PHP prevents SQL injection Vulnerability Code and analysis

  This article mainly introduces PHP to prevent SQL Injection Vulnerability Code and analysis, recently provided several common attacks of regular expressions, we refer to the use of the bar

The injection vulnerability code and analysis code are as follows: <?php  function Customerror ($errno, $errstr, $errfile, $errline)   {      Echo "<b>error number:</b> [$errno],error on line $errline in $errfile <br/>";      Die (); &nb Sp }  Set_error_handler ("Customerror", e_error);  $getfilter = "' | (And|or) b.+? (>|<|=|in|like) |/*.+?*/|<s*scriptb|bexecb| Union.+? Select| Update.+? Set| Inserts+into.+? values| (select| DELETE). +? From| (create| alter| drop| TRUNCATE) s+ (table| DATABASE) ";  $postfilter =" B (and|or) b.{1,6}? (=|&GT;|&LT;|BINB|BLIKEB) |/*.+?*/|<s*scriptb|bexecb| Union.+? Select| Update.+? Set| Inserts+into.+? values| (select| DELETE). +? From| (create| alter| drop| TRUNCATE) s+ (table| DATABASE) ";  $cookiefilter =" B (and|or) b.{1,6}? (=|&GT;|&LT;|BINB|BLIKEB) |/*.+?*/|<s*scriptb|bexecb| Union.+? Select| Update.+? Set| Inserts+into.+? values| (select| DELETE). +? From| (create| alter| drop| TRUNCATE) s+ (table| DATABASE) ";  function Stopattack ($StrFiltKey, $StrFiltValue, $ArrFiltReq) {&NBsp       if (Is_array ($StrFiltValue))       {          $StrFiltValue =im Plode ($StrFiltValue);     }      if (Preg_match ("/". $ArrFiltReq. " /is ", $StrFiltValue) ==1&&!isset ($_request[' SecurityToken '])     {          Slog ("<br><br> Operation IP:". $_server["REMOTE_ADDR"]. " <br> operation time: ". Strftime ("%y-%m-%d%h:%m:%s ")." <br> Action page: ". $_server[" Php_self "]." <br> Submission Method: ". $_server[" Request_method "." <br> Submit parameters: ". $StrFiltKey." <br> submit data: ". $StrFiltValue);          print" result Notice:illegal operation! ";           exit ();     } }  foreach ($_get as $key => $value) {  & nbsp   Stopattack ($key, $value, $getfilter); }  foreach ($_post as $key => $value) {      Stopattack ($key, $value, $postfilter); }  foreach ($_cookie as $key => $value) {      Stopattack ($key, $value, $cookiefilter); }    function slog ($logs)   {      $toppath = "log.htm";      $Ts =fopen ($toppath, "A +");      fputs ($Ts, $logs. " RN ");      fclose ($Ts); } ?>   SQL       Analysis   If you use this function, this function will bypass P HP's standard error handling, so you have to define your own error handler (Die ()).　   Second, if the code has been wrong before the execution, then the user-defined program has not been executed, so it will not be used by the user to write the error handler.   So, PHP has a set of error handling mechanism, you can use Set_error_handler () to take over PHP error handling, you can use the Trigger_error () function to actively throw an error. The   Set_error_handler () function sets the user-defined error-handling function. function is used to create the user's own error handling method for the runtime.　 It needs to first create an error-handling function and then set the error level.   About usage:     Copy code code as follows: function Customerror ($errno, $errstr, $errfile, $errline)   {  echo "& Lt;b> error code:</b> [${errno}] ${errstr}\r\n ";   echo "The line of code where the error occurred: {$errline} file {$errfile}\r\n";   echo "PHP version", Php_version, "(", Php_os, ") \ r \ n";  //Die ();  }   Set_error_handler ("Customerror", e_all|E_STRICT);       In this function, you can do anything to do, including the wrong details of the format output, log file. The code is as follows: function slog ($logs)   {      $toppath = "log.htm";      $Ts =fopen ($toppath, "A +") ;      fputs ($Ts, $logs. " RN ");      fclose ($Ts); }     custom error-handling functions must have these four input variables $errno, $errstr, $errfile, $errline.   errno is a set of constants that represent the wrong rank and a set of integers that correspond to them, but are generally represented by their string values, so that the semantics are better. For example e_warning, the binary mask is 4, which indicates a warning message.   Next, this function is passed as a callback parameter to the Set_error_handler. This will take over PHP's native error-handling functions. Note that this type of hosting does not host all kinds of errors, such as E_error, E_parse, E_core_error, e_core_warning, E_compile_error, e_compile_warning, and E_ Part of the strict. These errors are displayed in the most original manner, or are not displayed. The   Stopattack () function writes a pass-through post, get, cookie, regular expression, and call slog () to the log file.     Copy code code as follows: $Exec _commond  = "(s| S) * (EXEC (s|+) + (s|x) pw+) (s| S) * "; $Simple _XSS = "(s| S) * ((%3C) |<) ((%2f) |/) *[a-z0-9%]+ ((%3e) |>) (s| S) * "; $Eval _xss  = "(s| s) * ((%65) |e) (s) * (%76) |v) (s) * (%61) |a) (s) * ((%6C) |l) (s| S) * "; $Image _xss  = "(s| S) * ((%3C) |<) ((%69)|i| i| (%49)) ((%6d) |m| m| (%4D)) ((%67) |g| G| (%47)) [^n]+ (%3e) |>) (s| S) * "; $Script _XSS = "(s| s) * ((%73) |s) (s) * (%63) |c) (s) * ((%72) |r) (s) * ((%69) |i) (s) * (%70) |p) (s) * ((%74) |t) (s| S) * "; $SQL _injection = "(s| S) * ((%27) | (') | (%3d) | (=)| (/)| (%2f) | (")| ((%22) | (-|%2d) {2}) | (%23) | (%3b) | (;)) + (s| S) * ";     When HP encounters an error, it gives the location, line number, and reason for the error script, and many people say it's not a big deal. But the consequences of revealing the actual path are unthinkable, and for some intruders, this information is very important, and in fact there are many servers that are now in question. Some network management simply put the PHP configuration file display_errors set to off to solve, but I think this method is too negative. There are times when we really need PHP to return the wrong information for debugging. And you may need to give the user an account when you make an error, or even navigate to another page. But with the Set_error_handler (), these contradictions can also be resolved.