这段程序代码是一款php $_POST、$_GET防注入程序,以前我们也写过很多sql防注入程序,下面来看看这款防注入的php代码吧.
- <?php
-
-
-
-
-
-
-
-
-
-
- $ArrFiltrate=array("'","or","and","union","where");
-
- $StrGoUrl="";
-
- function FunStringExist($StrFiltrate,$ArrFiltrate){
- foreach ($ArrFiltrate as $key=>$value){
- if (eregi($value,$StrFiltrate)){
- return true;
- }
- }
- return false;
- }
-
-
-
- if(function_exists(array_merge)){
- $ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);
- }else{
- foreach($HTTP_POST_VARS as $key=>$value){
- $ArrPostAndGet[]=$value;
- }
- foreach($HTTP_GET_VARS as $key=>$value){
- $ArrPostAndGet[]=$value;
- }
- }
-
-
-
- foreach($ArrPostAndGet as $key=>$value){
- if (FunStringExist($value,$ArrFiltrate)){
- echo "<script language='javascript教程'>alert('传递的信息中不得包含{',or,and,union}等非法字符请您把他们换成{‘,OR,AND,UNION}');</script>";
- if (emptyempty($StrGoUrl)){
- echo "<script language='javascript'>history.go(-1);</script>";
- }else{
- echo "<script language='javascript'>window.location='".$StrGoUrl."';</script>";
- }
- exit;
- }
- }
-
- ?>
|