好了為php開發者提供了一款php sql 防注入與字符過濾以及各種過濾代碼哦。
好了為php開發者提供了一款php sql 防注入與字符過濾以及各種過濾代碼哦。
//==防注入自動過濾[啟用後程序效率低]==========================================================================================
/*
function inject_checks($sql_str){return eregi('select|insert|update|delete|'|/*|*|../|./|union|into|load_file|outfile', $sql_str);}
foreach ($_REQUEST as $value){if (inject_checks($value)){echo "<script language=javascript>alert('你提交的數據非法，請檢查後重新提交！');</script>";exit;}}
*/
//==防注[inject_check($sql_str)]==========================================================================================
function inject_check($sql_str){
if (eregi('select|insert|update|delete|union|into|load_file|outfile', $sql_str)){echo "<script language=javascript>alert('你提交的數據非法，請檢查後重新提交！');</script>";exit;}
return $sql_str;
}
//==字符過濾[safe_convert($string)]==============================================================================
function safe_convert($string){ //Words Filter
if(get_magic_quotes_gpc()){ //轉義字符 加上反斜線
$string=htmlspecialchars($string, ENT_QUOTES); //將特殊字元轉成HTML字串格式如 "&"轉成"&"
$string=str_replace("<","<",$string); //替換
$string=str_replace(">",">",$string); //替換
$string=str_replace("\", '\', $string); //替換
} else {
$string=addslashes($string); //轉義字符 加上反斜線 //$string=stripslashes($string); //去掉反斜線
$string=str_replace("\\", '\', $string);
}
//$string=str_replace("r","<br/>",$string); //換行
//$string=str_replace("n","",$string); //空格
$string=str_replace("t"," ",$string); //空格
$string=str_replace(" "," ",$string); //空格
//$string=str_replace('|', '|', $string); //替換 同分類系統有沖突
$string=str_replace("&#96;","`",$string); //替換
$string=str_replace("&#92;","\",$string); //替換
return $string;
}
//==字符反過濾[unsafe_convert($string)]==============================================================================
function unsafe_convert($string){ //Words Filter
$string=str_replace("\"",""",$string); //替換
return $string;
}
//==字符過濾[filter($string)]============================================================================================
function filter($string){ //Words Filter
include("Filter.php");//詞匯過濾列表
foreach($badwords as $badword){
if(stristr($string,$badword)==true){echo "<script language=javascript>alert('警告：你提交的內容含有敏感字眼，請更換內容。');</script>";exit;}
}
return $string;
}
