Home  >  Article  >  Backend Development  >  PHP防XSS 防SQL注入的代码

PHP防XSS 防SQL注入的代码

WBOY
WBOYOriginal
2016-06-20 12:58:031012browse

这里提供了一个函数,用来过滤用户输入的内容!使用POST传值的时候,可以调用这个函数进行过滤!

    /**     * 过滤参数     * @param string $str 接受的参数     * @return string     */    static public function filterWords($str)    {        $farr = array(                "/<(\\/?)(script|i?frame|style|html|body|title|link|meta|object|\\?|\\%)([^>]*?)>/isU",                "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",                "/select|insert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dump/is"        );        $str = preg_replace($farr,'',$str);        return $str;    }        /**     * 过滤接受的参数或者数组,如$_GET,$_POST     * @param array|string $arr 接受的参数或者数组     * @return array|string     */    static public function filterArr($arr)    {        if(is_array($arr)){            foreach($arr as $k => $v){                $arr[$k] = self::filterWords($v);            }        }else{            $arr = self::filterWords($v);        }        return $arr;    }


Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn