token,$filename,$fid,$property);
 }
 //新版书签批量导入并自动创建分类
 function import_link($api) {
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     //获取书签路径
-    $filename = trim($_POST['filename']);
-    $fid = intval($_POST['fid']);
-    $property = intval(@$_POST['property']);
+    $filename = trim(req_param('filename', ''));
+    $fid = intval(req_param('fid', ''));
+    $property = intval(req_param('property', ''));
     $api->import_link($filename,$property);
 }
 //检查弱密码
 function check_weak_password($api) {
     //获取token
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     $api->check_weak_password($token);
 }
 
@@ -318,14 +352,14 @@ function get_sql_update_list($api){
 
 //执行SQL更新
 function exe_sql($api) {
-    $data['name'] = htmlspecialchars(trim($_GET['name']));
+    $data['name'] = htmlspecialchars(trim(req_param('name', '')));
     $api->exe_sql($data);
 }
 
 //设置options表
 function set_theme($api) {
     $key = 's_themes';
-    $value = $_POST['value'];
+    $value = req_param('value', '');
     $api->set_option($key,$value);
 }
 
@@ -333,23 +367,23 @@ function set_theme($api) {
 function set_site($api) {
     //获取传递过来的参数
     //获取网站标题
-    $data['title'] = htmlspecialchars($_POST['title']);
+    $data['title'] = htmlspecialchars(req_param('title', ''));
     //获取网站logo
-    $data['logo'] = htmlspecialchars($_POST['logo']);
+    $data['logo'] = htmlspecialchars(req_param('logo', ''));
     //获取副标题
-    $data['subtitle'] = htmlspecialchars($_POST['subtitle']);
+    $data['subtitle'] = htmlspecialchars(req_param('subtitle', ''));
     //获取关键词
-    $data['keywords'] = htmlspecialchars($_POST['keywords']);
+    $data['keywords'] = htmlspecialchars(req_param('keywords', ''));
     //获取描述
-    $data['description'] = htmlspecialchars($_POST['description']);
+    $data['description'] = htmlspecialchars(req_param('description', ''));
     //获取自定义header
-    $data['custom_header'] = $_POST['custom_header'];
+    $data['custom_header'] = req_param('custom_header', '');
     //获取自定义footer
-    $data['custom_footer'] = $_POST['custom_footer'];
+    $data['custom_footer'] = req_param('custom_footer', '');
     //获取链接模式
-    $data['link_model'] = $_POST['link_model'];
+    $data['link_model'] = req_param('link_model', '');
     // 获取链接数量
-    $data['link_num'] = $_POST['link_num'];
+    $data['link_num'] = req_param('link_num', '');
     //序列化存储
     $value = serialize($data);
 
@@ -390,11 +424,11 @@ function _deny_set($content,$err_msg) {
 //设置订阅信息
 function set_subscribe($api) {
     //获取订单ID
-    $data['order_id'] = htmlspecialchars( trim($_POST['order_id']) );
+    $data['order_id'] = htmlspecialchars( trim(req_param('order_id', '')) );
     //获取邮箱
-    $data['email'] = htmlspecialchars( trim($_POST['email']) );
+    $data['email'] = htmlspecialchars( trim(req_param('email', '')) );
     //到期时间
-    $data['end_time'] = htmlspecialchars( trim($_POST['end_time']) );
+    $data['end_time'] = htmlspecialchars( trim(req_param('end_time', '')) );
     //重置订阅状态
     session_start();
     $_SESSION['subscribe'] = NULL;
@@ -415,7 +449,7 @@ function up_updater($api) {
 }
 //验证当前版本是否匹配
 function check_version($api) {
-    $version = $_REQUEST['version'];
+    $version = req_param('version', '');
     $api->check_version($version);
 }
 
