How to prevent sql injection in php website?

The operational security of the website is definitely an issue that every webmaster must consider. As we all know, most hackers attack websites by using SQL injection. This is what we often say why?

The most original static website is the safest. Today we will talk about the security specifications of PHP injection to prevent your website from being injected by SQL.

Nowadays, the mainstream website development language is still PHP, so let’s start with how to prevent SQL injection on PHP websites:

Security Prevention of Php Injection Through the above process, we can understand the principles and techniques of php injection. Of course, we can also develop corresponding prevention methods:
The first is the security settings of the server. Here are mainly the security settings of php+mysql and the security settings of the Linux host. To prevent php+mysql injection, first set magic_quotes_gpc to On and display_errs to Off. If it is an id type, we use intval() to convert it into an integer type, as shown in the code:



$idintval($id);
mysql_query”*fromexamplewherearticieid’$id’”; Or write like this: mysql_query(”SELECT*FROMarticleWHEREarticleid”.intval($id).””)
If it is a character type, use addslashes() to filter it, and then filter "%" and "_", such as:
$searchaddslashes($search);
$searchstr_replace(“_”,”_”,$search);
$searchstr_replace(“%”,”%”,$search);
Of course, you can also add PHP universal anti-injection code:
/*****************************
PHP universal anti-injection security code
Description:
Determine whether the passed variable contains illegal characters
Such as $_POST, $_GET
Function:
Anti-injection

*******************************/
//Illegal characters to be filtered
$ArrFiltratearray("'",";","union");
//The url to be redirected after an error occurs, if not filled in Default previous page
$StrGoUrl"";
//Whether there is a value in the array
functionFunStringExist($StrFiltrate,$ArrFiltrate){
feach($ArrFiltrateas$key>$value){
if(eregi ($value,$StrFiltrate)){
returntrue;
}
}
returnfalse;
}
//Merge $_POST and $_GET
if(function_exists(array_merge)){
$ArrPostAndGetarray_ merge ($HTTP_POST_VARS,$HTTP_GET_VARS);
}else{
feach($HTTP_POST_VARSas$key>$value){
$ArrPostAndGet[]$value;
}
feach($HTTP_GET_VARSas$key>$value) {
$ArrPostAndGet[]$value;
}
}
//Verification starts
feach($ArrPostAndGetas$key>$value){
if(FunStringExist($value,$ArrFiltrate)){
echo "alert(/"Neeao prompt, illegal character/");";
if(empty($StrGoUrl)){
echo "histy.go(-1);";
}else{
 echo "window.location/"".$StrGoUrl."/";";
}
exit;
}
}
?>
/*********** ******************

Save as checkpostget.php
Then add include("checkpostget.php"); before each php file
****************************/
In addition, the administrator username and password are md5 encrypted, which can effectively prevent PHP injection.
There are also some security precautions that need to be strengthened on the server and mysql.
For security settings of linux server:
To encrypt the password, use the "/usr/sbin/authconfig" tool to turn on the password shadow function and encrypt passwd.
To prohibit access to important files, enter the Linux command interface and enter at the prompt:
#chmod600/etc/inetd.conf//Change the file attributes to 600
#chattr+I /etc/inetd.conf // Ensure that the file owner is root
#chattr–I /etc/inetd.conf //Restrict changes to this file
It is forbidden for any user to change to the root user through the su command
Add the following two lines at the beginning of the su configuration file, that is, the /etc/pam.d/ directory:
Auth sufficient /lib/security/pam_rootok.sodebug
Auth required /lib/security/pam_whell.sogroupwheel
Delete all special accounts
#userdel lp etc. Delete user
#groupdellpetc delete group
Ban unused suid/sgid programs
#find/-typef(-perm-04000 -o–perm-02000)-execls–lg{};



http://hi.baidu.com/bigideaer/bl... 7e76e11a4cffd0.html

To determine whether the passed variables contain illegal characters, we put the following code into a public file, such as security.inc.php. Include this file in each file, then all the files submitted to any program can be After the variables are filtered, we achieve the effect once and for all.



Brief description: /***************************
Description:
Determine whether the passed variable contains illegal characters
Such as $_POST, $_GET
Function: Anti-injection
**************************/

The code is as follows:

//Illegal characters to be filtered
$ArrFiltratearray("",";","union");
//URL to be redirected after an error , if not filled in, it will default to the previous page
$StrGoUrl"";
//Whether there is a value in the array
functionFunStringExist($StrFiltrate,$ArrFiltrate){
feach($ArrFiltrateas$key>$value){
if(eregi($value,$StrFiltrate)){
returntrue;
}
}
returnfalse;
}

//Merge $_POST and $_GET
if(function_exists( array_merge) ){
$ArrPostAndGetarray_merge($HTTP_POST_VARS,$HTTP_GET_VARS);
} else{
feach($HTTP_POST_VARSas$key>$value){
$ArrPostAndGet[]$value;
} feach($HTTP_GET_VARSas $key>$value){

$ArrPostAndGet[]$value;

}

}


//Verification starts

feach($ArrPostAndGetas$key>$value){

if(FunStringExist($ value,$ArrFiltrate)){

echo"alert("Illegal character");";

if(emptyempty($StrGoUrl)){

echo"< ;scriptlanguage"javascript">histy.go(-1);";

}else{

echo"window.location"".$StrGoUrl."" ;";

}

exit;

}

}

?>

Then add include("checkpostget.php"); in front of each php file


Method 2

The code is as follows:

feach($_GETas$get_key>$get_var)

{

if(is_numeric($get_var)){

$get[strtolower($ get_key)]get_int($get_var);

}else{

$get[strtolower($get_key)]get_str($get_var);

}

}


/*Filter all POST variables* /

feach($_POSTas$post_key>$post_var)

{

if(is_numeric($post_var)){

$post[strtolower($post_key)]get_int($post_var);

}else{
 $post[strtolower($post_key)]get_str($post_var);

}

}


/*Filter function*/

//Integer filter function

functionget_int($number)

{

returnintval($number);

}

//String filter function

functionget_str($string)

{

if(!get_magic_quotes_gpc()){

returnaddslashes($string);
  }

return$string;

}

This topic was unpinned by Xiaobei on 2015-9-20 13:05