Good PHP code to prevent SQL Injection Vulnerability filter functions

PHP Whole station Anti-injection program, need to require_once this file in public file Judging MAGIC_QUOTES_GPC Status if (@get_magic_quotes_gpc ()) { $_get = sec ($_get); $_post = sec ($_post); $_cookie = sec ($_cookie); $_files = sec ($_files); } $_server = sec ($_server); Function sec (& $array) { If it is an array, iterate through the array, calling recursively if (Is_array ($array)) { foreach ($array as $k = = $v) { $array [$k] = sec ($v); } } else if (is_string ($array)) { Use the Addslashes function to handle $array = Addslashes ($array); } else if (Is_numeric ($array)) { $array = Intval ($array); } return $array; } Integer Filter function function Num_check ($id) { if (! $id) { Die (' parameter cannot be empty! ' ); }//Is null-judged else if (Inject_check ($id)) { Die (' illegal parameters '); }//Injection judgment else if (! is_numetic ($id)) { Die (' illegal parameters '); } Digital judgment $id = Intval ($id); The whole type of return $id; } Character Filter function function Str_check ($STR) { if (Inject_check ($STR)) { Die (' illegal parameters '); } Injection judgment $str = Htmlspecialchars ($STR); Convert HTML return $str; } function Search_check ($STR) { $str = Str_replace ("_", "\_", $str); Filter Out "_" $str = str_replace ("%", "\%", $str); Filter out "%" $str = Htmlspecialchars ($STR); Convert HTML return $str; } Form Filter function function Post_check ($str, $min, $max) { if (Isset ($min) && strlen ($STR) < $min) { Die (' minimum $min bytes '); } else if (Isset ($max) && strlen ($STR) > $max) { Die (' Up to $max bytes '); } Return Stripslashes_array ($STR); } Anti-injection function function Inject_check ($sql _str) { Return eregi (' select|inert|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/| Union|into|load_file|outfile ', $sql _str); Filtration, anti-injection } Function Stripslashes_array (& $array) { if (Is_array ($array)) { foreach ($array as $k = = $v) { $array [$k] = Stripslashes_array ($v); } } else if (is_string ($array)) { $array = Stripslashes ($array); } return $array; } ?> Copy Code

