Home > Backend Development > PHP Tutorial > php 防注入_PHP

php 防注入_PHP

WBOY
Release: 2016-06-01 12:25:40
Original
931 people have browsed it
CODE
  1. /*************************
  2. 说明:
  3. 判断传递的变量中是否含有非法字符
  4. 如$_POST、$_GET
  5. 功能:
  6. 防注入
  7. **************************/
  8. //要过滤的非法字符
  9. $ArrFiltrate=array("'",";","union");
  10. //出错后要跳转的url,不填则默认前一页
  11. $StrGoUrl="";
  12. //是否存在数组中的值
  13. function FunStringExist($StrFiltrate,$ArrFiltrate){
  14. foreach ($ArrFiltrate as $key=>$value){
  15.    if (eregi($value,$StrFiltrate)){
  16.        return true;
  17.    }
  18.  }
  19. return false;
  20. }
  21. //合并$_POST 和 $_GET
  22. if(function_exists(array_merge)){
  23.    $ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);
  24. }else{
  25.    foreach($HTTP_POST_VARS as $key=>$value){
  26.        $ArrPostAndGet[]=$value;
  27.    }
  28.    foreach($HTTP_GET_VARS as $key=>$value){
  29.        $ArrPostAndGet[]=$value;
  30.    }
  31. }
  32. //验证开始
  33. foreach($ArrPostAndGet as $key=>$value){
  34.    if (FunStringExist($value,$ArrFiltrate)){
  35.        echo "";
  36.        if (empty($StrGoUrl)){
  37.        echo "";
  38.        }else{
  39.        echo "";
  40.        }
  41.        exit;
  42.    }
  43. }
  44. ?>

保存为checkpostandget.php
然后在每个php文件前加include(“checkpostandget.php“);即可
Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template