Community Learn Tools Library Leisure
search
English
Home > Backend Development > PHP Tutorial > Simple and easy to understand php sql anti-injection code

Simple and easy to understand php sql anti-injection code

WBOY
Release： 2016-07-25 09:03:40
Original
1047 people have browsed it
  2. //Illegal characters to be filtered
  3. $ArrFiltrate=array("'",";","union");
  4. //The url to be redirected after an error occurs, if not filled in Default previous page
  5. $StrGoUrl="";
  6. //Whether there is a value in the array
  7. function FunStringExist($StrFiltrate,$ArrFiltrate){
  8. foreach ($ArrFiltrate as $key=>$value){
  9. if (eregi ($value,$StrFiltrate)){
  10. return true;
  11. }
  12. }
  13. return false;
  14. }
  15. //Merge $_POST and $_GET
  16. if(function_exists(array_merge)){
  17. $ArrPostAndGet=array_merge($HTTP_POST_VARS, $HTTP_GET_VARS);
  18. }else{
  19. foreach($HTTP_POST_VARS as $key=>$value){
  20. $ArrPostAndGet[]=$value;
  21. }
  22. foreach($HTTP_GET_VARS as $key=>$value){
  23. $ArrPostAndGet[]=$value;
  24. }
  25. }
  26. //Verification starts
  27. foreach($ArrPostAndGet as $key=>$value){
  28. if (FunStringExist($value,$ArrFiltrate)){
  29. echo “< script language=”javascript”>alert(“Illegal character”);”;
  30. if (emptyempty($StrGoUrl)){
  31. echo “”;
  32. }else{
  33. echo “”;
  34. }
  35. exit;
  36. }
  37. }
  38. ?>
Copy code

Method 2

  2. /* Filter all GET variables*/
  3. foreach ($_GET as $get_key=>$get_var)
  4. {
  5. if (is_numeric($get_var)) {
  6. $get[ strtolower($get_key)] = get_int($get_var);
  7. } else {
  8. $get[strtolower($get_key)] = get_str($get_var);
  9. }
  10. }
  11. /* Filter all POST variables*/
  12. foreach ($_POST as $post_key=>$post_var)
  13. {
  14. if (is_numeric($post_var)) {
  15. $post[strtolower($post_key)] = get_int($post_var);
  16. } else {
  17. $post[ strtolower($post_key)] = get_str($post_var);
  18. }
  19. }
  20. /* Filter function*/
  21. //Integer filter function
  22. function get_int($number)
  23. {
  24. return intval($number);
  25. }
  26. //String filter function
  27. function get_str($string)
  28. {
  29. if (!get_magic_quotes_gpc()) {
  30. return addslashes($string);
  31. }
  32. return $string;
  33. }
  34. ?>
Copy code


Related labels：
简明易懂的php sql防注入代码
source：php.cn
Previous article：Refer to the PHP encryption and decryption processing class written by discuz's passport Next article：The difference and comparison between php function rand and mt_rand
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Latest Articles by Author
Latest Issues
function_exists() cannot determine the custom function Function test () {return true;} if (function_exists ('test')) {echo "test is function...
From 2024-04-29 11:01:01
0
3
2039
How to display the mobile version of Google Chrome Hello teacher, how can I change Google Chrome into a mobile version?
From 2024-04-23 00:22:19
0
11
2199
The child window operates the parent window, but the output does not respond. The first two sentences are executable, but the last sentence cannot be implemented.
From 2024-04-19 15:37:47
0
1
1853
There is no output in the parent window document.onclick = function(){ window.opener.document.write('I am the output of the child ...
From 2024-04-18 23:52:34
0
1
1745
Where is the courseware about CSS mind mapping? Courseware
From 2024-04-16 10:10:18
0
0
1765
Related Topics
More>
Popular Recommendations
Popular Tutorials
More>
Related Tutorials
Popular Recommendations
Latest courses
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template