From the PHP anti-SQL injection code provided in 360 to a class-PHP source code

A class changed from the PHP anti-SQL injection code provided in 360 A class changed from the PHP anti-SQL injection code provided in 360

When a website was searched by Baidu a few days ago, it prompts "security alliance reminds you: This website has security risks. please visit it with caution !", So I began to work hard to find a solution, and finally solved the problem from SQL injection and HTTP cross-site. here I will record it.

 | <| = | In | like) | \\/ \\ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE) "; private $ postfilter =" \ B (and | or) \ B. {1, 6 }? (=|>|<|\\ Bin \ B |\\ blike \ B) |\\/ \\ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE) "; private $ cookiefilter =" \ B (and | or) \ B. {1, 6 }? (=|>|<|\\ Bin \ B |\\ blike \ B) |\\/ \\ *. +? \ * \/| <\ S * script \ B | \ bEXEC \ B | UNION. +? SELECT | UPDATE. +? SET | INSERT \ s + INTO. +? VALUES | (SELECT | DELETE). +? FROM | (CREATE | ALTER | DROP | TRUNCATE) \ s + (TABLE | DATABASE) ";/*** constructor */public function _ construct () {foreach ($ _ GET as $ key = >$ value) {$ this-> stopattack ($ key, $ value, $ this-> getfilter );} foreach ($ _ POST as $ key =>$ value) {$ this-> stopattack ($ key, $ value, $ this-> postfilter );} foreach ($ _ COOKIE as $ key =>$ value) {$ this-> stopattack ($ key, $ value, $ this-> cookiefilter );}} /*** check the parameter and write the log */public function stopattack ($ StrFiltK Ey, $ StrFiltValue, $ ArrFiltReq) {if (is_array ($ StrFiltValue) $ StrFiltValue = implode ($ StrFiltValue); if (preg_match ("/". $ ArrFiltReq. "/is", $ StrFiltValue) = 1) {$ this-> writeslog ($ _ SERVER ["REMOTE_ADDR"]. "". strftime ("% Y-% m-% d % H: % M: % S "). "". $ _ SERVER ["PHP_SELF"]. "". $ _ SERVER ["REQUEST_METHOD"]. "". $ StrFiltKey. "". $ StrFiltValue); showmsg ('The parameter you submitted is invalid. The system has recorded your operation! ', '',) ;}/ *** SQL injection log */public function writeslog ($ log) {$ log_path = CACHE_PATH.'logs'.DIRECTORY_SEPARATOR.' SQL _log.txt '; $ ts = fopen ($ log_path, "a +"); fputs ($ ts, $ log. "\ r \ n"); fclose ($ ts) ;}}?>

The above is the content of a class changed from the PHP anti-SQL injection code provided by 360 to. For more information, see PHP Chinese website (www.php1.cn )!