Regular expression application instance-user input data filtering

Generally, php can accept the data form POST submitted by the user and GET in the address bar in the following ways. no matter which path, we cannot trust the data entered by the user, all are filtered by the program. Common data filtering is given below

Generally, php can accept the data form POST submitted by the user and GET in the address bar in the following ways. no matter which path, we cannot trust the data entered by the user, all are filtered by the program. The following describes common data filtering functions.

Flat view printing?

01	FunctioninitUserInput ()

02

{

03	$ _ Data = array ($ _ GET, $ _ POST, $ _ COOKIE );

04	$ Data = array ();

05	Foreach ($ _ dataAS $ input)

06

{

07	If (is_array ($ input ))

08

{

09	Foreach ($ inputas $ k => $ v)

10

{

11	$ K = filter_key ($ k );

12	// Two-dimensional array filtering is not taken into consideration.

13	If (is_array ($ v ))

14

{

15	Foreach ($ vas $ k1 => $ v1)

16

{

17	$ K1 = filter_key ($ k1 );

18	$ Return [$ k] [$ k1] = filter_value ($ v1 );

19

}

20

}

21

Else

22

{

23	$ Return [$ k] = filter_value ($ v );

24

}

25

}

26

}

27

}

28	// Disable the global variables

29	Unset ($ _ GET, $ _ POST, $ _ COOKIE );

30	Return $ data;

31

}

32	// The key used to filter out super-global variables is actually the parameter name in the address bar and the form name.

33	Functionfilter_key ($ key)

34

{

35	If (is_numeric ($ key ))

36

{

37	Return $ key;

38

}

39	Elseif (empty ($ key ))

40

{

41	Return '';

42

}

43	// Filter '..', which is related to the system's directory structure

44	If (strpos ($ key ,'..')! = False)

45

{

46	$ Key = str_replace ('..', '', $ key );

47

}

48	// This is related to the magic constant and the magic method.

49	If (strpos ($ key ,'__')! = False)

50

{

51	$ Key = preg_replace ('/__(? :. + ?) _/', '', $ Key );

52

}

53	// Only numbers, letters, and underscores are allowed.-only numbers and letters must start with an underscore.

54	Returnpreg_replace ('/^ ([\ w \. \-_] +) $/', '\ 1', $ key );

55

}

56	Functionfilter_value ($ val)

57

{

58	// When an html field exists in the form, it indicates that the pure html code is required and does not need to be filtered.

59	If ($ _ REQUEST ['HTML '])

60

{

61	Return $ val;

62

}

63	If (is_numeric ($ val ))

64

{

65	Return $ val;

66

}

67	Elseif (empty ($ val ))

68

{

69	Returnis_array ($ val )? Array ():'';

70

}

71	// Filter javascript code

72	$ Val = preg_replace ("/