Home > Article > Backend Development > PHP filters dangerous code in form submissions
PHP filters dangerous code in form submissions
- 高洛峰Original
- 2016-11-29 15:21:281097browse
If the security of form submission is not done well, it is easy for the website to be attacked due to this form submission. Below I will share two examples of dangerous codes commonly used in PHP filter form submission. Friends in need can refer to it.
Example 1, the code is as follows:
function uhtml($str)
{
$farr = array(
"/s+/", //Filter excess white space
may introduce malicious intent Content or code that maliciously changes the display layout, if you do not need to insert flash, etc., you can also add the filter of
"/<(/?)(script|i?frame|style|html| body|title|link|meta|?|%)([^>]*?)>/isU",
" "/(<[^>]*)on[a-zA-Z]+ s*=([^>]*>)/isU",//Filter the on event of javascript
);
$tarr = array(
" " ",
" "＜123＞ ",// If you want to directly clear unsafe tags, you can leave it blank here
"12",
);
$str = preg_replace($farr,$tarr,$str);
return $str;
}
Example 2, or do this, the code is as follows:
//get post data
function PostGet($str,$post=0)
{
emptyempty($str)?die('para is null'. $str.'!'):'; [$str])?$ _POST
[$str]:'');
}
else
{
return addslashes(htmlspecialchars(isset($_POST[$str])?
$_POST[$str] :''));
}
}
}
else
{
if( get_magic_quotes_gpc() )
{
return htmlspecialchars(isset($_GET[$str])?$_GET[$ str]:');
} }//Open source code phpfensi.com }