Discuz PHP to prevent SQL injection function _php skills

Source: Internet
Author: User
Tags sql injection
Recently in doing a subject polling website, customers understand some of the procedural aspects of things. There are special requirements to filter some characters to prevent SQL injection. There was no special study in this respect. Oh, and carry forward a back to copycat. Take the SQL anti-injection function of the Discuz forum!
Copy Code code as follows:

@extract (Daddslashes ($_cookie));
@extract (Daddslashes ($_post));
@extract (Daddslashes ($_get));
if (! $magic _QUOTES_GPC) {
$_files = Daddslashes ($_files);

function Daddslashes ($string, $force = 0) {
if (! $GLOBALS [' MAGIC_QUOTES_GPC '] | | $force) {
if (Is_array ($string)) {
foreach ($string as $key => $val) {
$string [$key] = Daddslashes ($val, $force);
} else {
$string = Addslashes ($string);
return $string;

You can enhance the following code to protect the security of the server, PHP to prevent SQL injection security functions is very important!
Copy Code code as follows:

Function name: Inject_check ()
Function: Detect the submitted value contains SQL injected characters, prevent injection, protect server security
Parameters: $sql _STR: Submitted variables
Return value: Returns the detection result, ture or False
function Inject_check ($sql _str) {
Return eregi (' select|insert|and|or|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile ', $sql _str) ; To filter

Function name: verify_id ()
Function: Verify that the submitted ID class value is legitimate
Parameters: $id: Submitted ID values
Return value: Returns the processed ID
function verify_id ($id =null) {
if (! $id) {exit (' No submit parameters! '); }//IS NULL judgment
ElseIf (Inject_check ($id)) {exit (' submitted parameter illegal! '); }//Injection judgment
ElseIf (!is_numeric ($id)) {exit (' submitted parameter illegal! '); }//Digital judgment
$id = Intval ($id); Integral type

return $id;

Function name: Str_check ()
Function: Filter the submitted string
Parameters: $var: strings to be processed
Return value: Returns the filtered string
function Str_check ($STR) {
if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open
$str = Addslashes ($STR); To filter
$str = Str_replace ("_", "\_", $str); To filter out the ' _ '
$str = str_replace ("%", "\%", $str); To filter out '% '

return $str;

Function name: Post_check ()
Function: Handle the edited content of the submission
Parameters: $post: Content to submit
return value: $post: Back to filtered content
function Post_check ($post) {
if (!GET_MAGIC_QUOTES_GPC ()) {//To determine if MAGIC_QUOTES_GPC is open
$post = Addslashes ($post); To filter the submitted data without opening the MAGIC_QUOTES_GPC
$post = Str_replace ("_", "\_", $post); To filter out the ' _ '
$post = str_replace ("%", "\%", $post); To filter out '% '
$post = NL2BR ($post); Carriage return Conversion
$post = Htmlspecialchars ($post); HTML markup Conversion

return $post;

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.