@@ -423,18 +457,18 @@ function check_version($api) {
 function set_transition_page($api) {
     //获取传递过来的参数
     //获取开关
-    $data['control'] = htmlspecialchars(trim($_POST['control']));
+    $data['control'] = htmlspecialchars(trim(req_param('control', '')));
     //获取游客停留时间
-    $data['visitor_stay_time'] = intval($_POST['visitor_stay_time']);
+    $data['visitor_stay_time'] = intval(req_param('visitor_stay_time', ''));
     //获取管理员停留时间
-    $data['admin_stay_time'] = intval($_POST['admin_stay_time']);
+    $data['admin_stay_time'] = intval(req_param('admin_stay_time', ''));
     //获取菜单
-    $data['menu'] = $_POST['menu'];
+    $data['menu'] = req_param('menu', '');
     //获取footer
-    $data['footer'] = $_POST['footer'];
+    $data['footer'] = req_param('footer', '');
     //获取广告
-    $data['a_d_1'] = $_POST['a_d_1'];
-    $data['a_d_2'] = $_POST['a_d_2'];
+    $data['a_d_1'] = req_param('a_d_1', '');
+    $data['a_d_2'] = req_param('a_d_2', '');
     
 
     //验证订阅
@@ -490,9 +524,9 @@ function get_latest_version() {
 //批量修改链接分类
 function batch_modify_category($api) {
     //获取id列表
-    $id = $_POST['id'];
+    $id = req_param('id', '');
     //获取分类ID
-    $fid = intval($_POST['fid']);
+    $fid = intval(req_param('fid', ''));
 
     $data = [
         'id'    =>  $id,
@@ -616,8 +650,8 @@ function export_json($api) {
 
 // 批量设置链接私有属性
 function set_link_attribute($api) {
-    $ids = $_POST['ids'];
-    $property = intval( $_POST['property'] );
+    $ids = req_param('ids', []);
+    $property = intval( req_param('property', '') );
     $data = [
         "ids"      =>   $ids,
         "property" =>   $property
@@ -627,23 +661,23 @@ function set_link_attribute($api) {
 
 //获取用户登录状态
 function check_login($api) {
-    $token = trim($_REQUEST['token']);
+    $token = trim(req_param('token'));
     $api->check_login($token);
 }
 
 //删除主题
 function delete_theme($api) {
-    $name = $_REQUEST['name'];
+    $name = req_param('name', '');
     $api->delete_theme($name);
 }
 
 //下载主题
 function down_theme() {
     global $api;
-    $data['name'] = trim($_GET['name']);
-    $data['key'] = trim( $_GET['key'] );
-    $data['value'] = trim( $_GET['value'] );
-    $data['type'] = trim( $_GET['type'] );
+    $data['name'] = trim(req_param('name', ''));
+    $data['key'] = trim( req_param('key', '') );
+    $data['value'] = trim( req_param('value', '') );
+    $data['type'] = trim( req_param('type', '') );
 
     $api->down_theme($data);
 }
@@ -663,20 +697,20 @@ function backup_db_list() {
 //删除单个数据库备份
 function del_backup_db() {
     global $api;
-    $name = @$_GET['name'];
+    $name = req_param('name', '');
     $api->del_backup_db($name);
 }
 
 //回滚数据库
 function restore_db() {
     global $api;
-    $name = @$_REQUEST['name'];
+    $name = req_param('name', '');
     $api->restore_db($name);
 }
 
 //获取APPINFO
 function app_info() {
-    $token = empty( $_POST['token'] ) ? $_GET['token'] : $_POST['token'];
+    $token = req_token();
     global $api;
     
     $api->app_info($token);
@@ -685,7 +719,7 @@ function app_info() {
 //下载数据库
 function down_db() {
     global $api;
-    $name = $_GET['name'];
+    $name = req_param('name', '');
     $api->down_db($name);
 }
 
@@ -694,10 +728,10 @@ function create_share() {
     global $api;
 
     $data['add_time'] = date("Y-m-d H:i:s",time());
-    $data['expire_time'] = $_POST['expire_time'];
-    $data['password'] = trim($_POST['password']);
-    $data['cid'] = intval($_POST['cid']);
-    $data['note'] = $_POST['note'];
+    $data['expire_time'] = req_param('expire_time', '');
+    $data['password'] = trim(req_param('password', ''));
+    $data['cid'] = intval(req_param('cid', ''));
+    $data['note'] = req_param('note', '');
 
