PHP 安全检测代码片段(分享)_php技巧

/**<BR>  <STRONG>* html转换输出（只转义' " 保留Html正常运行)<BR></STRONG>  * @param $param<BR>  * @return string<BR>  */<BR> function htmlEscape($param) {<BR>    return trim(htmlspecialchars($param, ENT_QUOTES));<BR> }<br><br>  /**<BR>  <STRONG>* 是否数组（同时检测数组中是否存在值）<BR></STRONG>  * @param $params<BR>  * @return boolean<BR>  */<BR> function isArray($params) {<BR>     return (!is_array($params) || !count($params)) ? false : true;<BR> } <br><br> /**<BR>  <STRONG>* 变量是否在数组中存在（参数容错， 字符串是否存在于数组中)<BR></STRONG>  * @param $param<BR>  * @param $params<BR>  * @return boolean<BR>  */<BR> function inArray($param, $params) {<BR>    return (!in_array((string)$param, (array)$params)) ? false : true;<BR> }<br><br> /**<BR>  <STRONG>* 通用多类型混合转义函数<BR></STRONG>  * @param $var<BR>  * @param $strip<BR>  * @param $isArray<BR>  * @return mixture<BR>  */<BR> function sqlEscape($var, $strip = true, $isArray = false) {<BR>    if (is_array($var)) {<BR>        if (!$isArray) return " '' ";<BR>        foreach ($var as $key => $value) {<BR>            $var[$key] = trim(S::sqlEscape($value, $strip));<BR>        }<BR>        return $var;<BR>    } elseif (is_numeric($var)) {<BR>         return " '" . $var . "' ";<BR>    } else {<BR>        return " '" . addslashes($strip ? stripslashes($var) : $var) . "' ";<BR>    }<BR>}<br><br>     /**<BR>      <STRONG>* 获取服务器变量<BR></STRONG>      * @param $keys<BR>      * @return string<BR>      */<BR>     function getServer($keys) {<BR>         $server = array();<BR>         $array = (array) $keys;<BR>         foreach ($array as $key) {<BR>             $server[$key] = NULL;<BR>             if (isset($_SERVER[$key])) {<BR>                 $server[$key] = str_replace(array('','"',"'",'%3C','%3E','%22','%27','%3c','%3e'), '', $_SERVER[$key]);<BR>             }<BR>         }<BR>         return is_array($keys) ? $server : $server[$keys];<BR>     }<br><br>     /**<BR>      <STRONG>* 变量转义<BR></STRONG>      * @param $array<BR>      */<BR>     function slashes(&$array) {<BR>         if (is_array($array)) {<BR>             foreach ($array as $key => $value) {<BR>                 if (is_array($value)) {<BR>                     S::slashes($array[$key]);<BR>                 } else {<BR>                     $array[$key] = addslashes($value);<BR>                 }<BR>             }<BR>         }<BR>     }<br><br>     /**<BR>      <STRONG>* 目录转换<BR></STRONG>      * @param unknown_type $dir<BR>      * @return string<BR>      */<BR>     function escapeDir($dir) {<BR>         $dir = str_replace(array("'",'#','=','`','$','%','&',';'), '', $dir);<BR>         return rtrim(preg_replace('/(\/){2,}|(\\\){1,}/', '/', $dir), '/');<BR>     }<BR>     /**<BR>      <STRONG>* 通用多类型转换<BR></STRONG>      * @param $mixed<BR>      * @param $isint<BR>      * @param $istrim<BR>      * @return mixture<BR>      */<BR>     function escapeChar($mixed, $isint = false, $istrim = false) {<BR>         if (is_array($mixed)) {<BR>             foreach ($mixed as $key => $value) {<BR>                 $mixed[$key] = S::escapeChar($value, $isint, $istrim);<BR>             }<BR>         } elseif ($isint) {<BR>             $mixed = (int) $mixed;<BR>         } elseif (!is_numeric($mixed) && ($istrim ? $mixed = trim($mixed) : $mixed) && $mixed) {<BR>             $mixed = S::escapeStr($mixed);<BR>         }<BR>         return $mixed;<BR>     }<BR>     /**<BR>      <STRONG>* 字符转换<BR></STRONG>      * @param $string<BR>      * @return string<BR>      */<BR>     function escapeStr($string) {<BR>         $string = str_replace(array("\0","%00","\r"), '', $string); //modified@2010-7-5<BR>         $string = preg_replace(array('/[\\x00-\\x08\\x0B\\x0C\\x0E-\\x1F]/','/&(?!(#[0-9]+|[a-z]+);)/is'), array('', '&'), $string);<BR>         $string = str_replace(array("%3C",'<'), '<', $string);<BR>         $string = str_replace(array("%3E",'>'), '>', $string);<BR>         $string = str_replace(array('"',"'","\t",'  '), array('"',''','    ','  '), $string);<BR>         return $string;<BR>     }<BR>     /**<BR>      <STRONG>* 变量检查<BR></STRONG>      * @param $var<BR>      */<BR>     function checkVar(&$var) {<BR>         if (is_array($var)) {<BR>             foreach ($var as $key => $value) {<BR>                 S::checkVar($var[$key]);<BR>             }<BR>         } elseif (P_W != 'admincp') {<BR>             $var = str_replace(array('..',')','<','='), array('..',')','<','='), $var);<BR>         } elseif (str_replace(array('<iframe','<meta','<script'), '', $var) != $var) {<BR>             global $basename;<BR>             $basename = 'java<b style="color:transparent">本文来源gao@!dai!ma.com搞$$代^@码!网!</b><strong>搞gaodaima代码</strong>script:history.go(-1);';<BR>             adminmsg('word_error');<BR>         }<BR>     }<BR>

喜欢 (0)赏

[搞代码]

分享 (0)