网页防注入,可以依赖360的通用防护代码吗
<?php<br />//Code By Safe3 <br />function customError($errno, $errstr, $errfile, $errline)<br />{ <br /> echo "<b>Error number:</b> [$errno],error on line $errline in $errfile<br />";<br /> die();<br />}<br />set_error_handler("customError",E_ERROR);<br />$getfilter="'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";<br />$postfilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";<br />$cookiefilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";<br />function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq){ <br /><br />if(is_array($StrFiltValue))<br />{<br /> $StrFiltValue=implode($StrFiltValue);<br />} <br />if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){ <br /> //slog("<br><br>操作IP: ".$_SERVER["REMOTE_ADDR"]."<br>操作时间: ".strftime("%Y-%m-%d %H:%M:%S")."<br>操作页面:".$_SERVER["PHP_SELF"]."<br>提交方式: ".$_SERVER["REQUEST_METHOD"]."<br>提交参数: ".$StrFiltKey."<br>提交数据: ".$StrFiltValue);<br /> print "360websec notice:Illegal operation!";<br /> exit();<br />} <br />} <br />//$ArrPGC=array_merge($_GET,$_POST,$_COOKIE);<br />foreach($_GET as $key=>$value){ <br /> StopAttack($key,$value,$getfilter);<br />}<br />foreach($_POST as $key=>$value){ <br /> StopAttack($key,$value,$postfilter);<br />}<br />foreach($_COOKIE as $key=>$value){ <br /> StopAttack($key,$value,$cookiefilter);<br />}<br />if (file_exists('update360.php')) {<br /> echo "请重命名文件update360.php，防止黑客利用<br/>";<br /> die();<br />}<br />function slog($logs)<br />{<br /> $toppath=$_SERVER["DOCUMENT_ROOT"]."/log.htm";<br /> $Ts=fopen($toppath,"a+");<br /> fputs($Ts,$logs."\r\n");<br /> fclose($Ts);<br />}<br />?>
