PHP general anti-injection Security Code

/*************************

Note:

Determines whether the passed variable contains invalid characters.

Such as $ _ POST and $ _ GET

Function:

Anti-Injection

**************************/

<? Php

// Invalid characters to be filtered

$ ArrFiltrate = array ("", ";", "union ");

// The url to be redirected after an error occurs. If this parameter is left blank, the previous page is displayed by default.

$ StrGoUrl = "";

// Whether the value in the array exists

Function FunStringExist ($ StrFiltrate, $ ArrFiltrate ){

Foreach ($ ArrFiltrate as $ key => $ value ){

If (eregi ($ value, $ StrFiltrate )){

Return true;

}

}

Return false;

}

// Merge $ _ POST and $ _ GET

If (function_exists (array_merge )){

$ ArrPostAndGet = array_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS );

} Else {

Foreach ($ HTTP_POST_VARS as $ key => $ value ){

$ ArrPostAndGet [] = $ value;

}

Foreach ($ HTTP_GET_VARS as $ key => $ value ){

$ ArrPostAndGet [] = $ value;

}

}

// Verification starts

Foreach ($ ArrPostAndGet as $ key => $ value ){

If (FunStringExist ($ value, $ ArrFiltrate )){

Echo "<script language =/" javascript/"> alert (/" Neeao prompt, illegal character/"); </script> ";

If (empty ($ StrGoUrl )){

Echo "<script language =/" javascript/"> history. go (-1); </script> ";

} Else {

Echo "<script language =/" javascript/"> window. location =/" ". $ StrGoUrl."/"; </script> ";

}

Exit;

}

}

?>

Save as checkpostandget. php

Add include ("checkpostandget. php") before each php file.