     $api->create_share($data);
 }
@@ -705,8 +739,8 @@ function create_share() {
 //分享列表
 function share_list() {
     global $api;
-    $page = empty(intval($_REQUEST['page'])) ? 1 : intval($_REQUEST['page']);
-    $limit = empty(intval($_REQUEST['limit'])) ? 10 : intval($_REQUEST['limit']);
+    $page = empty(intval(req_param('page', ''))) ? 1 : intval(req_param('page', ''));
+    $limit = empty(intval(req_param('limit', ''))) ? 10 : intval(req_param('limit', ''));
 
     $data = [
         'page'          =>  $page,
@@ -719,15 +753,15 @@ function share_list() {
 //获取SID下的链接
 function get_sid_links() {
     global $api;
-    $data['sid'] = trim($_POST['sid']);
-    $data['password'] = trim($_POST['password']);
+    $data['sid'] = trim(req_param('sid', ''));
+    $data['password'] = trim(req_param('password', ''));
     $api->get_sid_links($data);
 }
 
 //删除分享
 function del_share() {
     global $api;
-    $data['id'] = intval($_GET['id']);
+    $data['id'] = intval(req_param('id', ''));
     //var_dump($data['id']);
 
     $api->del_share($data);
@@ -753,8 +787,8 @@ function edit_link_row(){
 
 // 批量修改分类属性
 function set_cat_batch() {
-    $data['ids'] = $_POST['ids'];
-    $data['property'] = $_POST['property'];
+    $data['ids'] = req_param('ids', []);
+    $data['property'] = req_param('property', '');
     global $api;
     $api->set_cat_batch($data);
 }
diff --git a/controller/bing.php b/controller/bing.php
index bec3fed..b7bb77e 100755
--- a/controller/bing.php
+++ b/controller/bing.php
@@ -6,9 +6,9 @@ header('Content-Type:application/json; charset=utf-8');
 // 载入辅助函数
 require('functions/helper.php');
 //获取当前主机名
-$host = $_SERVER['HTTP_HOST'];
+$host = $_SERVER['HTTP_HOST'] ?? '';
 //获取reffrer
-$referer = $_SERVER['HTTP_REFERER'];
+$referer = $_SERVER['HTTP_REFERER'] ?? '';
 
 //如果referer和主机名不匹配，则禁止调用
 if ( ( !empty($referer) ) && ( !strstr($referer,$host)  ) ) {
diff --git a/controller/click.php b/controller/click.php
index 687d77e..27f88c0 100755
--- a/controller/click.php
+++ b/controller/click.php
@@ -3,7 +3,7 @@
 require('functions/helper.php');
 
 //获取link.id
-$id = intval($_GET['id']);
+$id = intval($_GET['id'] ?? 0);
 
 //如果链接为空
 if(empty($id)) {
@@ -28,8 +28,10 @@ if( !$link ){
 $category = $db->get('on_categorys',['id','property'],[
     'id'    =>  $link['fid']
 ]);
+$category = $category ?: [];
 
 //判断用户是否登录
+$is_login = FALSE;
 if( is_login() ) {
     $is_login = TRUE;
 }
@@ -37,13 +39,22 @@ if( is_login() ) {
 //查询过渡页设置
 $transition_page = $db->get('on_options','value',[ 'key'  =>  "s_transition_page" ]);
 $transition_page = unserialize($transition_page);
+if ( !is_array($transition_page) ) {
+    $transition_page = [];
+}
+$transition_page = array_merge([
+    'control'           =>  'on',
+    'visitor_stay_time' =>  5,
+    'admin_stay_time'   =>  1,
+    'a_d_1'             =>  '',
+    'a_d_2'             =>  ''
+], $transition_page);
 
 //获取当前站点信息
-$site = $db->get('on_options','value',[ 'key'  =>  "s_site" ]);
-$site = unserialize($site);
+$site = get_site_setting();
 
