预防SQL注入代码,PHP代码库,德仔网

代码语言
代码分类
【PHP】预防SQL注入
作者:Dezai.CN / 发布于2011/6/11/ 577
<div><span style="color: rgb(0,0,0); font-weight: bold"><?php</span>
<span style="color: rgb(0,0,0); font-weight: bold">function</span> anti_injection<span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,255)">$user</span>, <span style="color: rgb(0,0,255)">$pass</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">{</span>
<span style="font-style: italic; color: rgb(128,128,128)"># We'll first get rid of any special characters using a simple regex statement.</span>
<span style="font-style: italic; color: rgb(128,128,128)"># After that, we'll get rid of any SQL command words using a string replacment.</span>
<span style="color: rgb(0,0,255)">$banlist</span> = <a href="http://www.php.net/array" target="_blank"><span style="color: rgb(0,0,102)">array</span></a> <span style="color: rgb(102,204,102)">(</span>
<span style="color: rgb(255,0,0)">"insert"</span>, <span style="color: rgb(255,0,0)">"select"</span>, <span style="color: rgb(255,0,0)">"update"</span>, <span style="color: rgb(255,0,0)">"delete"</span>, <span style="color: rgb(255,0,0)">"distinct"</span>, <span style="color: rgb(255,0,0)">"having"</span>, <span style="color: rgb(255,0,0)">"truncate"</span>, <span style="color: rgb(255,0,0)">"replace"</span>,
<span style="color: rgb(255,0,0)">"handler"</span>, <span style="color: rgb(255,0,0)">"like"</span>, <span style="color: rgb(255,0,0)">" as "</span>, <span style="color: rgb(255,0,0)">"or "</span>, <span style="color: rgb(255,0,0)">"procedure"</span>, <span style="color: rgb(255,0,0)">"limit"</span>, <span style="color: rgb(255,0,0)">"order by"</span>, <span style="color: rgb(255,0,0)">"group by"</span>, <span style="color: rgb(255,0,0)">"asc"</span>, <span style="color: rgb(255,0,0)">"desc"</span>
<span style="color: rgb(102,204,102)">)</span>;
<span style="font-style: italic; color: rgb(128,128,128)">// ---------------------------------------------</span>
<span style="color: rgb(177,177,0)">if</span> <span style="color: rgb(102,204,102)">(</span> <a href="http://www.php.net/eregi" target="_blank"><span style="color: rgb(0,0,102)">eregi</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(255,0,0)">"[a-zA-Z0-9]+"</span>, <span style="color: rgb(0,0,255)">$user</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">{</span>
<span style="color: rgb(0,0,255)">$user</span> = <a href="http://www.php.net/trim" target="_blank"><span style="color: rgb(0,0,102)">trim</span></a> <span style="color: rgb(102,204,102)">(</span> <a href="http://www.php.net/str_replace" target="_blank"><span style="color: rgb(0,0,102)">str_replace</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,255)">$banlist</span>, <span style="color: rgb(255,0,0)">''</span>, <a href="http://www.php.net/strtolower" target="_blank"><span style="color: rgb(0,0,102)">strtolower</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,255)">$user</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span>;
<span style="color: rgb(102,204,102)">}</span> <span style="color: rgb(177,177,0)">else</span> <span style="color: rgb(102,204,102)">{</span>
<span style="color: rgb(0,0,255)">$user</span> = <span style="color: rgb(0,0,0); font-weight: bold">NULL</span>;
<span style="color: rgb(102,204,102)">}</span>
<span style="font-style: italic; color: rgb(128,128,128)">// ---------------------------------------------</span>
<span style="font-style: italic; color: rgb(128,128,128)"># Now to make sure the given password is an alphanumerical string</span>
<span style="font-style: italic; color: rgb(128,128,128)"># devoid of any special characters. strtolower() is being used</span>
<span style="font-style: italic; color: rgb(128,128,128)"># because unfortunately, str_ireplace() only works with PHP5.</span>
<span style="color: rgb(177,177,0)">if</span> <span style="color: rgb(102,204,102)">(</span> <a href="http://www.php.net/eregi" target="_blank"><span style="color: rgb(0,0,102)">eregi</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(255,0,0)">"[a-zA-Z0-9]+"</span>, <span style="color: rgb(0,0,255)">$pass</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">{</span>
<span style="color: rgb(0,0,255)">$pass</span> = <a href="http://www.php.net/trim" target="_blank"><span style="color: rgb(0,0,102)">trim</span></a> <span style="color: rgb(102,204,102)">(</span> <a href="http://www.php.net/str_replace" target="_blank"><span style="color: rgb(0,0,102)">str_replace</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,255)">$banlist</span>, <span style="color: rgb(255,0,0)">''</span>, <a href="http://www.php.net/strtolower" target="_blank"><span style="color: rgb(0,0,102)">strtolower</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,255)">$pass</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span>;
<span style="color: rgb(102,204,102)">}</span> <span style="color: rgb(177,177,0)">else</span> <span style="color: rgb(102,204,102)">{</span>
<span style="color: rgb(0,0,255)">$pass</span> = <span style="color: rgb(0,0,0); font-weight: bold">NULL</span>;
<span style="color: rgb(102,204,102)">}</span>
<span style="font-style: italic; color: rgb(128,128,128)">// ---------------------------------------------</span>
<span style="font-style: italic; color: rgb(128,128,128)"># Now to make an array so we can dump these variables into the SQL query.</span>
<span style="font-style: italic; color: rgb(128,128,128)"># If either user or pass is NULL (because of inclusion of illegal characters),</span>
<span style="font-style: italic; color: rgb(128,128,128)"># the whole script will stop dead in its tracks.</span>
<span style="color: rgb(0,0,255)">$array</span> = <a href="http://www.php.net/array" target="_blank"><span style="color: rgb(0,0,102)">array</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(255,0,0)">'user'</span> => <span style="color: rgb(0,0,255)">$user</span>, <span style="color: rgb(255,0,0)">'pass'</span> => <span style="color: rgb(0,0,255)">$pass</span> <span style="color: rgb(102,204,102)">)</span>;
<span style="font-style: italic; color: rgb(128,128,128)">// ---------------------------------------------</span>
<span style="color: rgb(177,177,0)">if</span> <span style="color: rgb(102,204,102)">(</span> <a href="http://www.php.net/in_array" target="_blank"><span style="color: rgb(0,0,102)">in_array</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(0,0,0); font-weight: bold">NULL</span>, <span style="color: rgb(0,0,255)">$array</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">)</span> <span style="color: rgb(102,204,102)">{</span>
<a href="http://www.php.net/die" target="_blank"><span style="color: rgb(0,0,102)">die</span></a> <span style="color: rgb(102,204,102)">(</span> <span style="color: rgb(255,0,0)">'Invalid use of login and/or password. Please use a normal method.'</span> <span style="color: rgb(102,204,102)">)</span>;
<span style="color: rgb(102,204,102)">}</span> <span style="color: rgb(177,177,0)">else</span> <span style="color: rgb(102,204,102)">{</span>
<span style="color: rgb(177,177,0)">return</span> <span style="color: rgb(0,0,255)">$array</span>;
<span style="color: rgb(102,204,102)">}</span>
<span style="color: rgb(102,204,102)">}</span>
<span style="color: rgb(0,0,0); font-weight: bold">?></span>
</div>
试试其它关键字
　防SQL注入　
同语言下
可能有用的
Dezai.CN贡献的其它代码(4037)