Php anti-injection Function Code

Dedicated waiting

When using php programs, we all pay more attention to website security. So how does php defend against injection?

The addslaches () function that comes with php itself is a little weak and cannot be too reassuring.

Now I want to share with you a simple method:

Create a new file and save it as checkpostandget. php
Add include ("checkpostandget. php") before each php file.
<? Php
/*************************
Note:
Determines whether the passed variable contains invalid characters.
Such as $ _ POST and $ _ GET
Function:
Anti-Injection
**************************/
// Invalid characters to be filtered
$ ArrFiltrate = array ("", ";", "union ");
// The url to be redirected after an error occurs. If this parameter is left blank, the previous page is displayed by default.
$ StrGoUrl = "";
// Whether the value in the array exists
Function FunStringExist ($ StrFiltrate, $ ArrFiltrate ){
Foreach ($ ArrFiltrate as $ key => $ value ){
If (eregi ($ value, $ StrFiltrate )){
Return true;
}
}
Return false;
}
// Merge $ _ POST and $ _ GET
If (function_exists (array_merge )){
$ ArrPostAndGet = array_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS );
} Else {
Foreach ($ HTTP_POST_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}
Foreach ($ HTTP_GET_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}
}
// Verification starts
Foreach ($ ArrPostAndGet as $ key => $ value ){
If (FunStringExist ($ value, $ ArrFiltrate )){
Echo "<script language =" javascript "> alert (" invalid character "); </script> ";
If (empty ($ StrGoUrl )){
Echo "<script language =" javascript "> history. go (-1); </script> ";
} Else {
Echo "<script language =" javascript "> window. location =" ". $ StrGoUrl." "; </script> ";
}
Exit;
}
}
?>

After searching through the network, the author changed the code. The following is the rewritten content!

If (function_exists (array_merge )){
$ ArrPostAndGet = array_merge ($ HTTP_POST_VARS, $ HTTP_GET_VARS );
} Else {
Foreach ($ HTTP_POST_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}
Foreach ($ HTTP_GET_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}
}
Change
Foreach ($ HTTP_POST_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}
Foreach ($ HTTP_GET_VARS as $ key => $ value ){
$ ArrPostAndGet [] = $ value;
}