php过滤特殊危险字符的总结_PHP教程

if (!get_magic_quotes_gpc()) {    
     add_slashes($_GET);    
     add_slashes($_POST);    
     add_slashes($_COOKIE);    
}    
    
function add_slashes($string) {    
     if (is_array($string)) {    
         foreach ($string as $key => $value) {    
             $string[$key] = add_slashes($value);    
         }    
     } else {    
         $string = addslashes($string);    
     }    
     return $string;    
}

//编码

function htmlencode($str) {     
      if(empty($str)) return;
      if($str=="") return $str;      
      $str=trim($str);
      $str=str_replace("&","&",$str);
      $str=str_replace(">",">",$str);
      $str=str_replace("<","<",$str);
$str=str_replace(chr(32)," ",$str);
$str=str_replace(chr(9)," ",$str);
$str=str_replace(chr(34),"&",$str);
$str=str_replace(chr(39),"'",$str);
$str=str_replace(chr(13),"
",$str);
      $str=str_replace("'","''",$str);
      $str=str_replace("select","select",$str);
      $str=str_replace("join","join",$str);
      $str=str_replace("union","union",$str);
      $str=str_replace("where","where",$str);
      $str=str_replace("insert","insert",$str);
      $str=str_replace("delete","delete",$str);
      $str=str_replace("update","update",$str);
      $str=str_replace("like","like",$str);
      $str=str_replace("drop","drop",$str);
      $str=str_replace("create","create",$str);
      $str=str_replace("modify","modify",$str);
      $str=str_replace("rename","rename",$str);
      $str=str_replace("alter","alter",$str);
      $str=str_replace("cast","cas",$str);      
      return $str; 
}

//解码

function htmldecode($str) {     
      if(empty($str)) return;
      if($str=="")  return $str;
      $str=str_replace("select","select",$str);
      $str=str_replace("join","join",$str);
      $str=str_replace("union","union",$str);
      $str=str_replace("where","where",$str);
      $str=str_replace("insert","insert",$str);
      $str=str_replace("delete","delete",$str);
      $str=str_replace("update","update",$str);
      $str=str_replace("like","like",$str);
      $str=str_replace("drop","drop",$str);
      $str=str_replace("create","create",$str);
      $str=str_replace("modify","modify",$str);
      $str=str_replace("rename","rename",$str);
      $str=str_replace("alter","alter",$str);
      $str=str_replace("cas","cast",$str);
      $str=str_replace("&","&",$str);
      $str=str_replace(">",">",$str);
      $str=str_replace("<","<",$str);
$str=str_replace(" ",chr(32),$str);
$str=str_replace(" ",chr(9),$str);
$str=str_replace("&",chr(34),$str);
$str=str_replace("'",chr(39),$str);
$str=str_replace("
",chr(13),$str);
      $str=str_replace("''","'",$str);      
      return $str;
}

function safe_replace($string) {
 $string = str_replace(' ','',$string);
 $string = str_replace(''','',$string);
 $string = str_replace(''','',$string);
 $string = str_replace('*','',$string);
 $string = str_replace('"','"',$string);
 $string = str_replace("'",'',$string);
 $string = str_replace('"','',$string);
 $string = str_replace(';','',$string);
 $string = str_replace('  $string = str_replace('>','>',$string);
 $string = str_replace("{",'',$string);
 $string = str_replace('}','',$string);
 return $string;
}

//处理提交的数据
function htmldecode($str) {
 if (empty ( $str ) || "" == $str) {
 return "";
 }
 
 $str = strip_tags ( $str );
 $str = htmlspecialchars ( $str );
 $str = nl2br ( $str );
 $str = str_replace ( "?", "", $str );
 $str = str_replace ( "*", "", $str );
 $str = str_replace ( "!", "", $str );
 $str = str_replace ( "~", "", $str );
 $str = str_replace ( "$", "", $str );
 $str = str_replace ( "%", "", $str );
 $str = str_replace ( "^", "", $str );
 $str = str_replace ( "^", "", $str );
 $str = str_replace ( "select", "", $str );
 $str = str_replace ( "join", "", $str );
 $str = str_replace ( "union", "", $str );
 $str = str_replace ( "where", "", $str );
 $str = str_replace ( "insert", "", $str );
 $str = str_replace ( "delete", "", $str );
 $str = str_replace ( "update", "", $str );
 $str = str_replace ( "like", "", $str );
 $str = str_replace ( "drop", "", $str );
 $str = str_replace ( "create", "", $str );
 $str = str_replace ( "modify", "", $str );
 $str = str_replace ( "rename", "", $str );
 $str = str_replace ( "alter", "", $str );
 $str = str_replace ( "cast", "", $str );
 
 $farr = array ("//s+/", //过滤多余的空白
"/]*?)>/isU", //过滤 "/(]*)on[a-zA-Z]+/s*=([^>]*>)/isU" )//过滤javascript的on事件
;
 $tarr = array (" ", "", //如果要直接清除不安全的标签，这里可以留空
"" );
 return $str;
}