PHP anti-injection function code summary_PHP tutorial

To prevent injection in PHP, a global file is usually written to filter special strings. This article summarizes various PHP anti-injection function codes. It can also prevent SQL injection for your reference.

For security, we often use the following function to filter some passed illegal characters:

PHP anti-injection function

The code is as follows

Copy code

代码如下

复制代码

//要过滤的非法字符 $ArrFiltrate=array(“‘”,”;”,”union”,”select”,”delete”,”‘”,”or”,”and”,”=”); //出错后要跳转的url,不填则默认前一页 $StrGoUrl=”"; //是否存在数组中的值 function FunStringExist($StrFiltrate,$ArrFiltrate){ foreach ($ArrFiltrate as $key=>$value){ if (eregi($value,$StrFiltrate)){ return true; } } return false; } //合并$_POST 和 $_GET if(function_exists(array_merge)){ $ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS); }else{ foreach($HTTP_POST_VARS as $key=>$value){ $ArrPostAndGet[]=$value; } foreach($HTTP_GET_VARS as $key=>$value){ $ArrPostAndGet[]=$value; } } //验证开始 foreach($ArrPostAndGet as $key=>$value){ if (FunStringExist($value,$ArrFiltrate)){ if (empty($StrGoUrl)){ echo “”; }else{ echo “”; } exit; } }

//Illegal characters to be filtered
$ArrFiltrate=array(“‘”,”;”,”union”,”select”,”delete”,”‘”,”or”,”and”,”=”);
//The URL to jump to after an error occurs. If not filled in, the previous page will be defaulted
$StrGoUrl=””;
//Whether there is a value in the array
function FunStringExist($StrFiltrate,$ArrFiltrate){
foreach ($ArrFiltrate as $key=>$value){
if (eregi($value,$StrFiltrate)){
return true;
}
}
return false;
}
//Merge $_POST and $_GET
if(function_exists(array_merge)){
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);
}else{
foreach($HTTP_POST_VARS as $key=>$value){
$ArrPostAndGet[]=$value;
}
foreach($HTTP_GET_VARS as $key=>$value){
$ArrPostAndGet[]=$value;
}
}
//Verification starts
foreach($ArrPostAndGet as $key=>$value){
if (FunStringExist($value,$ArrFiltrate)){
if (empty($StrGoUrl)){
echo “”;
}else{
echo “”;
}
exit;
}
}

Look at another example that is similar to the above. This is the method used by the dz forum

代码如下

复制代码

$magic_quotes_gpc = get_magic_quotes_gpc(); @extract(daddslashes($_COOKIE)); @extract(daddslashes($_POST)); @extract(daddslashes($_GET)); if(!$magic_quotes_gpc) { $_FILES = daddslashes($_FILES); } function daddslashes($string, $force = 0) { if(!$GLOBALS['magic_quotes_gpc'] || $force) { if(is_array($string)) { foreach($string as $key => $val) { $string[$key] = daddslashes($val, $force); } } else { $string = addslashes($string); } } return $string; }

The code is as follows

Copy code

$magic_quotes_gpc = get_magic_quotes_gpc(); @extract(daddslashes($_COOKIE)); @extract(daddslashes($_POST)); @extract(daddslashes($_GET)); if(!$magic_quotes_gpc) { $_FILES = daddslashes($_FILES); } function daddslashes($string, $force = 0) { if(!$GLOBALS['magic_quotes_gpc'] || $force) { if(is_array($string)) { foreach($string as $key => $val) { $string[$key] = daddslashes($val, $force); } } else { $string = addslashes($string); } } return $string; }

