php filter special characters sql anti-injection code-PHP Tutorial-php.cn

php filter special characters sql anti-injection code

WBOY

Release： 2016-07-25 08:54:03

Original

1258 people have browsed it

//Method one
//Filter',",sql language name
addslashes();
//Method two, remove all html tags
strip_tags();
//Method three Filtering may generate code
function php_sava($str)
{
$farr = array(
"/s+/",
"/<(/?)(script|i?frame|style|html|body|title| link|meta|?|%)([^>]*?)>/isU",
"/(<[^>]*)on[a-zA-Z]+s*=([ ^>]*>)/isU",
);
$tarr = array(
" ",
"＜＞", //If you want to directly clear unsafe tags, you can leave it blank here
"" ,
);
$str = preg_replace( $farr,$tarr,$str);
return $str;
}
//php sql anti-injection code
class sqlin
{
//dowith_sql($value)
function dowith_sql($str)
{
$str = str_replace("and","",$str);
$str = str_replace("execute","",$str);
$str = str_replace("update" ,"",$str);
$str = str_replace("count","",$str);
$str = str_replace("chr","",$str);
$str = str_replace("mid ","",$str);
$str = str_replace("master","",$str);
$str = str_replace("truncate","",$str);
$str = str_replace(" char","",$str);
$str = str_replace("declare","",$str);
$str = str_replace("select","",$str);
$str = str_replace( "create","",$str);
$str = str_replace("delete","",$str);
$str = str_replace("insert","",$str);
$str = str_replace ("'","",$str);
$str = str_replace(""","",$str);
$str = str_replace(" ","",$str);
$str = str_replace ("or","",$str);
$str = str_replace("=","",$str);
$str = str_replace("%20","",$str);
// echo $str;
return $str;
}
//aticle() anti-SQL injection function//php tutorial
function sqlin()
{
foreach ($_GET as $key=>$value)
{
$ _GET[$key]=$this->dowith_sql($value);
}
foreach ($_POST as $key=>$value)
{
$_POST[$key]=$this->dowith_sql( $value);
}
}
}
$dbsql=new sqlin();
?>

Copy code

Usage: Copy the above code to create a new sqlin.php file, and then include it in the page where GET or POST data is received

Principle analysis: Replace all SQL keywords with empty This code cannot be used in the guestbook. If you want to use it in the guestbook, please replace it. ....... $str = str_replace("and","",$str); arrive $str = str_replace("%20","",$str); ... The code is:

$str = str_replace("and","and",$str);
$str = str_replace("execute","execute",$str);
$str = str_replace ("update","update",$str);
$str = str_replace("count","count",$str);
$str = str_replace("chr","c hr",$str);
$str = str_replace("mid","mid",$str);
$str = str_replace("master","master",$str);
$str = str_replace(" truncate","truncate",$str);
$str = str_replace("char","char",$str);
$str = str_replace("declare","declare",$str) ;
$str = str_replace("select","select",$str);
$str = str_replace("create","create",$str);
$str = str_replace("delete" ,"delete",$str);
$str = str_replace("insert","insert",$str);
$str = str_replace("'","'",$str);
$ str = str_replace(""",""",$str);
?>

Copy code

------------------------------------------------- ------ addslashes – Use backslashes to quote strings

string addslashes ( string str )

Returns a string with backslashes added in front of certain characters for database query statements, etc. These characters are single quote ('), double quote ("), backslash () and NUL (NULL character).

An example of using addslashes() is when you are entering data into a database. For example, inserting the name O'reilly into the database requires escaping it. Most databases use as escape character: O'reilly. This puts the data into the database without inserting extra . When the PHP directive magic_quotes_sybase is set to on, it means that inserting ' will be escaped with '.

By default, the PHP instruction magic_quotes_gpc is on, which mainly automatically runs addslashes() on all GET, POST and COOKIE data. Do not use addslashes() on strings that have been escaped by magic_quotes_gpc, as this will result in double escaping. When encountering this situation, you can use the function get_magic_quotes_gpc() to detect it. get_magic_quotes_gpc() This function obtains the value of the variable magic_quotes_gpc (GPC, Get/Post/Cookie) in the PHP environment configuration. Returning 0 means turning off this function; returning 1 means turning this function on. When magic_quotes_gpc is turned on, all ' (single quote), " (double quote), (backslash) and null characters are automatically converted to overflow characters containing backslashes. addslashes and stripslashes are used to operate on database characters in PHP. At first glance, it seems difficult to remember, but if you analyze it, add means to add, and strip means to ignore. slash is a slash, and slash is the plural of slash. Then addslashes means adding a slash, because some special characters are written to the database. Problems will occur later, such as " ', etc., so special symbols must be escaped to tell the database that those special symbols are strings. In the same way, stripslashes must subtract the slash when fetching the string from the database. htmlspecialchars converts certain special characters into html encoding. The most commonly used occasion may be the message board that handles customer messages. These special characters are limited to the following: & -> & " -> " < > -> > The functions of htmlentities are similar to htmlspecialchars, but htmlentities ignores all entities defined by HTML, including various special characters and Chinese characters. The result is that the Chinese characters become a bunch of garbled characters. htmlspecialchars_decode is the reverse process of htmlspecialchars, which converts html encoding into characters. PHP utility function for filtering special characters Special character filtering method for php form submission html special character filter php class How to escape special characters in url links Detailed explanation of php special character escaping php filter parameter special characters anti-injection php method to filter illegal and special strings Examples of php special character processing functions