《PHP應(yīng)用：簡(jiǎn)單實(shí)用的PHP防注入類實(shí)例》要點(diǎn)：
本文介紹了PHP應(yīng)用：簡(jiǎn)單實(shí)用的PHP防注入類實(shí)例，希望對(duì)您有用。如果有疑問(wèn)，可以聯(lián)系我們。
PHP應(yīng)用本文實(shí)例講述了簡(jiǎn)單實(shí)用的PHP防注入類.分享給大家供大家參考.具體如下：
PHP應(yīng)用PHP防注入注意要過(guò)濾的信息基本是get,post,然后對(duì)于sql就是我們常用的查詢,插入等等sql命令了,下面我給各位整理兩個(gè)簡(jiǎn)單的例子,希望這些例子能給你網(wǎng)站帶來(lái)平安.
PHP應(yīng)用PHP防注入類代碼如下:
代碼如下:
<?php
/**
?* 參數(shù)處理類
?* @author JasonWei
?*/
class Params
{
??? public $get = array();
?
??? public $post = array();
?
??? function __construct()
??? {
?if (!emptyempty($_GET)) {
???? foreach ($_GET as $key => $val) {
?if (is_numeric($val)) {
???? $this->get[$key] = $this->getInt($val);
?} else {
???? $this->get[$key] = $this->getStr($val);
?}
???? }
?}
?if (!emptyempty($_POST)) {
???? foreach ($_POST as $key => $val) {
?if (is_numeric($val)) {
???? $this->post[$key] = $this->getInt($val);
?} else {
???? $this->post[$key] = $this->getStr($val);
?}
???? }
?}
??? }
?
??? public function getInt($number)
??? {
?return intval($number);
??? }
?
??? public function getStr($string)
??? {
?if (!get_magic_quotes_gpc()) {
???? $string = addslashes($string);
?}
?return $string;
??? }
?
??? public function checkInject($string)
??? {
?return eregi('select|insert|update|delete|/*|*|../|./|union|into|load_file|outfile', $string);
??? }
?
??? public function verifyId($id = null)
??? {
?if (!$id || $this->checkInject($id) || !is_numeric($id)) {
???? $id = false;
?} else {
???? $id = intval($id);
?}
?return $id;
??? }
}
?>
例子二,代碼如下:
代碼如下:
<?php?
/*************************??
說(shuō)明：????
判斷傳遞的變量中是否含有非法字符????
???
如$_POST、$_GET????
功能：????
防注入????
*************************/????
//要過(guò)濾的非法字符?????
$ArrFiltrate=array("'","or","and","union","where");?????
//出錯(cuò)后要跳轉(zhuǎn)的url,不填則默認(rèn)前一頁(yè)?????
$StrGoUrl="";?????
//是否存在數(shù)組中的值?????
function FunStringExist($StrFiltrate,$ArrFiltrate){?????
foreach ($ArrFiltrate as $key=>$value){?????
if (eregi($value,$StrFiltrate)){?????
? return true;?????
}?????
}?????
return false;?????
}?????
//合并$_POST 和 $_GET?????
if(function_exists(array_merge)){?????
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);?????
}else{?????
foreach($HTTP_POST_VARS as $key=>$value){?????
$ArrPostAndGet[]=$value;?????
}?????
foreach($HTTP_GET_VARS as $key=>$value){?????
$ArrPostAndGet[]=$value;?????
}?????
}?????
//驗(yàn)證開(kāi)始?????
foreach($ArrPostAndGet as $key=>$value){?????
if (FunStringExist($value,$ArrFiltrate)){?????
echo "<script language='javascript'>alert('傳遞的信息中不得包含{',or,and,union}等非法字符請(qǐng)您把他們換成{‘,ＯＲ,ＡＮＤ,ＵＮＩＯＮ}');</script>";?????
if (emptyempty($StrGoUrl)){?????
echo "<scriptlanguage='javascript'>history.go(-1);</script>";?????
}else{?????
echo "<scriptlanguage='javascript'>window.location='".$StrGoUrl."';</script>";?????
}?????
exit;?????
}?????
}?????
/***************結(jié)束防止PHP注入*****************/????
?>
PHP應(yīng)用希望本文所述對(duì)大家的PHP程序設(shè)計(jì)有所贊助.
維易PHP培訓(xùn)學(xué)院每天發(fā)布《PHP應(yīng)用：簡(jiǎn)單實(shí)用的PHP防注入類實(shí)例》等實(shí)戰(zhàn)技能，PHP、MYSQL、LINUX、APP、JS,CSS全面培養(yǎng)人才。
轉(zhuǎn)載請(qǐng)注明本頁(yè)網(wǎng)址：
http://www.fzlkiss.com/jiaocheng/13444.html
