PHP Anti-injection security Implementation program code _php tutorial

Many of the previous talk about SQL anti-injection code, but still have to start from our server script, below to tell a little bit of PHP in a few common methods of anti-injection you can refer to.

The most common thing you can see is

First set MAGIC_QUOTES_GPC to On,display_errors set to OFF, and if ID type, we use Intval () to convert it to an integer type, such as code:
$id =intval ($id);

Okay, let me introduce the basic principles of PHP submission data filtering.

1) When committing variables into the database, we must use Addslashes () to filter, like our injection problem, a addslashes () will be done. In fact, when it comes to variable values, the Intval () function is also a good choice for filtering strings.

2) Open MAGIC_QUOTES_GPC and Magic_quotes_runtime in php.ini. MAGIC_QUOTES_GPC can turn the quotes in the Get,post,cookie into slashes. Magic_quotes_runtime the data in and out of the database can play the role of format. In fact, as early as the previous injection is crazy, this parameter is very popular.

3) When using system functions, you must use the Escapeshellarg (), escapeshellcmd () parameters to filter, so you can rest assured that the use of system functions.

4) for cross-site, Strip_tags (), Htmlspecialchars () Two parameters are good, for the user submitted with HTML and PHP markup will be converted. For example, the angle brackets "<" will be converted to "<" such harmless characters.

The code is as follows	Copy Code
$new = Htmlspecialchars ("Test", ent_quotes); Strip_tags ($text,);

5) for the filtering of related functions, just like the previous include (), Unlink,fopen () and so on, as long as you specify the variables you want to perform the action or filter the relevant characters closely, I think this is also invulnerable.

2, PHP simple data filtering

1) Warehousing: Trim ($STR), Addslashes ($STR)
2) Out of stock: Stripslashes ($STR)
3) Display: Htmlspecialchars (NL2BR ($STR))

Share an instance

The specific code:

The code is as follows

Copy Code

security.php /** * @author Zhengwei * @copyright 2007 */ /* Function name: Inject_check () Function: Detects whether the submitted value is a character that contains SQL injections, prevents injections, and secures the server Parameters: $sql _STR: Committed variables Return value: Return test result, ture or False Function Author: heiyeluren */ function Inject_check ($sql _str) { Return eregi (' select|insert|update|delete| ' | /*|*|.. /|. /|union|into|load_file|outfile ', $sql _str); To filter } /* Function name: verify_id () Function: Verify that the ID class value of the commit is legal Parameter: $id: The ID value of the Commit Return value: Returns the processed ID Function Author: heiyeluren */ function verify_id ($id =null) { if (! $id) {exit (' No arguments are submitted! '); }//Is null-judged ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! '); }//Injection judgment ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! '); }//Digital judgment $id = Intval ($id); The whole type of return $id; } /* Function name: Str_check () Function: Filter the submitted string Parameter: $var: The string to be processed Return value: Returns the filtered string Function Author: heiyeluren */ function Str_check ($STR) { if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open $str = Addslashes ($STR); To filter } $str = Str_replace ("_", "_", $str); Filter out the ' _ ' $str = str_replace ("%", "%", $str); Filter out the '% ' return $str; } /* Function name: Post_check () Function: Process the edited content of the submission Parameters: $post: What to submit return value: $post: Returns the filtered content Function Author: heiyeluren */ function Post_check ($post) { if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open $post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC } $post = Str_replace ("_", "_", $post); Filter out the ' _ ' $post = str_replace ("%", "%", $post); Filter out the '% ' $post = NL2BR ($post); Carriage return Conversion $post = Htmlspecialchars ($post); HTML markup Conversions return $post; } foreach ($_post as $post _key=> $post _var) { if (Is_numeric ($post _var)) { $post [Strtolower ($post _key)] = Get_int ($post _var); } else { $post [Strtolower ($post _key)] = Get_str ($post _var); } } /* Filter Function */ Integer Filter function function Get_int ($number) { Return Intval ($number); } string-Type Filter function function Get_str ($string) { if (!GET_MAGIC_QUOTES_GPC ()) { Return addslashes ($string); } return $string; } ?> In some CMS I will see foreach ($HTTP _post_vars as $key = + $value) { $ArrPostAndGet []= $value; } foreach ($HTTP _get_vars as $key = + $value) { $ArrPostAndGet []= $value; }

This code then loads the function on all pages, so filtering personal discoveries can be problematic if you upload a file.

http://www.bkjia.com/PHPjc/629640.html www.bkjia.com true http://www.bkjia.com/PHPjc/629640.html techarticle Many of the previous talk about SQL anti-injection code, but still have to start from our server script, the following to tell a next PHP in the anti-injection of some common methods you can refer to ...

