简体中文（ZH-CN）English（EN）繁体中文（ZH-TW）日本語（JA）한국어（KO）Melayu（MS）Français（FR）Deutsch（DE）
Home
Article
Q&A
Course
Topic
Download
Game
Dictionary
Recent Updates

Home  >  Article  >  Backend Development  >  Summary of filtering special dangerous characters in php_PHP tutorial

Summary of filtering special dangerous characters in php_PHP tutorial

WBOY
WBOYOriginal
2016-07-13 10:47:581023browse

We may encounter some security issues when submitting forms or obtaining values ​​from URLs on the website. Below I have summarized some commonly used solutions to filter some dangerous special characters. I hope this tutorial will be helpful to you.

Generally, for the characters passed in, PHP can use the addslashes function to process them (only get_magic_quotes_gpc() is false, otherwise they will be escaped again!), so that a certain degree of security requirements can be achieved
Like this

The code is as follows Copy code
 代码如下 复制代码

if (!get_magic_quotes_gpc()) {    
     add_slashes($_GET);    
     add_slashes($_POST);    
     add_slashes($_COOKIE);    
}    
    
function add_slashes($string) {    
     if (is_array($string)) {    
         foreach ($string as $key => $value) {    
             $string[$key] = add_slashes($value);    
         }    
     } else {    
         $string = addslashes($string);    
     }    
     return $string;    
}
if (!get_magic_quotes_gpc()) {          add_slashes($_GET);                                                               add_slashes($_POST);                                                               add_slashes($_COOKIE);                                               }  ​   function add_slashes($string) { If (is_array($string)) { foreach ($string as $key => $value) {                   $string[$key] = add_slashes($value);                                                                                                                            } else {               $string = addslashes($string);                                             }   Return $string; }

但是还可以更进一步进行重新编码，解码，如下：

 代码如下 复制代码

//编码

function htmlencode($str) {     
      if(empty($str)) return;
      if($str=="") return $str;      
      $str=trim($str);
      $str=str_replace("&","&",$str);
      $str=str_replace(">",">",$str);
      $str=str_replace("<","&lt;",$str);
      $str=str_replace(chr(32),"&nbsp;",$str);
      $str=str_replace(chr(9),"&nbsp;",$str);
      $str=str_replace(chr(34),"&",$str);
      $str=str_replace(chr(39),"&#39;",$str);
      $str=str_replace(chr(13),"<br />",$str);
      $str=str_replace("'","''",$str);
      $str=str_replace("select","sel&#101;ct",$str);
      $str=str_replace("join","jo&#105;n",$str);
      $str=str_replace("union","un&#105;on",$str);
      $str=str_replace("where","wh&#101;re",$str);
      $str=str_replace("insert","ins&#101;rt",$str);
      $str=str_replace("delete","del&#101;te",$str);
      $str=str_replace("update","up&#100;ate",$str);
      $str=str_replace("like","lik&#101;",$str);
      $str=str_replace("drop","dro&#112;",$str);
      $str=str_replace("create","cr&#101;ate",$str);
      $str=str_replace("modify","mod&#105;fy",$str);
      $str=str_replace("rename","ren&#097;me",$str);
      $str=str_replace("alter","alt&#101;r",$str);
      $str=str_replace("cast","ca&#115;",$str);      
      return $str; 
}

这样就能更放心的对外来数据进行入库处理了， 但是从数据库取出来，在前台显示的时候，必须重新解码一下：

 代码如下 复制代码

//解码

function htmldecode($str) {     
      if(empty($str)) return;
      if($str=="")  return $str;
      $str=str_replace("sel&#101;ct","select",$str);
      $str=str_replace("jo&#105;n","join",$str);
      $str=str_replace("un&#105;on","union",$str);
      $str=str_replace("wh&#101;re","where",$str);
      $str=str_replace("ins&#101;rt","insert",$str);
      $str=str_replace("del&#101;te","delete",$str);
      $str=str_replace("up&#100;ate","update",$str);
      $str=str_replace("lik&#101;","like",$str);
      $str=str_replace("dro&#112;","drop",$str);
      $str=str_replace("cr&#101;ate","create",$str);
      $str=str_replace("mod&#105;fy","modify",$str);
      $str=str_replace("ren&#097;me","rename",$str);
      $str=str_replace("alt&#101;r","alter",$str);
      $str=str_replace("ca&#115;","cast",$str);
      $str=str_replace("&amp;","&",$str);
      $str=str_replace("&gt;",">",$str);
      $str=str_replace("&lt;","<",$str);
      $str=str_replace("&nbsp;",chr(32),$str);
      $str=str_replace("&nbsp;",chr(9),$str);
      $str=str_replace("&",chr(34),$str);
      $str=str_replace("&#39;",chr(39),$str);
      $str=str_replace("<br />",chr(13),$str);
      $str=str_replace("''","'",$str);      
      return $str;
}

虽然多了一步编码，解码的过程，但是安全方面，会更进一步，要如何做，自己取舍吧。

再附一些

 代码如下 复制代码

function safe_replace($string) {
 $string = str_replace(' ','',$string);
 $string = str_replace(''','',$string);
 $string = str_replace(''','',$string);
 $string = str_replace('*','',$string);
 $string = str_replace('"','"',$string);
 $string = str_replace("'",'',$string);
 $string = str_replace('"','',$string);
 $string = str_replace(';','',$string);
 $string = str_replace('<','<',$string);
$string = str_replace('>','>',$string);
 $string = str_replace("{",'',$string);
 $string = str_replace('}','',$string);
 return $string;
}

更全面的

 代码如下
 代码如下 复制代码

//处理提交的数据
function htmldecode($str) {
 if (empty ( $str ) || "" == $str) {
 return "";
 }
 
 $str = strip_tags ( $str );
 $str = htmlspecialchars ( $str );
 $str = nl2br ( $str );
 $str = str_replace ( "?", "", $str );
 $str = str_replace ( "*", "", $str );
 $str = str_replace ( "!", "", $str );
 $str = str_replace ( "~", "", $str );
 $str = str_replace ( "$", "", $str );
 $str = str_replace ( "%", "", $str );
 $str = str_replace ( "^", "", $str );
 $str = str_replace ( "^", "", $str );
 $str = str_replace ( "select", "", $str );
 $str = str_replace ( "join", "", $str );
 $str = str_replace ( "union", "", $str );
 $str = str_replace ( "where", "", $str );
 $str = str_replace ( "insert", "", $str );
 $str = str_replace ( "delete", "", $str );
 $str = str_replace ( "update", "", $str );
 $str = str_replace ( "like", "", $str );
 $str = str_replace ( "drop", "", $str );
 $str = str_replace ( "create", "", $str );
 $str = str_replace ( "modify", "", $str );
 $str = str_replace ( "rename", "", $str );
 $str = str_replace ( "alter", "", $str );
 $str = str_replace ( "cast", "", $str );
 
 $farr = array ("//s+/", //过滤多余的空白
"/<(//?)(img|script|i?frame|style|html|body|title|link|meta|/?|/%)([^>]*?)>/isU", //过滤