比较好用的PHP防注入漏洞过滤函数代码_php实例

 <BR><?PHP <BR>//PHP整站防注入程序，需要在公共文件中require_once本文件 <BR>//判断magic_quotes_gpc状态 <BR>if (@get_magic_quotes_gpc ()) { <BR>$_GET = sec ( $_GET ); <BR>$_POST = sec ( $_POST ); <BR>$_COOKIE = sec ( $_COOKIE ); <BR>$_FILES = sec ( $_FILES ); <BR>}<b style="color:transparent">（、本文来源gao@!dai!ma.com搞$$代^@码网*</b><i>搞gaodaima代码</i> <BR>$_SERVER = sec ( $_SERVER ); <BR>function sec(&$array) { <BR>//如果是数组，遍历数组，递归调用 <BR>if (is_array ( $array )) { <BR>foreach ( $array as $k => $v ) { <BR>$array [$k] = sec ( $v ); <BR>} <BR>} else if (is_string ( $array )) { <BR>//使用addslashes函数来处理 <BR>$array = addslashes ( $array ); <BR>} else if (is_numeric ( $array )) { <BR>$array = intval ( $array ); <BR>} <BR>return $array; <BR>} <BR>//整型过滤函数 <BR>function num_check($id) { <BR>if (! $id) { <BR>die ( '参数不能为空！' ); <BR>} //是否为空的判断 <BR>else if (inject_check ( $id )) { <BR>die ( '非法参数' ); <BR>} //注入判断 <BR>else if (! is_numetic ( $id )) { <BR>die ( '非法参数' ); <BR>} <BR>//数字判断 <BR>$id = intval ( $id ); <BR>//整型化 <BR>return $id; <BR>} <BR>//字符过滤函数 <BR>function str_check($str) { <BR>if (inject_check ( $str )) { <BR>die ( '非法参数' ); <BR>} <BR>//注入判断 <BR>$str = htmlspecialchars ( $str ); <BR>//转换html <BR>return $str; <BR>} <BR>function search_check($str) { <BR>$str = str_replace ( "_", "\_", $str ); <BR>//把"_"过滤掉 <BR>$str = str_replace ( "%", "\%", $str ); <BR>//把"%"过滤掉 <BR>$str = htmlspecialchars ( $str ); <BR>//转换html <BR>return $str; <BR>} <BR>//表单过滤函数 <BR>function post_check($str, $min, $max) { <BR>if (isset ( $min ) && strlen ( $str ) < $min) { <BR>die ( '最少$min字节' ); <BR>} else if (isset ( $max ) && strlen ( $str ) > $max) { <BR>die ( '最多$max字节' ); <BR>} <BR>return stripslashes_array ( $str ); <BR>} <BR>//防注入函数 <BR>function inject_check($sql_str) { <BR>return eregi ( 'select|inert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|UNION|into|load_file|outfile', $sql_str ); <BR>// www.php.net 进行过滤，防注入 <BR>} <BR>function stripslashes_array(&$array) { <BR>if (is_array ( $array )) { <BR>foreach ( $array as $k => $v ) { <BR>$array [$k] = stripslashes_array ( $v ); <BR>} <BR>} else if (is_string ( $array )) { <BR>$array = stripslashes ( $array ); <BR>} <BR>return $array; <BR>} <BR>?> <BR>

喜欢 (0)赏

[搞代码]

分享 (0)