Discuz PHP to prevent SQL injection function _php skills

Recently in doing a subject polling website, customers understand some of the procedural aspects of things. There are special requirements to filter some characters to prevent SQL injection. There was no special study in this respect. Oh, and carry forward a back to copycat. Take the SQL anti-injection function of the Discuz forum!

Copy Code code as follows:

$magic _QUOTES_GPC = GET_MAGIC_QUOTES_GPC ();
@extract (Daddslashes ($_cookie));
@extract (Daddslashes ($_post));
@extract (Daddslashes ($_get));
if (! $magic _QUOTES_GPC) {
$_files = Daddslashes ($_files);
}


function Daddslashes ($string, $force = 0) {
if (! $GLOBALS [' MAGIC_QUOTES_GPC '] | | $force) {
if (Is_array ($string)) {
foreach ($string as $key => $val) {
$string [$key] = Daddslashes ($val, $force);
}
} else {
$string = Addslashes ($string);
}
}
return $string;
}

You can enhance the following code to protect the security of the server, PHP to prevent SQL injection security functions is very important!

Copy Code code as follows:

/*
Function name: Inject_check ()
Function: Detect the submitted value contains SQL injected characters, prevent injection, protect server security
Parameters: $sql _STR: Submitted variables
Return value: Returns the detection result, ture or False
*/
function Inject_check ($sql _str) {
Return eregi (' select|insert|and|or|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile ', $sql _str) ; To filter
}

/*
Function name: verify_id ()
Function: Verify that the submitted ID class value is legitimate
Parameters: $id: Submitted ID values
Return value: Returns the processed ID
*/
function verify_id ($id =null) {
if (! $id) {exit (' No submit parameters! '); }//IS NULL judgment
ElseIf (Inject_check ($id)) {exit (' submitted parameter illegal! '); }//Injection judgment
ElseIf (!is_numeric ($id)) {exit (' submitted parameter illegal! '); }//Digital judgment
$id = Intval ($id); Integral type

return $id;
}

/*
Function name: Str_check ()
Function: Filter the submitted string
Parameters: $var: strings to be processed
Return value: Returns the filtered string
*/
function Str_check ($STR) {
if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open
$str = Addslashes ($STR); To filter
}
$str = Str_replace ("_", "\_", $str); To filter out the ' _ '
$str = str_replace ("%", "\%", $str); To filter out '% '

return $str;
}

/*
Function name: Post_check ()
Function: Handle the edited content of the submission
Parameters: $post: Content to submit
return value: $post: Back to filtered content
*/
function Post_check ($post) {
if (!GET_MAGIC_QUOTES_GPC ()) {//To determine if MAGIC_QUOTES_GPC is open
$post = Addslashes ($post); To filter the submitted data without opening the MAGIC_QUOTES_GPC
}
$post = Str_replace ("_", "\_", $post); To filter out the ' _ '
$post = str_replace ("%", "\%", $post); To filter out '% '
$post = NL2BR ($post); Carriage return Conversion
$post = Htmlspecialchars ($post); HTML markup Conversion

return $post;
}