 //link.id为公有，且category.id为公有
-if( ( $link['property'] == 0 ) && ($category['property'] == 0) ){
+if( ( $link['property'] == 0 ) && ( ($category['property'] ?? 0) == 0) ){
     //增加link.id的点击次数
     $click = $link['click'] + 1;
     //更新数据库
diff --git a/controller/ico.php b/controller/ico.php
index af677f3..b888a6c 100755
--- a/controller/ico.php
+++ b/controller/ico.php
@@ -77,13 +77,13 @@ function hsv2rgb($h, $s, $v)
  */
 function output_ico() {
     //获取文字
-    $text = @trim($_GET['text']);
+    $text = trim($_GET['text'] ?? '');
     $text = empty($text) ? '空' : $text;
     
     //获取当前主机名
-    $host = $_SERVER['HTTP_HOST'];
+    $host = $_SERVER['HTTP_HOST'] ?? '';
     //获取reffrer
-    $referer = $_SERVER['HTTP_REFERER'];
+    $referer = $_SERVER['HTTP_REFERER'] ?? '';
 
     //如果referer和主机名不匹配，则禁止调用
     if ( ( !empty($referer) ) && ( !strstr($referer,$host)  ) ) {
diff --git a/controller/index.php b/controller/index.php
index 9db158b..783a058 100755
--- a/controller/index.php
+++ b/controller/index.php
@@ -3,17 +3,17 @@
  * 首页模板入口
  */
 
+// 载入辅助函数
+require('functions/helper.php');
+
 //获取当前站点信息
-$site = $db->get('on_options','value',[ 'key'  =>  "s_site" ]);
-$site = unserialize($site);
+$site = get_site_setting();
 // 获取链接数量,默认为30
 $link_num = empty( $site['link_num'] ) ? 30 : intval($site['link_num']);
 // var_dump($link_num);
 
 
 //如果已经登录，获取所有分类和链接
-// 载入辅助函数
-require('functions/helper.php');
 // 明文密码检查
 unSafe();
 
@@ -211,7 +211,7 @@ $templates = $db->get("on_options","value",[
     "key"   =>  "s_themes"
 ]);
 // 获取UA
-$userAgent = $_SERVER['HTTP_USER_AGENT'];
+$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
 $mobileKeywords = [
     'mobile', 'android', 'iphone'
 ];
@@ -237,7 +237,7 @@ if (empty($templates)) {
 
 
 //获取用户传递的主题参数
-$theme = trim( @$_GET['theme'] );
+$theme = trim( $_GET['theme'] ?? '' );
 //如果用户传递了主题参数
 if( !empty($theme) ) {
     //获取所有主题
@@ -274,12 +274,16 @@ $config_content = @file_get_contents($config_file);
 //如果是info.json,则特殊处理下
 if ( strstr($config_file,"info.json") ) {
     $config_content = json_decode($config_content);
-    $theme_config = $config_content->config;
+    $theme_config = ( is_object($config_content) && isset($config_content->config) )
+        ? $config_content->config
+        : (object) [];
 }
 else{
-    $config_content = $config_content;
     $theme_config = json_decode($config_content);
 }
+if ( !is_object($theme_config) ) {
+    $theme_config = (object) [];
+}
 
 
 
@@ -327,8 +331,14 @@ $search_engines = [
 //获取主题的最低版本要求
 $info_json = @file_get_contents($tpl_dir.$template."/info.json");
 
+$info = (object) [
+    'version' => ''
+];
 if( $info_json ) {
-    $info = json_decode($info_json);
+    $decoded_info = json_decode($info_json);
+    if ( is_object($decoded_info) ) {
+        $info = (object) array_merge( (array) $info, (array) $decoded_info );
+    }
     
     $min_version = @$info->require->min;
     //获取到了最低版本
@@ -343,7 +353,8 @@ if( $info_json ) {
 
 // 该分类下可见的链接数量
 function get_links_number($fid){
-    $number = count(get_links($fid));
+    $links = get_links($fid);
+    $number = is_array($links) ? count($links) : 0;
     // var_dump($number);
     return $number;
 }
diff --git a/controller/init.php b/controller/init.php
index 18afb88..16fe9db 100755
--- a/controller/init.php
+++ b/controller/init.php
@@ -12,7 +12,7 @@ function check_env() {
     $ext = get_loaded_extensions();
     //检查PHP版本，最低要求7.2，兼容8.x
     $php_version = PHP_VERSION;
-    $uri = $_SERVER["REQUEST_URI"];
+    $uri = $_SERVER["REQUEST_URI"] ?? '';
 