Lastly post an enhanced version

The code is as follows

Copy code

$field = explode(',', $data); array_walk($field, array($this, 'add_special_char')); $data = implode(',', $field); /** * Add backticks on both sides of the field to ensure database security * @param $value array value ​*/ public function add_special_char(&$value) { if('*' == $value || false !== strpos($value, '(') || false !== strpos($value, '.') || false !== strpos ( $value, '`')) { //Do not process include * or use sql method. } else { $value = '`'.trim($value).'''; } return $value; } function str_filter($str) { $str = htmlspecialchars ( $str ); if (! get_magic_quotes_gpc ()) { $str = addslashes ( $str ); } //Filter dangerous characters return preg_replace ( "/["'=]|(and)|(or)|(create)|(update)|(alter)|(delete)|(insert)|(load_file)|(outfile)|(count) |(%20)|(char)/i", "", $str ); } /* Function name: str_check() Function: Filter the submitted string Parameters: $var: string to be processed Return value: Return the filtered string */ function str_check($str) { if (! get_magic_quotes_gpc ()) { // Determine whether magic_quotes_gpc is turned on $str = addslashes ( $str ); // Filter } $str = str_replace ( "_", "_", $str ); // Filter out '_' $str = str_replace ( "%", "%", $str ); // Filter out '%' return $str; } /* Function name: post_check() Function: Process the submitted editing content Parameters: $post: Content to be submitted Return value: $post: Returns filtered content */ function post_check($post) { if (! get_magic_quotes_gpc ()) { // Determine whether magic_quotes_gpc is open $post = addslashes ( $post ); // Filter submitted data when magic_quotes_gpc is not turned on } $post = str_replace ( "_", "_", $post ); // Filter out '_' $post = str_replace ( "%", "%", $post ); // Filter out '%' $post = nl2br ( $post ); // Enter conversion $post = htmlspecialchars ( $post ); // html tag conversion return $post; } /* Function name: inject_check() Function: Detect whether the submitted value contains SQL injection characters, prevent injection, and protect server security Parameter: $sql_str: Submitted variable Return value: Return the detection result, true or false */ function inject_check($sql_str) { return eregi('select|insert|and|or|update|delete|'|/*|*|../|./|union|into|load_file|outfile', $sql_str); // Filter } /* Function name: verify_id() Function: Verify whether the submitted ID value is legal Parameters: $id: Submitted ID value Return value: Return the processed ID */ function verify_id($id=null) { if (!$id) { exit('No parameters submitted!'); } // Determine whether it is empty elseif (inject_check($id)) { exit('The submitted parameter is illegal!'); } // Injection judgment elseif (!is_numeric($id)) { exit('The submitted parameter is illegal!'); } // Numeric judgment $id = intval($id); // Integer return $id; } // $rptype = 0 表示仅替换 html标记 // $rptype = 1 表示替换 html标记同时去除连续空白字符 // $rptype = 2 表示替换 html标记同时去除所有空白字符 // $rptype = -1 表示仅替换 html危险的标记 function HtmlReplace($str, $rptype = 0) { $str = stripslashes ( $str ); if ($rptype == 0) { $str = htmlspecialchars ( $str ); } else if ($rptype == 1) { $str = htmlspecialchars ( $str ); $str = str_replace ( "　", ' ', $str ); $str = ereg_replace ( "[rnt ]{1,}", ' ', $str ); } else if ($rptype == 2) { $str = htmlspecialchars ( $str ); $str = str_replace ( "　", '', $str ); $str = ereg_replace ( "[rnt ]", '', $str ); } else { $str = ereg_replace ( "[rnt ]{1,}", ' ', $str ); $str = eregi_replace ( 'script', 'ｓｃｒｉｐｔ', $str ); $str = eregi_replace ( "<[/]{0,1}(link|meta|ifr|fra)[^>]*>", '', $str );  }  return addslashes ( $str ); } //递归ddslashes function daddslashes($string, $force = 0, $strip = FALSE) {  if (! get_magic_quotes_gpc () || $force) {   if (is_array ( $string )) {    foreach ( $string as $key => $val ) {     $string [$key] = daddslashes ( $val, $force );    }   } else {    $string = addslashes ( $strip ? stripslashes ( $string ) : $string );   }  }  return $string; } //递归stripslashes function dstripslashes($string) {  if (is_array ( $string )) {   foreach ( $string as $key => $val ) {    $string [$key] = $this->dstripslashes ( $val );   }  } else {   $string = stripslashes ( $string );  }  return $string; } /**  * 安全过滤函数  * @param $string 要过滤的字符串  * @return string 返回处理过的字符串  */ function safe_replace($string) {  $string = str_replace('%20','',$string);  $string = str_replace('%27','',$string);  $string = str_replace('%2527','',$string);  $string = str_replace('*','',$string);  $string = str_replace('"','"',$string);  $string = str_replace("'",'',$string);  $string = str_replace('"','',$string);  $string = str_replace(';','',$string);  $string = str_replace('<','<',$string); $string = str_replace('>','>',$string);  $string = str_replace("{",'',$string);  $string = str_replace('}','',$string);  return $string; } /**  * 使用htmlspecialchars处理字符串或数组  * @param $obj 需要处理的字符串或数组  * @return mixed 返回经htmlspecialchars处理过的字符串或数组  */ function new_htmlspecialchars($string) {  if(!is_array($string))  return htmlspecialchars($string);  foreach($string as $key => $val)  $string[$key] = new_htmlspecialchars($val);  return $string; } //处理禁用HTML但允许换行的内容 function TrimMsg($msg) {  $msg = trim ( stripslashes ( $msg ) );  $msg = nl2br ( htmlspecialchars ( $msg ) );  $msg = str_replace ( "  ", " ", $msg );  return addslashes ( $msg ); }

http://www.bkjia.com/PHPjc/629615.htmlwww.bkjia.comtruehttp://www.bkjia.com/PHPjc/629615.htmlTechArticle在php中防注入一般会写一个全局文件用来过滤特殊的字符串，本文章来总结了各种各样的php防注入函数代码，同时还可防sql注入大家可参考...