Home >Backend Development >PHP Tutorial >简单实用的PHP防注入类实例_PHP

简单实用的PHP防注入类实例_PHP

WBOY
WBOYOriginal
2016-05-31 18:15:38744browse

本文实例讲述了简单实用的PHP防注入类。分享给大家供大家参考。具体如下:

PHP防注入注意要过滤的信息基本是get,post,然后对于sql就是我们常用的查询,插入等等sql命令了,下面我给各位整理两个简单的例子,希望这些例子能给你网站带来安全.

PHP防注入类代码如下:

代码如下:

/**
 * 参数处理类
 * @author JasonWei
 */
class Params
{
    public $get = array();
 
    public $post = array();
 
    function __construct()
    {
 if (!emptyempty($_GET)) {
     foreach ($_GET as $key => $val) {
 if (is_numeric($val)) {
     $this->get[$key] = $this->getInt($val);
 } else {
     $this->get[$key] = $this->getStr($val);
 }
     }
 }
 if (!emptyempty($_POST)) {
     foreach ($_POST as $key => $val) {
 if (is_numeric($val)) {
     $this->post[$key] = $this->getInt($val);
 } else {
     $this->post[$key] = $this->getStr($val);
 }
     }
 }
    }
 
    public function getInt($number)
    {
 return intval($number);
    }
 
    public function getStr($string)
    {
 if (!get_magic_quotes_gpc()) {
     $string = addslashes($string);
 }
 return $string;
    }
 
    public function checkInject($string)
    {
 return eregi('select|insert|update|delete|/*|*|../|./|union|into|load_file|outfile', $string);
    }
 
    public function verifyId($id = null)
    {
 if (!$id || $this->checkInject($id) || !is_numeric($id)) {
     $id = false;
 } else {
     $id = intval($id);
 }
 return $id;
    }
}
?>


例子二,代码如下:

代码如下:

/*************************  
说明:    
判断传递的变量中是否含有非法字符    
   
如$_POST、$_GET    
功能:    
防注入    
*************************/    
//要过滤的非法字符     
$ArrFiltrate=array("'","or","and","union","where");     
//出错后要跳转的url,不填则默认前一页     
$StrGoUrl="";     
//是否存在数组中的值     
function FunStringExist($StrFiltrate,$ArrFiltrate){     
foreach ($ArrFiltrate as $key=>$value){     
if (eregi($value,$StrFiltrate)){     
  return true;     
}     
}     
return false;     
}     
//合并$_POST 和 $_GET     
if(function_exists(array_merge)){     
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);     
}else{     
foreach($HTTP_POST_VARS as $key=>$value){     
$ArrPostAndGet[]=$value;     
}     
foreach($HTTP_GET_VARS as $key=>$value){     
$ArrPostAndGet[]=$value;     
}     
}     
//验证开始     
foreach($ArrPostAndGet as $key=>$value){     
if (FunStringExist($value,$ArrFiltrate)){     
echo "";     
if (emptyempty($StrGoUrl)){     
echo "history.go(-1);";     
}else{     
echo "window.location='".$StrGoUrl."';";     
}     
exit;     
}     
}     
/***************结束防止PHP注入*****************/    
?>

希望本文所述对大家的PHP程序设计有所帮助。

Statement:
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn