PHP SQL anti-injection

There are not too many filters, mainly for PHP and MySQL combination.
General anti-injection, as long as the use of PHP addslashes function is possible.

Here's a copy of the code:

PHP Code

1. $_post = Sql_injection ($_post);
2. $_get = Sql_injection ($_get);
4. function Sql_injection ($content)
5. {
6. if (!GET_MAGIC_QUOTES_GPC ()) {
7. if (Is_array ($content)) {
8. foreach ($content as $key = = $value) {
9. $content [$key] = addslashes ($value);
10. }
11. } else {
12. Addslashes ($content);
13. }
14. }
15. return $content;
16. }

To do the system, you can use the following code, but also copy.

PHP Code

4. function Inject_check ($sql _str) {
6. Return eregi (' select|insert|update|delete|\ ' |\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile ', $sql _str); To filter
8. }
14. function verify_id ($id =null) {
16. if (! $id) {exit (' No arguments are submitted! ‘); }//Is null-judged
18. ElseIf (Inject_check ($id)) {exit (' argument submitted is illegal! ‘); }//Injection judgment
20. ElseIf (!is_numeric ($id)) {exit (' argument submitted is illegal! ‘); }//Digital judgment
22. $id = Intval ($id); The whole type of
26. return $id;
28. }
34. function Str_check ($STR) {
36. if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open
38. $str = Addslashes ($STR); To filter
40. }
42. $str = Str_replace ("_", "\_", $str); Filter out the ' _ '
44. $str = str_replace ("%", "\%", $str); Filter out the '% '
48. return $str;
50. }
56. function Post_check ($post) {
58. if (!GET_MAGIC_QUOTES_GPC ()) {//Determine if MAGIC_QUOTES_GPC is open
60. $post = Addslashes ($post); To filter the submission data without opening the MAGIC_QUOTES_GPC
62. }
64. $post = Str_replace ("_", "\_", $post); Filter out the ' _ '
66. $post = str_replace ("%", "\%", $post); Filter out the '% '
68. $post = NL2BR ($post); Carriage return Conversion
70. $post = Htmlspecialchars ($post); HTML markup Conversions
74. return $post;
76. }

PHP SQL anti-injection