Simple php anti-injection code

The so-called SQL injection is to insert a SQL command into a Web form to submit or enter a domain name or query for a page request String, and ultimately trick the server into executing malicious SQL commands. Specifically, it is the ability to use existing applications to inject (malicious) SQL commands into the backend database engine for execution. It can obtain information on a website with security vulnerabilities by entering (malicious) SQL statements into a web form. database, rather than executing SQL statements as intended by the designer. For example, many previous film and television websites leaked VIP membership passwords, mostly by submitting query characters through WEB forms. Such forms are particularly vulnerable to SQL injection attacks. This article mainlyTwo methods to prevent injection in PHP. First, please save the following code as safe.php in the root directory of the website, and then add include("/safe.php") in front of each PHP file. ;That’s it:

php anti-injection code method one:

<?php 
//要过滤的非法字符 
$ArrFiltrate=array(”‘”,”;”,”union”); 
//出错后要跳转的url,不填则默认前一页 
$StrGoUrl=””; 
//是否存在数组中的值 
function FunStringExist($StrFiltrate,$ArrFiltrate){ 
foreach ($ArrFiltrate as $key=>$value){ 
if (eregi($value,$StrFiltrate)){ 
return true; 
} 
} 
return false; 
} 
//合并$_POST 和 $_GET 
if(function_exists(array_merge)){ 
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS); 
}else{ 
foreach($HTTP_POST_VARS as $key=>$value){ 
$ArrPostAndGet[]=$value; 
} 
foreach($HTTP_GET_VARS as $key=>$value){ 
$ArrPostAndGet[]=$value; 
} 
} 
//验证开始 
foreach($ArrPostAndGet as $key=>$value){ 
if (FunStringExist($value,$ArrFiltrate)){ 
echo “<script language=\”javascript\”>alert(\”非法字符\”);</script>”; 
if (emptyempty($StrGoUrl)){ 
echo “<script language=\”javascript\”>history.go(-1);</script>”; 
}else{ 
echo “<script language=\”javascript\”>window.location=\””.$StrGoUrl.”\”;</script>”; 
} 
exit; 
} 
} 
?>

php anti-injection code method two:

/* 过滤所有GET过来变量 */ 
foreach ($_GET as $get_key=>$get_var) 
{ 
if (is_numeric($get_var)) { 
$get[strtolower($get_key)] = get_int($get_var); 
} else { 
$get[strtolower($get_key)] = get_str($get_var); 
} 
} 
/* 过滤所有POST过来的变量 */ 
foreach ($_POST as $post_key=>$post_var) 
{ 
if (is_numeric($post_var)) { 
$post[strtolower($post_key)] = get_int($post_var); 
} else { 
$post[strtolower($post_key)] = get_str($post_var); 
} 
} 
/* 过滤函数 */ 
//整型过滤函数 
function get_int($number) 
{ 
return intval($number); 
} 
//字符串型过滤函数 
function get_str($string) 
{ 
if (!get_magic_quotes_gpc()) { 
return addslashes($string); 
} 
return $string; 
}

The above is the detailed content of Simple php anti-injection code. For more information, please follow other related articles on the PHP Chinese website!