     // var_dump($uri);
     
@@ -138,9 +138,9 @@ check_env();
 
 if ( $c == 'init' ) {
     //接收POST参数
-    $email = htmlspecialchars(trim($_POST['email']));
-    $username = htmlspecialchars(trim($_POST['username']));
-    $password = htmlspecialchars(trim($_POST['password']));
+    $email = htmlspecialchars(trim($_POST['email'] ?? ''));
+    $username = htmlspecialchars(trim($_POST['username'] ?? ''));
+    $password = htmlspecialchars(trim($_POST['password'] ?? ''));
     $data = [
         "email"     =>  $email,
         "username"  =>  $username,
diff --git a/controller/login.php b/controller/login.php
index ffe5f59..61dbb1a 100755
--- a/controller/login.php
+++ b/controller/login.php
@@ -13,9 +13,9 @@ $username = $site_setting['user'];
 $password = ENCRYPTED_PASSWORD;
 $ip = getIP();
 //如果认证通过，直接跳转到后台管理
-$key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']);
+$key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
 //获取cookie
-$cookie = $_COOKIE['key'];
+$cookie = $_COOKIE['key'] ?? '';
 
 //获取版本号
 $version = new_get_version();
@@ -27,16 +27,16 @@ if( is_login() ){
 }
 
 //登录检查
-if( $_GET['check'] == 'login' ) {
-    $user = trim($_POST['user']);
-    $pass = trim($_POST['password']);
+if( ($_GET['check'] ?? '') == 'login' ) {
+    $user = trim($_POST['user'] ?? '');
+    $pass = trim($_POST['password'] ?? '');
     // 用户密码进行加密处理，加密算法为用户名 + 密码，再进行MD5加密
     $pass = md5($user.$pass);
     header('Content-Type:application/json; charset=utf-8');
     if( ($user === $username) && ($pass === $password) ) {
-        $key = md5($username.$password.'onenav'.$_SERVER['HTTP_USER_AGENT']);
+        $key = md5($username.$password.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
         //开启httponly支持
-        setcookie("key", $key, time()+30 * 24 * 60 * 60,"/",NULL,false,TRUE);
+        setcookie("key", $key, time()+30 * 24 * 60 * 60,"/","",false,TRUE);
         $data = [
             'code'      =>  0,
             'msg'   =>  'successful'
diff --git a/controller/universal.php b/controller/universal.php
index 578414a..4e4ce6e 100755
--- a/controller/universal.php
+++ b/controller/universal.php
@@ -9,8 +9,7 @@ require('functions/helper.php');
 $version = new_get_version();
 
 //获取当前站点信息
-$site = $db->get('on_options','value',[ 'key'  =>  "s_site" ]);
-$site = unserialize($site);
+$site = get_site_setting();
 
 
 //载入视图
diff --git a/functions/helper.php b/functions/helper.php
index 19426e4..fc87f1e 100755
--- a/functions/helper.php
+++ b/functions/helper.php
@@ -17,16 +17,16 @@ function getIP() {
     $ip = getenv('HTTP_FORWARDED'); 
   } 
   else { 
-      $ip = $_SERVER['REMOTE_ADDR']; 
+      $ip = $_SERVER['REMOTE_ADDR'] ?? '';
   } 
       return $ip; 
   }
 
 
 function is_login(){
-    $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.$_SERVER['HTTP_USER_AGENT']);
+    $key = md5(USER.ENCRYPTED_PASSWORD.'onenav'.($_SERVER['HTTP_USER_AGENT'] ?? ''));
     //获取session
-    $session = $_COOKIE['key'];
+    $session = $_COOKIE['key'] ?? '';
     //如果已经成功登录
     if($session === $key) {
         return true;
@@ -37,6 +37,29 @@ function is_login(){
 }
 
