sql universal anti-injection system

sql generic anti-injection system This article provides anti-sql injection code is a php tutorial sql double filter illegal characters function, he can be based on user-defensive SQL injection Oh, first filter some sql command, then the post get filtered once, the best validation.
* /
// anti-injection

$ arrfiltrate = array (update, delete, selert, drop, exec, cast, union, union);
// jump after the error url, do not fill the default previous page
$ strgourl = "";
// Whether there is an array value
function funstringexist ($ strfiltrate, $ arrfiltrate) {
foreach ($ arrfiltrate as $ key => $ value) {
if (eregi ($ value, $ strfiltrate)) {
return true;
}
}
return false;
}
// Combine $ _post and $ _get
if (function_exists (array_merge)) {
$ arrpostandget = array_merge ($ http_post_vars, $ http_get_vars);
} else {
foreach ($ http_post_vars as $ key => $ value) {
$ arrpostandget [] = $ value;
}
foreach ($ http_get_vars as $ key => $ value) {
$ arrpostandget [] = $ value;
}
}
// validation begins
foreach ($ arrpostandget as $ key => $ value) {
if (funstringexist ($ value, $ arrfiltrate)) {
echo "";
if (empty ($ strgourl)) {
echo "";
} else {
echo "";
}
echo "<script> alert ('system detected an illegal character!'); history.back (); </ script>";
exit ();
}
}
?>