Detailed explanation of practical PHP anti-injection code examples

伊谢尔伦
Release: 2023-03-12 06:04:01
Original
1512 people have browsed it

This article mainly introduces simple and practical examples of PHP anti-injection classes. It uses two simple anti-injection classes as examples to introduce the principles and techniques of PHP anti-injection. It is of great practical value for website security construction and needs Friends can refer to

This article describes a simple and practical PHP anti-injection class with examples. Share it with everyone for your reference. The details are as follows:

PHP Anti-injection Note that the information to be filtered is basically get, post, and for sql, it is our commonly used query, insert, etc. sql commands. Below I will give you two simple examples. I hope these examples can bring security to your website.

PHP anti-injection code is as follows:

<?php 
/** 
 * 参数处理类 
 */ 
class Params 
{ 
    public $get = array(); 
 
    public $post = array(); 
 
    function construct() 
    { 
 if (!emptyempty($_GET)) { 
     
foreach
 ($_GET as $key => $val) { 
 if (is_numeric($val)) { 
     $this->get[$key] = $this->getInt($val); 
 } else { 
     $this->get[$key] = $this->getStr($val); 
 } 
     } 
 } 
 if (!emptyempty($_POST)) { 
     foreach ($_POST as $key => $val) { 
 if (is_numeric($val)) { 
     $this->post[$key] = $this->getInt($val); 
 } else { 
     $this->post[$key] = $this->getStr($val); 
 } 
     } 
 } 
    } 
 
    public function getInt($number) 
    { 
 return intval($number); 
    } 
 
    public function getStr($string) 
    { 
 if (!
get_magic_quotes_gpc
()) { 
     $string = 
addslashes
($string); 
 } 
 return $string; 
    } 
 
    public function checkInject($string) 
    { 
 return eregi(&#39;select|insert|update|delete|/*|*|../|./|union|into|load_file|outfile&#39;, $string); 
    } 
 
    public function verifyId($id = null) 
    { 
 if (!$id || $this->checkInject($id) || !is_numeric($id)) { 
     $id = false; 
 } else { 
     $id = intval($id); 
 }
 return $id; 
    } 
} 
?>
Copy after login


Example 2, the code is as follows:

<?php  
/*************************   
说明:     
判断传递的
变量
中是否含有非法字符     
    
如$_POST、$_GET     
功能:     
防注入     
*************************/     
//要过滤的非法字符      
$ArrFiltrate=array("&#39;","or","and","union","where");      
//出错后要跳转的url,不填则默认前一页      
$StrGoUrl="";      
//是否存在数组中的值      
function FunStringExist($StrFiltrate,$ArrFiltrate){      
foreach ($ArrFiltrate as $key=>$value){      
if (eregi($value,$StrFiltrate)){      
  return true;      
}      
}      
return false;      
}      
//合并$_POST 和 $_GET      
if(function_exists(
array_merge
)){      
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);      
}else{      
foreach($HTTP_POST_VARS as $key=>$value){      
$ArrPostAndGet[]=$value;      
}      
foreach($HTTP_GET_VARS as $key=>$value){      
$ArrPostAndGet[]=$value;      
}      
}      
//验证开始      
foreach($ArrPostAndGet as $key=>$value){      
if (FunStringExist($value,$ArrFiltrate)){      
echo "<script language=&#39;
javascript
&#39;>alert(&#39;传递的信息中不得包含{&#39;,or,and,union}等非法字符请您把他们换成{‘,OR,AND,UNION}&#39;);</script>";      
if (emptyempty($StrGoUrl)){      
echo "<scriptlanguage=&#39;javascript&#39;>history.go(-1);</script>";      
}else{      
echo "<scriptlanguage=&#39;javascript&#39;>window.location=&#39;".$StrGoUrl."&#39;;</script>";      
}      
exit;      
}      
}      
/***************结束防止PHP注入*****************/     
?>
Copy after login


The above is the detailed content of Detailed explanation of practical PHP anti-injection code examples. For more information, please follow other related articles on the PHP Chinese website!

Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template