Home  >  Article  >  Backend Development  >  PHP anti-injection code provided by 360

PHP anti-injection code provided by 360

WBOY
WBOYOriginal
2016-07-25 08:43:071128browse
  1. //Code By Safe3
  2. function customError($errno, $errstr, $errfile, $errline)
  3. {
  4. echo "Error number: [$errno],error on line $errline in $errfile
    " ;
  5. die();
  6. }
  7. set_error_handler("customError",E_ERROR);
  8. $getfilter="'|(and|or)\b.+?(>|<|=|in|like)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?Select|Update.+?SET|Insert\s+INTO.+?VALUES|(Select|Delete).+?FROM|(Create|Alter|Drop|TRUNCATE)\s+(TABLE|DATABASE)" ;
  9. $postfilter="\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?Select|Update.+?SET|Insert\s+INTO.+?VALUES|(Select|Delete).+?FROM|(Create|Alter|Drop|TRUNCATE)\s+(TABLE|DATABASE)" ;
  10. $cookiefilter="\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?Select|Update.+?SET|Insert\s+INTO.+?VALUES|(Select|Delete).+?FROM|(Create|Alter|Drop|TRUNCATE)\s+(TABLE|DATABASE)" ;
  11. function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq){
  12. if(is_array($StrFiltValue))
  13. {
  14. $StrFiltValue=implode($StrFiltValue);
  15. }
  16. if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){
  17. //slog("

    操作IP: ".$_SERVER["REMOTE_ADDR"]."
    操作时间: ".strftime("%Y-%m-%d %H:%M:%S")."
    操作页面:".$_SERVER["PHP_SELF"]."
    提交方式: ".$_SERVER["REQUEST_METHOD"]."
    提交参数: ".$StrFiltKey."
    提交数据: ".$StrFiltValue);
  18. print "360websec notice:Illegal operation!" ;
  19. exit();
  20. }
  21. }
  22. //$ArrPGC=array_merge($_GET,$_POST,$_COOKIE);
  23. foreach($_GET as $key=>$value){
  24. StopAttack($key,$value,$getfilter);
  25. }
  26. foreach($_POST as $key=>$value){
  27. StopAttack($key,$value,$postfilter);
  28. }
  29. foreach($_COOKIE as $key=>$value){
  30. StopAttack($key,$value,$cookiefilter);
  31. }
  32. /*
  33. if (file_exists('update360.php')) {
  34. echo "请重命名文件update360.php,防止黑客利用
    ";
  35. die();
  36. }
  37. */
  38. function slog($logs)
  39. {
  40. $toppath=$_SERVER["DOCUMENT_ROOT"]."/log.htm";
  41. $Ts=fopen($toppath,"a+");
  42. fputs($Ts,$logs."rn");
  43. fclose($Ts);
  44. }
复制代码

php


Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn