How to filter SQL injection with $_GET and $_POST in PHP, _get_post_PHP tutorial

How $_GET and $_POST filter SQL injection in php, _get_post

The example in this article describes the method of filtering SQL injection by $_GET and $_POST in PHP, and shares it with everyone for your reference. The specific analysis is as follows:

This function can only filter some sensitive sql commands. For example, you still need to filter them simply by yourself, such as id=1.

The main implementation code is as follows:

Copy code The code is as follows:

if (!get_magic_quotes_gpc())
{
if (!empty($_GET))
{
$_GET = addslashes_deep($_GET);
}
if (!empty($_POST))
{
$_POST = addslashes_deep($_POST);
}
$_COOKIE = addslashes_deep($_COOKIE);
$_REQUEST = addslashes_deep($_REQUEST);
}
function addslashes_deep($value)
{
if (empty($value))
{
return $value;
}
else
{
return is_array($value) ? array_map('addslashes_deep', $value) : addslashes($value);
}
}

I hope this article will be helpful to everyone’s PHP programming design.

php filter sql injection, newbie

I wrote a code to prevent SQL injection in PHP4 environment. After actual use, it is also compatible under PHP5. Everyone is welcome to modify and use it.
The code is as follows:
/*
sqlin anti-injection class
*/
class sqlin
{

//dowith_sql($ value)
function dowith_sql($str)
{
$str = str_replace("and","",$str);
$str = str_replace("execute","",$ str);
$str = str_replace("update","",$str);
$str = str_replace("count","",$str);
$str = str_replace(" chr","",$str);
$str = str_replace("mid","",$str);
$str = str_replace("master","",$str);
$str = str_replace("truncate","",$str);
$str = str_replace("char","",$str);
$str = str_replace("declare","" ,$str);
$str = str_replace("select","",$str);
$str = str_replace("create","",$str);
$str = str_replace ("delete","",$str);
$str = str_replace("insert","",$str);
$str = str_replace("'","",$str);
$str = str_replace(""","",$str);
$str = str_replace(" ","",$str);
$str = str_replace("or"," ",$str);
$str = str_replace("=","",$str);
$str = str_replace("%20","",$str);
// echo $str;
return $str;
}
//aticle() Anti-SQL injection function
function sqlin()
{
foreach ($_GET as $key=> ;$value)
{
$_GE...the rest of the text>>

php Regarding thinkphp’s anti-sql injection and filtering issues

Use one to filter the passed value. Before using these two, check whether they are enabled
get_magic_quotes_gpc(); if not enabled, use the following two to filter
mysql_real_escape_string(); generally used for sql Statement
addslashes();
For example:
if (!get_magic_quotes_gpc()) {
$lastname = addslashes($_POST['lastname']);
//or mysql_real_escape_string($ _POST['lastname'])
} else {
$lastname = $_POST['lastname'];
}

http://www.bkjia.com/PHPjc/904930.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/904930.htmlTechArticleHow $_GET and $_POST filter sql injection in php, _get_post This article describes the $_GET and $ in php _POST method of filtering sql injection is shared with everyone for your reference. The specific analysis is as follows: This...