PHP防注入漏洞攻击的过滤函数代码

<br /></p><p><?PHP </p>//PHP整站防注入程序，需要在公共文件中require_once本文件 <br />//判断magic_quotes_gpc状态 <br />if (@get_magic_quotes_gpc ()) { <br />$_GET = sec ( $_GET ); <br />$_POST = sec ( $_POST ); <br />$_COOKIE = sec ( $_COOKIE ); <br />$_FILES = sec ( $_FILES ); <br />} <br />$_SERVER = sec ( $_SERVER ); <br />function sec(&$array) { <br />//如果是数组，遍历数组，递归调用 <br />if (is_array ( $array )) { <br />foreach ( $array as $k => $v ) { <br />$array [$k] = sec ( $v ); <br />} <br />} else if (is_string ( $array )) { <br />//使用addslashes函数来处理 <br />$array = addslashes ( $array ); <br />} else if (is_numeric ( $array )) { <br />$array = intval ( $array ); <br />} <br />return $array; <br />} <br />//整型过滤函数 <br />function num_check($id) { <br />if (! $id) { <br />die ( '参数不能为空！' ); <br />} //是否为空的判断 <br />else if (inject_check ( $id )) { <br />die ( '非法参数' ); <br />} //注入判断 <br />else if (! is_numetic ( $id )) { <br />die ( '非法参数' ); <br />} <br />//数字判断 <br />$id = intval ( $id ); <br />//整型化 <br />return $id; <br />} <br />//字符过滤函数 <br />function str_check($str) { <br />if (inject_check ( $str )) { <br />die ( '非法参数' ); <br />} <br />//注入判断 <br />$str = htmlspecialchars ( $str ); <br />//转换html <br />return $str; <br />} <br />function search_check($str) { <br />$str = str_replace ( "_", "\_", $str ); <br />//把"_"过滤掉 <br />$str = str_replace ( "%", "\%", $str ); <br />//把"%"过滤掉 <br />$str = htmlspecialchars ( $str ); <br />//转换html <br />return $str; <br />} <br />//表单过滤函数 <br />function post_check($str, $min, $max) { <br />if (isset ( $min ) && strlen ( $str ) < $min) { <br />die ( '最少$min字节' ); <br />} else if (isset ( $max ) && strlen ( $str ) > $max) { <br />die ( '最多$max字节' ); <br />} <br />return stripslashes_array ( $str ); <br />} <br />//防注入函数 <br />function inject_check($sql_str) { <br />return eregi ( 'select|inert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|UNION|into|load_file|outfile', $sql_str ); <br />// www.scutephp.com 进行过滤，防注入 <br />} <br />function stripslashes_array(&$array) { <br />if (is_array ( $array )) { <br />foreach ( $array as $k => $v ) { <br />$array [$k] = stripslashes_array ( $v ); <br />} <br />} else if (is_string ( $array )) { <br />$array = stripslashes ( $array ); <br />} <br />return $array; <br />} <br />?>