Maison > Article > développement back-end > La sécurité Web pour empêcher l'injection SQL consiste en plusieurs filtres avec fonction de filtre PHP

La sécurité Web pour empêcher l'injection SQL consiste en plusieurs filtres avec fonction de filtre PHP

不言original: 2018-05-04 10:15:323311parcourir

这篇文章主要介绍了关于web安全防sql注入就是多过滤附PHP过滤函数，有着一定的参考价值，现在分享给大家，有需要的朋友可以参考一下

SQL注入与跨站攻击过滤函数，支持SQL注入，跨站脚本攻击和跨站POST提交等常见安全过滤。

<?php    
     /**    
      * 全局安全过滤函数    
      * 支持SQL注入和跨站脚本攻击    
      */    
     function global_filter()    
     {    
     //APP，ACT 分别为控制器和控制器方法    
     $params = array(APP, ACT);    
     foreach($params as $k => $v)    
     {    
     if(!preg_match("/^[a-zA-Z0-9_-]+$/", $v))    
     {    
                 header_status_404();    
     }    
     }    
     
     $arrStr = array(&#39;%0d%0a&#39;, "&#39;", &#39;<&#39;, &#39;>&#39;, &#39;$&#39;, &#39;script&#39;, &#39;document&#39;, &#39;eval&#39;,&#39;atestu&#39;,&#39;select&#39;,&#39;insert?into&#39;,&#39;delete?from&#39;);    
     global_inject_input($_SERVER[&#39;HTTP_REFERER&#39;], $arrStr, true);    
     global_inject_input($_SERVER[&#39;HTTP_USER_AGENT&#39;], $arrStr, true);    
     global_inject_input($_SERVER[&#39;HTTP_ACCEPT_LANGUAGE&#39;], $arrStr, true);    
     global_inject_input($_GET, array_merge($arrStr, array(&#39;"&#39;)), true);    
     //global_inject_input($_COOKIE, array_merge($arrStr, array(&#39;"&#39;, &#39;&&#39;)), true);    
         //cookie会有对url的记录(pGClX_last_url)。去掉对&的判断    
         global_inject_input($_COOKIE, array_merge($arrStr, array(&#39;"&#39;)), true);    
     global_inject_input($_SERVER, array(&#39;%0d%0a&#39;), true);    
     
     //处理跨域POST提交问题    
     if($_SERVER[&#39;REQUEST_METHOD&#39;] == &#39;POST&#39;)    
     {    
     //处理客户端POST请求处理没有HTTP_REFERER参数问题    
     if(isset($_SERVER[&#39;HTTP_REFERER&#39;]))    
     {    
     $url = parse_url($_SERVER[&#39;HTTP_REFERER&#39;]);    
     $referer_host = !empty($url[&#39;port&#39;]) && $url[&#39;port&#39;] != &#39;80&#39; ? $url[&#39;host&#39;].&#39;:&#39;.$url[&#39;port&#39;] : $url[&#39;host&#39;];    
     if($referer_host != $_SERVER[&#39;HTTP_HOST&#39;])    
     {    
        header_status_404();    
     }    
     }    
     }    
     
     global_inject_input($_POST, array(&#39;%0d%0a&#39;));    
     global_inject_input($_REQUEST, array(&#39;%0d%0a&#39;));    
     }    
     
     /**    
      * 全局安全过滤函数    
      */    
     function global_inject_input($string, $inject_string, $replace = false)    
     {    
     if(!is_array($string))    
     {    
     foreach($inject_string as $value)    
     {    
     if(stripos(strtolower($string), $value) !== false)    
     {    
                     header_status_404();    
     }    
     }    
     if($replace)    
     {    
     return filter_var(safe_replace($string),FILTER_SANITIZE_STRING);    
     }    
     else    
     {    
        return $string;    
     }    
     }    
     
     foreach($string as $key => $val)    
     {    
     $string[$key] = global_inject_input($val, $inject_string, $replace);    
     }    
     
     return $string;    
     }    
     
     /**    
      * http 头信息    
     **/    
     function header_status_404($status = &#39;404&#39;)    
     {    
        if(substr(php_sapi_name(), 0, 3) == &#39;cgi&#39;)    
     {    
        header(&#39;Status: &#39;.$status, TRUE);    
        exit;    
     }    
        else    
        {    
     header($_SERVER[&#39;SERVER_PROTOCOL&#39;].&#39; &#39;.$status);    
     $error_404 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\r\n";    
     $error_404 .= "<html><head>\r\n";    
     $error_404 .= "<title>404 Not Found</title>\r\n";    
     $error_404 .= "</head><body>\r\n";    
     $error_404 .= "<h1>Object not found!</h1>\r\n";    
     $error_404 .= "<p>The requested URL was not found on this server!~</p>\r\n";    
     $error_404 .= "<h2>Error 404</h2></body></html>";    
     echo $error_404;    
     exit;    
     }    
     }    
     
     /**    
      * 安全过滤函数    
      *    
      * @param $string    
      * @return string    
      */    
     function safe_replace($string)    
     {    
     $string = str_replace(&#39;%20&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;%27&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;%2527&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;*&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;"&#39;, &#39;&quot;&#39;, $string);    
     $string = str_replace("&#39;", &#39;&#39;, $string);    
     $string = str_replace(&#39;"&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;;&#39;, &#39;&#39;, $string);    
     $string = str_replace(&#39;<&#39;, &#39;&lt;&#39;, $string);    
     $string = str_replace(&#39;>&#39;, &#39;&gt;&#39;, $string);    
     $string = str_replace("{", &#39;&#39;, $string);    
     $string = str_replace(&#39;}&#39;, &#39;&#39;, $string);    
     return $string;    
     }

Articles Liés

Voir plus