 //后续全局函数全部以g_命名开头
+/**
+ * 获取站点设置，并补齐旧版本/种子库缺失的字段
+ */
+function get_site_setting() {
+    global $db;
+    $site = $db->get('on_options','value',[ 'key'  =>  's_site' ]);
+    $site = is_string($site) ? @unserialize($site) : $site;
+    if ( !is_array($site) ) {
+        $site = [];
+    }
+    return array_merge([
+        'title'         =>  'OneNav',
+        'logo'          =>  'OneNav',
+        'subtitle'      =>  '',
+        'keywords'      =>  '',
+        'description'   =>  '',
+        'custom_header' =>  '',
+        'custom_footer' =>  '',
+        'link_model'    =>  'jump',
+        'link_num'      =>  30
+    ], $site);
+}
+
 function g_extend_js() {
     //载入js扩展
     if( file_exists('data/extend.js') ) {
@@ -102,7 +125,7 @@ function GetRandStr($len)
 
 //跳转到手机版页面
 function jump_mobile() {
-    $ua = $_SERVER['HTTP_USER_AGENT'];
+    $ua = $_SERVER['HTTP_USER_AGENT'] ?? '';
 
     if( stristr($ua,'iphone') || stristr($ua,'android') ) {
         header("Location: /index.php?c=mobile#/");
@@ -132,7 +155,7 @@ function get_all_themes() {
                 case 'admin':
                 case 'mobile':
                 case 'universal':
-                    continue;
+                    continue 2;
                     break;
                 default:
                     array_push($tpl_one,$value);
@@ -155,7 +178,7 @@ function get_all_themes() {
                     case '.':
                     case '..':
                     case 'admin':
-                        continue;
+                        continue 2;
                         break;
                     default:
                         array_push($tpl_two,$value);
@@ -178,7 +201,7 @@ function get_all_themes() {
 
 // 获取HOST，需要去除端口号
 function get_host(){
-    $host = $_SERVER['HTTP_HOST'];
+    $host = $_SERVER['HTTP_HOST'] ?? '';
     $parsed_host = parse_url($host);
     //var_dump($parsed_host);
     if (isset($parsed_host['port']) && $parsed_host['port'] != 80 && $parsed_host['port'] != 443) {
@@ -190,7 +213,9 @@ function get_host(){
 // 获取当前域名，比如https://nav.rss.ink
 function getCurrentUrlDomain() {
 
-    $url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
+    $host = $_SERVER['HTTP_HOST'] ?? '';
+    $request_uri = $_SERVER['REQUEST_URI'] ?? '';
+    $url = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://" . $host . $request_uri;
     
     $url_parts = parse_url($url);
     
diff --git a/index.php b/index.php
index 49e57a3..accc877 100755
--- a/index.php
+++ b/index.php
@@ -7,7 +7,7 @@ header("content-Type: text/html; charset=Utf-8");
 //获取控制器
 $c = @$_GET['c'];
 //进行过滤
-$c = strip_tags($c);
+$c = strip_tags($c ?? '');
 //读取版本号
 //$version = @file_get_contents("./functions/version.txt");
 //载入配置文件
diff --git a/templates/admin/click.php b/templates/admin/click.php
index 316b0dc..c88dbf2 100755
--- a/templates/admin/click.php
+++ b/templates/admin/click.php
@@ -1,3 +1,23 @@
+<?php
+// 兼容直接通过后台页面参数加载模板的情况，保证变量和字段存在
+$link = array_merge([
+    'title'         =>  '',
+    'url'           =>  '',
+    'url_standby'   =>  '',
+    'description'   =>  ''
+], (isset($link) && is_array($link)) ? $link : []);
+$site = array_merge([
+    'title'         =>  'OneNav',
+    'custom_header' =>  ''
+], (isset($site) && is_array($site)) ? $site : []);
+$transition_page = array_merge([
+    'visitor_stay_time' =>  5,
+    'admin_stay_time'   =>  1,
+    'a_d_1'             =>  '',
+    'a_d_2'             =>  ''
+], (isset($transition_page) && is_array($transition_page)) ? $transition_page : []);
+$is_login = isset($is_login) ? $is_login : FALSE;
+?>
 <!DOCTYPE html>
 <html lang="zh-cn" xmlns="http://www.w3.org/1999/xhtml">
 <head>
@@ -104,13 +124,8 @@
 			$visitor_stay_time = $transition_page['visitor_stay_time'];
 			//管理员停留时间
 			$admin_stay_time = $transition_page['admin_stay_time'];
-			
-			if ($is_login) {
-				header("Refresh:$admin_stay_time;url=".$link['url']);
-			}
-			else{
-				header("Refresh:$visitor_stay_time;url=".$link['url']);
-			}
+			$refresh_time = $is_login ? $admin_stay_time : $visitor_stay_time;
+			echo '<meta http-equiv="refresh" content="'.intval($refresh_time).';url='.htmlspecialchars($link['url'], ENT_QUOTES).'">';
 		}
 		
 	?>
diff --git a/templates/admin/edit_category.php b/templates/admin/edit_category.php
index ea8edb1..fad649f 100755
--- a/templates/admin/edit_category.php
+++ b/templates/admin/edit_category.php
@@ -140,7 +140,7 @@
       // 每页显示数量，默认12
       limit: 30,
       // 点击回调
-      value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标
+      value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
       click: function(data) {
           console.log(data);
       },
diff --git a/templates/admin/edit_category_new.php b/templates/admin/edit_category_new.php
index 1a72cb3..4f151e8 100755
--- a/templates/admin/edit_category_new.php
+++ b/templates/admin/edit_category_new.php
@@ -138,7 +138,7 @@
       // 每页显示数量，默认12
       limit: 30,
       // 点击回调
-      value:'<?php echo str_replace("fa ","",$category_one["font_icon"]); ?>', //自定义默认图标
+      value:'<?php echo str_replace("fa ","",$category_one["font_icon"] ?? ''); ?>', //自定义默认图标
       click: function(data) {
           console.log(data);
       },
diff --git a/templates/admin/setting/api.php b/templates/admin/setting/api.php
index dc139d2..749ed1f 100755
--- a/templates/admin/setting/api.php
+++ b/templates/admin/setting/api.php
@@ -1,4 +1,3 @@
-<?php echo $transition_page['control']; ?>
 <!-- API页面设置 -->
 <?php require_once(dirname(__DIR__).'/header.php'); ?>
 <?php include_once(dirname(__DIR__).'/left.php'); ?>
diff --git a/templates/admin/setting/backup.php b/templates/admin/setting/backup.php
index 0a3d3ea..50fa62a 100755
--- a/templates/admin/setting/backup.php
+++ b/templates/admin/setting/backup.php
@@ -1,4 +1,3 @@
-<?php echo $transition_page['control']; ?>
 <!-- API页面设置 -->
 <?php require_once(dirname(__DIR__).'/header.php'); ?>
 <?php include_once(dirname(__DIR__).'/left.php'); ?>
diff --git a/templates/admin/setting/share.php b/templates/admin/setting/share.php
index e039652..17e1c77 100755
--- a/templates/admin/setting/share.php
+++ b/templates/admin/setting/share.php
@@ -1,4 +1,3 @@
-<?php echo $transition_page['control']; ?>
 <!-- API页面设置 -->
 <?php require_once(dirname(__DIR__).'/header.php'); ?>
 <?php include_once(dirname(__DIR__).'/left.php'); ?>
diff --git a/templates/admin/setting/site.php b/templates/admin/setting/site.php
index 634bb78..fd9da20 100755
--- a/templates/admin/setting/site.php
+++ b/templates/admin/setting/site.php
@@ -48,7 +48,7 @@
         <div class="layui-form-item">
             <label class="layui-form-label">直链模式</label>
             <div class="layui-input-inline">
-                <?php if( $site['link_model'] === 'direct' ) { ?>
+                <?php if( ($site['link_model'] ?? 'jump') === 'direct' ) { ?>
                     <input type="radio" name="link_model" value="jump" title="关闭">
                     <input type="radio" name="link_model" value="direct" title="开启" checked>
                 <?php }else{ ?>
@@ -62,7 +62,7 @@
         <div class="layui-form-item">
             <label class="layui-form-label">链接数量</label>
             <div class="layui-input-inline">
-                <input type="number" name="link_num" value = "<?php echo $site['link_num']; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input">
+                <input type="number" name="link_num" value = "<?php echo $site['link_num'] ?? 30; ?>" autocomplete="off" placeholder="分类需要展示的链接数量" class="layui-input">
             </div>
             <div class="layui-form-mid layui-word-aux">指的是首页单个分类下需要展示的链接数量，默认30，值越低，性能越好</div>
         </div>
@@ -84,7 +84,7 @@
         <div class="layui-form-item layui-form-text">
             <label class="layui-form-label">自定义footer(支持HTML代码，订阅可用)</label>
             <div class="layui-input-block">
-                <textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer']; ?></textarea>
+                <textarea name = "custom_footer" placeholder="自定义站点底部信息，请填写HTML代码" class="layui-textarea"><?php echo $site['custom_footer'] ?? ''; ?></textarea>
             </div>
         </div>
 
