php過濾特殊危險字元的總結

一般，對於傳進來的字元，php可以用addslashes函數處理一遍（要get_magic_quotes_gpc()為假才處理，不然就重複轉義了！），這樣就能達到一定程度的安全要求
比如這樣

代碼如下

複製代碼

if (!get_magic_quotes_gpc()) {          add_slashes($_GET);          add_slashes($_POST);          add_slashes($_COOKIE);     }          function add_slashes($string) {          if (is_array($string)) {              foreach ($string as $key => $value) {                  $string[$key] = add_slashes($value);              }          } else {              $string = addslashes($string);          }          return $string;     }

但是還可以更進一步進行重新編碼，解碼，如下：

代碼如下

複製代碼

//編碼 function htmlencode($str) {            if(empty($str)) return;       if($str=="") return $str;             $str=trim($str);       $str=str_replace("&","&",$str);       $str=str_replace(">",">",$str);       $str=str_replace("<","<",$str);       $str=str_replace(chr(32)," ",$str);       $str=str_replace(chr(9)," ",$str);       $str=str_replace(chr(34),"&",$str);       $str=str_replace(chr(39),"'",$str);       $str=str_replace(chr(13),"<br />",$str);       $str=str_replace("'","''",$str);       $str=str_replace("select","select",$str);       $str=str_replace("join","join",$str);       $str=str_replace("union","union",$str);       $str=str_replace("where","where",$str);       $str=str_replace("insert","insert",$str);       $str=str_replace("delete","delete",$str);       $str=str_replace("update","update",$str);       $str=str_replace("like","like",$str);       $str=str_replace("drop","drop",$str);       $str=str_replace("create","create",$str);       $str=str_replace("modify","modify",$str);       $str=str_replace("rename","rename",$str);       $str=str_replace("alter","alter",$str);       $str=str_replace("cast","cas",$str);             return $str;  }

這樣就能更放心的對外來資料進行入庫處理了， 但是從資料庫取出來，在前台顯示的時候，必須重新解碼一下：

代碼如下

複製代碼

//解碼 function htmldecode($str) {            if(empty($str)) return;       if($str=="")  return $str;       $str=str_replace("select","select",$str);       $str=str_replace("join","join",$str);       $str=str_replace("union","union",$str);       $str=str_replace("where","where",$str);       $str=str_replace("insert","insert",$str);       $str=str_replace("delete","delete",$str);       $str=str_replace("update","update",$str);       $str=str_replace("like","like",$str);       $str=str_replace("drop","drop",$str);       $str=str_replace("create","create",$str);       $str=str_replace("modify","modify",$str);       $str=str_replace("rename","rename",$str);       $str=str_replace("alter","alter",$str);       $str=str_replace("cas","cast",$str);       $str=str_replace("&","&",$str);       $str=str_replace(">",">",$str);       $str=str_replace("<","<",$str);       $str=str_replace(" ",chr(32),$str);       $str=str_replace(" ",chr(9),$str);       $str=str_replace("&",chr(34),$str);       $str=str_replace("'",chr(39),$str);       $str=str_replace("<br />",chr(13),$str);       $str=str_replace("''","'",$str);             return $str; }

雖然多了一步編碼，解碼的過程，但是安全方面，會更進一步，要如何做，自己取捨吧。

再附一些

代碼如下

複製代碼

function safe_replace($string) {  $string = str_replace(' ','',$string);  $string = str_replace(''','',$string);  $string = str_replace(''','',$string);  $string = str_replace('*','',$string);  $string = str_replace('"','"',$string);  $string = str_replace("'",'',$string);  $string = str_replace('"','',$string);  $string = str_replace(';','',$string);  $string = str_replace('<','<',$string);  $string = str_replace('>','>',$string);  $string = str_replace("{",'',$string);  $string = str_replace('}','',$string);  return $string; }

更全面的

代碼如下

複製代碼

//處理提交的資料 function htmldecode($str) {  if (empty ( $str ) || "" == $str) {  return "";  }    $str = strip_tags ( $str );  $str = htmlspecialchars ( $str );  $str = nl2br ( $str );  $str = str_replace ( "?", "", $str );  $str = str_replace ( "*", "", $str );  $str = str_replace ( "!", "", $str );  $str = str_replace ( "~", "", $str );  $str = str_replace ( "$", "", $str );  $str = str_replace ( "%", "", $str );  $str = str_replace ( "^", "", $str );  $str = str_replace ( "^", "", $str );  $str = str_replace ( "select", "", $str );  $str = str_replace ( "join", "", $str );  $str = str_replace ( "union", "", $str );  $str = str_replace ( "where", "", $str );  $str = str_replace ( "insert", "", $str );  $str = str_replace ( "delete", "", $str );  $str = str_replace ( "update", "", $str );  $str = str_replace ( "like", "", $str );  $str = str_replace ( "drop", "", $str );  $str = str_replace ( "create", "", $str );  $str = str_replace ( "modify", "", $str );  $str = str_replace ( "rename", "", $str );  $str = str_replace ( "alter", "", $str );  $str = str_replace ( "cast", "", $str );    $farr = array ("//s+/", //過濾多餘的空白 "/<(//?)(img|script|i?frame|style|html|body|title|link|meta|/?|/%)([^>]*?)>/isU", //過濾 <script 防止引入惡意內容或惡意代碼,如果不需要插入flash等,還可以加入<object的過濾 "/(<[^>]*)on[a-zA-Z]+/s*=([^>]*>)/isU" )//過濾javascript的on事件 ;  $tarr = array (" ", "", //如果要直接清除不安全的標籤，這裡可以留空 "" );  return $str; }