php过滤特殊危险字符的总结

if (!get_magic_quotes_gpc()) {

add_slashes($_GET);

add_slashes($_POST);

add_slashes($_COOKIE);

}

function add_slashes($string) {

if (is_array($string)) {

foreach ($string as $key => $value) {

$string[$key] = add_slashes($value);

}

} else {

$string = addslashes($string);

}

return $string;

}

但是还可以更进一步进行重新编码,解码,代码如下:

//编码

function htmlencode($str) {

if(emptyempty($str)) return;

if($str=="") return $str;

$str=trim($str);

$str=str_replace("&","&",$str);

$str=str_replace(">",">",$str);

$str=str_replace("<","<",$str);

$str=str_replace(chr(32)," ",$str);

$str=str_replace(chr(9)," ",$str);

$str=str_replace(chr(34),"&",$str);

$str=str_replace(chr(39),"'",$str);

$str=str_replace(chr(13),"<br />",$str);

$str=str_replace("'","''",$str);

$str=str_replace("select","select",$str);

$str=str_replace("join","join",$str);

$str=str_replace("union","union",$str);

$str=str_replace("where","where",$str);

$str=str_replace("insert","insert",$str);

$str=str_replace("delete","delete",$str);

$str=str_replace("update","update",$str);

$str=str_replace("like","like",$str);

$str=str_replace("drop","drop",$str);

$str=str_replace("create","create",$str);

$str=str_replace("modify","modify",$str);

$str=str_replace("rename","rename",$str);

$str=str_replace("alter","alter",$str);

$str=str_replace("cast","cas",$str);

return $str;

}

这样就能更放心的对外来数据进行入库处理了,但是从数据库取出来,在前台显示的时候,必须重新解码一下,代码如下:

//解码

function htmldecode($str) {

if(emptyempty($str)) return;

if($str=="") return $str;

$str=str_replace("select","select",$str);

$str=str_replace("join","join",$str);

$str=str_replace("union","union",$str);

$str=str_replace("where","where",$str);

$str=str_replace("insert","insert",$str);

$str=str_replace("delete","delete",$str);

$str=str_replace("update","update",$str);

$str=str_replace("like","like",$str);

$str=str_replace("drop","drop",$str);

$str=str_replace("create","create",$str);

$str=str_replace("modify","modify",$str);

$str=str_replace("rename","rename",$str);

$str=str_replace("alter","alter",$str);

$str=str_replace("cas","cast",$str);

$str=str_replace("&","&",$str);

$str=str_replace(">",">",$str);

$str=str_replace("<","<",$str);

$str=str_replace(" ",chr(32),$str);

$str=str_replace(" ",chr(9),$str);

$str=str_replace("&",chr(34),$str);

$str=str_replace("'",chr(39),$str);

$str=str_replace("<br />",chr(13),$str);

$str=str_replace("''","'",$str); //开源代码phpfensi.com

return $str;

}

虽然多了一步编码,解码的过程,但是安全方面,会更进一步,要如何做,自己取舍吧.

再附一些代码如下:

function safe_replace($string) {

$string = str_replace(' ','',$string);

$string = str_replace(''','',$string);

$string = str_replace(''','',$string);

$string = str_replace('*','',$string);

$string = str_replace('"','"',$string);

$string = str_replace("'",'',$string);

$string = str_replace('"','',$string);

$string = str_replace(';','',$string);

$string = str_replace('<','<',$string);

$string = str_replace('>','>',$string);

$string = str_replace("{",'',$string);

$string = str_replace('}','',$string);

return $string;

}

//更全面的代码如下:

 
//处理提交的数据  
function htmldecode($str) {  
 if (emptyempty ( $str ) || "" == $str) {  
 return "";  
 }  
   
 $str = strip_tags ( $str );  
 $str = htmlspecialchars ( $str );  
 $str = nl2br ( $str );  
 $str = str_replace ( "?", "", $str );  
 $str = str_replace ( "*", "", $str );  
 $str = str_replace ( "!", "", $str );  
 $str = str_replace ( "~", "", $str );  
 $str = str_replace ( "$", "", $str );  
 $str = str_replace ( "%", "", $str );  
 $str = str_replace ( "^", "", $str );  
 $str = str_replace ( "^", "", $str );  
 $str = str_replace ( "select", "", $str );  
 $str = str_replace ( "join", "", $str );  
 $str = str_replace ( "union", "", $str );  
 $str = str_replace ( "where", "", $str );  
 $str = str_replace ( "insert", "", $str );  
 $str = str_replace ( "delete", "", $str );  
 $str = str_replace ( "update", "", $str );  
 $str = str_replace ( "like", "", $str );  
 $str = str_replace ( "drop", "", $str );  
 $str = str_replace ( "create", "", $str );  
 $str = str_replace ( "modify", "", $str );  
 $str = str_replace ( "rename", "", $str );  
 $str = str_replace ( "alter", "", $str );  
 $str = str_replace ( "cast", "", $str );  
   
 $farr = array ("//s+/", //过滤多余的空白  
"/<(//?)(img|script|i?frame|style|html|body|title|link|meta|/?|/%)([^>]*?)>/isU", //过滤 <script 防止引入恶意内容或恶意代码,如果不需要插入flash等,还可以加入<object的过滤  
"/(<[^>]*)on[a-zA-Z]+/s*=([^>]*>)/isU" )//过滤javascript的on事件  
;  
 $tarr = array (" ", "", //如果要直接清除不安全的标签，这里可以留空  
"" );  
 return $str;  
}