Php filters out special characters of SQL anti-injection code

Php filters out special characters of SQL anti-injection code

// Method 1 // Filter ', ", SQL language name Addslashes (); // Method 2: Remove all html tags Strip_tags (); // Method 3: filter the code that may be generated Function php_sava ($ str) { $ Farr = array ( "/S + /", "/<(/?) (Script | I? Frame | style | html | body | title | link | meta |? | %) ([^>] *?)> /IsU ", "/(<[^>] *) On [a-zA-Z] + s * = ([^>] *>)/isU ", ); $ Tarr = array ( "", "<>", // If you want to clear insecure labels directly, leave it blank. "", ); $ Str = preg_replace ($ farr, $ tarr, $ str ); Return $ str; } // Php SQL anti-injection code Class sqlin { // Dowith_ SQL ($ value) Function dowith_ SQL ($ str) { $ Str = str_replace ("and", "", $ str ); $ Str = str_replace ("execute", "", $ str ); $ Str = str_replace ("update", "", $ str ); $ Str = str_replace ("count", "", $ str ); $ Str = str_replace ("chr", "", $ str ); $ Str = str_replace ("mid", "", $ str ); $ Str = str_replace ("master", "", $ str ); $ Str = str_replace ("truncate", "", $ str ); $ Str = str_replace ("char", "", $ str ); $ Str = str_replace ("declare", "", $ str ); $ Str = str_replace ("select", "", $ str ); $ Str = str_replace ("create", "", $ str ); $ Str = str_replace ("delete", "", $ str ); $ Str = str_replace ("insert", "", $ str ); $ Str = str_replace ("'", "", $ str ); $ Str = str_replace ("", "", $ str ); $ Str = str_replace ("", "", $ str ); $ Str = str_replace ("or", "", $ str ); $ Str = str_replace ("=", "", $ str ); $ Str = str_replace ("% 20", "", $ str ); // Echo $ str; Return $ str; } // Aticle () anti-SQL injection function // php Tutorial Function sqlin () { Foreach ($ _ GET as $ key => $ value) { $ _ GET [$ key] = $ this-> dowith_ SQL ($ value ); } Foreach ($ _ POST as $ key => $ value) { $ _ POST [$ key] = $ this-> dowith_ SQL ($ value ); } } } $ Dbsql = new sqlin (); ?> Usage: copy the above code to create a new sqlin. php file, and then include the page for receiving GET or POST data. Principle analysis: Replace all SQL keywords with NULL. this code cannot be used in the message book. to use it in the message book, replace ....... $ str = str_replace ("and", "", $ str); to $ str = str_replace ("% 20", "", $ str );... the code is: $ Str = str_replace ("and", "and", $ str ); $ Str = str_replace ("execute", "execute", $ str ); $ Str = str_replace ("update", "update", $ str ); $ Str = str_replace ("count", "count", $ str ); $ Str = str_replace ("chr", "chr", $ str ); $ Str = str_replace ("mid", "mid", $ str ); $ Str = str_replace ("master", "master", $ str ); $ Str = str_replace ("truncate", "truncate", $ str ); $ Str = str_replace ("char", "char", $ str ); $ Str = str_replace ("declare", "declare", $ str ); $ Str = str_replace ("select", "select", $ str ); $ Str = str_replace ("create", "create", $ str ); $ Str = str_replace ("delete", "delete", $ str ); $ Str = str_replace ("insert", "insert", $ str ); $ Str = str_replace ("'", "'", $ str ); $ Str = str_replace ("", ", $ str ); ?> ------------------------------------------------------- Addslashes -- use a backslash to reference a string String addslashes (string str) Returns a string that requires a backslash before certain characters for database query statements. These characters are single quotation marks ('), double quotation marks ("), backslash (\), and NUL (NULL ). An example of using addslashes () is when you want to input data into the database. For example, insert the name 'Reilly into the database, which requires escaping. Most databases use \ as the escape character: O \ 'Reilly. In this way, the data can be put into the database without inserting additional \. When the PHP command magic_quotes_sybase is set to on, it means that when 'is inserted,' is used for escape. By default, the PHP command magic_quotes_gpc is on, which automatically runs addslashes () on all GET, POST, and COOKIE data (). Do not use addslashes () for strings that have been escaped by magic_quotes_gpc, because this causes double-layer escape. In this case, you can use the get_magic_quotes_gpc () function for detection. Get_magic_quotes_gpc () this function obtains the magic_quotes_gpc (GPC, Get/Post/Cookie) value of the variable configured in the PHP environment. If 0 is returned, this function is disabled. if 1 is returned, this function is enabled. When magic_quotes_gpc is enabled, all '(single quotation marks),' (double quotation marks), \ (backslash) and null characters are automatically converted to overflow characters containing the backslash. When addslashes and stripslashes are used to operate database characters in php. at first glance, it seems hard to remember, but as long as you analyze it, add is added, strip is ignored. slash is the diagonal line, and slash is the plural number of the diagonal line. then, addslashes is used to add diagonal lines, because some special characters may cause problems after being written to the database, such as "', so we need to add \ to escape special characters, tell the database that the special symbols are strings. Similarly, when stripslashes extracts strings from the database, it will subtract the diagonal line. htmlspecialchars converts some special characters into html encoding, which may be the message board used to process customers' messages. These special characters are limited to the following: &-> & "->" <-> <>-> htmlentities are similar to htmlspecialchars, however, htmlentities are reserved for all the entity defined in HTML, including various special characters and Chinese characters. as a result, the Chinese characters are changed to a bunch of garbled characters. Htmlspecialchars_decode is the reverse process of htmlspecialchars, which converts html encoding into characters. Php filter special character utility functions php form submission special character filtering methods html special character filtering special character escaping methods in php url links php special character escaping explanation php filter parameters special characters anti-injection php filter an example of php special character processing function for illegal methods with special strings