diff --git a/templates/admin/setting/subscribe.php b/templates/admin/setting/subscribe.php
index 1a8c07d..e2cbce0 100755
--- a/templates/admin/setting/subscribe.php
+++ b/templates/admin/setting/subscribe.php
@@ -53,7 +53,7 @@
         <div class="layui-form-item" style = "display:none;">
             <label class="layui-form-label">域名</label>
             <div class="layui-input-block">
-                <input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST']; ?>" autocomplete="off" placeholder="网站域名" class="layui-input">
+                <input type="text" name="domain" id = "domain" value = "<?php echo $_SERVER['HTTP_HOST'] ?? ''; ?>" autocomplete="off" placeholder="网站域名" class="layui-input">
             </div>
         </div>
 
diff --git a/templates/default/index.php b/templates/default/index.php
index 9af15ed..c502160 100755
--- a/templates/default/index.php
+++ b/templates/default/index.php
@@ -27,7 +27,7 @@
 </head>
 <?php
 	// 根据cookie来设置mdui主题
-	$md_theme = $_COOKIE['docs-theme-layout'];
+	$md_theme = $_COOKIE['docs-theme-layout'] ?? '';
 	if( empty($md_theme) || ( $md_theme == "light" ) ) {
 		$md_theme = "";
 	}
@@ -172,6 +172,9 @@
             <?php foreach ( $categorys as $category ) {
                 $fid = $category['id'];
                 $links = $get_links($fid);
+                if ( !is_array($links) ) {
+                    $links = [];
+                }
 				$font_icon = empty($category['font_icon']) ? '' : "<i class='{$category['font_icon']}'></i> ";
                 //如果分类是私有的
                 if( $category['property'] == 1 ) {
@@ -192,7 +195,7 @@
 					$link['description'] = empty($link['description']) ? '作者很懒，没有填写描述。' : $link['description'];
 					$id = $link['id'];
 					//直链模式
-					if( $site['link_model'] === 'direct' ) {
+					if( ($site['link_model'] ?? 'jump') === 'direct' ) {
 						$url = $link['url'];
 					}
 					else{
diff --git a/templates/minima/index.php b/templates/minima/index.php
index c342e1d..cbbee96 100644
--- a/templates/minima/index.php
+++ b/templates/minima/index.php
@@ -127,6 +127,9 @@
                 <?php foreach ($categorys as $category) {
                     $fid = $category['id'];
                     $links = $get_links($fid);
+                    if ( !is_array($links) ) {
+                        $links = [];
+                    }
                     $font_icon = empty($category['font_icon']) ? 'fa fa-folder' : $category['font_icon'];
                     
                     // 如果分类是私有的
@@ -152,7 +155,7 @@
                             $id = $link['id'];
                             
                             // 直链模式
-                            if( $site['link_model'] === 'direct' ) {
+                            if( ($site['link_model'] ?? 'jump') === 'direct' ) {
                                 $url = $link['url'];
                             } else {
                                 $url = '/index.php?c=click&id='.$link['id'];