Put it in a common call file (such as the conn database link file) and filter all GET or POST data with special strings to achieve simple and effective SQL injection filtering. PHP beginners, welcome criticism and advice. Thank you!
Function inject_check($sql_str) { Return eregi('select|insert|and|or|update|delete|'|/*|*|../|./|union|into|load_file|outfile' , $sql_str); }- if (inject_check($_SERVER['QUERY_STRING'])==1 or inject_check(file_get_contents("php://input"))==1){
- //echo "Warning of illegal access ! ";
-
OnFunction Inject_check ($ SQL_STR) {
- Return Preg_match ('/Select | Insert | AND | OPDATE | DELETE |/*|*| ./ | UNION | Into | LOAD_FILE | OUUUU TFILE /i', $sql_str);
- }
- if (inject_check($_SERVER['QUERY_STRING'])==1 or inject_check(file_get_contents("php://input"))==1){
- //echo " Warning illegal access! ";
" header("Location: Error.php"); " exit; }
Copy code
|