在网站中表单提交或url获取值我们都可能碰到一些安全问题,下面我总结了一些常用的过滤一些危险特殊字符的解决方法,一般,对于传进来的字符,php可以用addslashes函数处理一遍(要get_magic_quotes_gpc()为假才处理,不然就重复转义了!),这样就能达到一定程度的安全要求,比如这样,代码如下:
- if (!get_magic_quotes_gpc()) {
- add_slashes($_GET);
- add_slashes($_POST);
- add_slashes($_COOKIE);
- }
- function add_slashes($string) {
- if (is_array($string)) {
- foreach ($string as $key => $value) {
- $string[$key] = add_slashes($value);
- }
- } else {
- $string = addslashes($string);
- }
- return $string;
- }
但是还可以更进一步进行重新编码,解码,代码如下:
//编码
- function htmlencode($str) {
- if(emptyempty($str)) return;
- if($str=="") return $str;
- $str=trim($str);
- $str=str_replace("&","&",$str);
- $str=str_replace(">",">",$str);
- $str=str_replace("<","&lt;",$str);
- $str=str_replace(chr(32),"&nbsp;",$str);
- $str=str_replace(chr(9),"&nbsp;",$str);
- $str=str_replace(chr(34),"&",$str);
- $str=str_replace(chr(39),"&#39;",$str);
- $str=str_replace(chr(13),"<br />",$str);
- $str=str_replace("'","''",$str);
- $str=str_replace("select","sel&#101;ct",$str);
- $str=str_replace("join","jo&#105;n",$str);
- $str=str_replace("union","un&#105;on",$str);
- $str=str_replace("where","wh&#101;re",$str);
- $str=str_replace("insert","ins&#101;rt",$str);
- $str=str_replace("delete","del&#101;te",$str);
- $str=str_replace("update","up&#100;ate",$str);
- $str=str_replace("like","lik&#101;",$str);
- $str=str_replace("drop","dro&#112;",$str);
- $str=str_replace("create","cr&#101;ate",$str);
- $str=str_replace("modify","mod&#105;fy",$str);
- $str=str_replace("rename","ren&#097;me",$str);
- $str=str_replace("alter","alt&#101;r",$str);
- $str=str_replace("cast","ca&#115;",$str);
- return $str;
- }
这样就能更放心的对外来数据进行入库处理了,但是从数据库取出来,在前台显示的时候,必须重新解码一下,代码如下:
- //解码
- function htmldecode($str) {
- if(emptyempty($str)) return;
- if($str=="") return $str;
- $str=str_replace("sel&#101;ct","select",$str);
- $str=str_replace("jo&#105;n","join",$str);
- $str=str_replace("un&#105;on","union",$str);
- $str=str_replace("wh&#101;re","where",$str);
- $str=str_replace("ins&#101;rt","insert",$str);
- $str=str_replace("del&#101;te","delete",$str);
- $str=str_replace("up&#100;ate","update",$str);
- $str=str_replace("lik&#101;","like",$str);
- $str=str_replace("dro&#112;","drop",$str);
- $str=str_replace("cr&#101;ate","create",$str);
- $str=str_replace("mod&#105;fy","modify",$str);
- $str=str_replace("ren&#097;me","rename",$str);
- $str=str_replace("alt&#101;r","alter",$str);
- $str=str_replace("ca&#115;","cast",$str);
- $str=str_replace("&amp;","&",$str);
- $str=str_replace("&gt;",">",$str);
- $str=str_replace("&lt;","<",$str);
- $str=str_replace("&nbsp;",chr(32),$str);
- $str=str_replace("&nbsp;",chr(9),$str);
- $str=str_replace("&",chr(34),$str);
- $str=str_replace("&#39;",chr(39),$str);
- $str=str_replace("<br />",chr(13),$str);
- $str=str_replace("''","'",$str); //开源代码phpfensi.com
- return $str;
- }
虽然多了一步编码,解码的过程,但是安全方面,会更进一步,要如何做,自己取舍吧.
再附一些代码如下:
转载请注明来源:php过滤特殊危险字符的总结
- function safe_replace($string) {
- $string = str_replace(' ','',$string);
- $string = str_replace(''','',$string);
- $string = str_replace(''','',$string);
- $string = str_replace('*','',$string);
- $string = str_replace('"','"',$string);
- $string = str_replace("'",'',$string);
- $string = str_replace('"','',$string);
- $string = str_replace(';','',$string);
- $string = str_replace('<','<',$string);
- $string = str_replace('>','>',$string);
- $string = str_replace("{",'',$string);
- $string = str_replace('}','',$string);
- return $string;
- }
- //更全面的代码如下:
- //处理提交的数据
- function htmldecode($str) {
- if (emptyempty ( $str ) || "" == $str) {
- return "";
- }
- $str = strip_tags ( $str );
- $str = htmlspecialchars ( $str );
- $str = nl2br ( $str );
- $str = str_replace ( "?", "", $str );
- $str = str_replace ( "*", "", $str );
- $str = str_replace ( "!", "", $str );
- $str = str_replace ( "~", "", $str );
- $str = str_replace ( "$", "", $str );
- $str = str_replace ( "%", "", $str );
- $str = str_replace ( "^", "", $str );
- $str = str_replace ( "^", "", $str );
- $str = str_replace ( "select", "", $str );
- $str = str_replace ( "join", "", $str );
- $str = str_replace ( "union", "", $str );
- $str = str_replace ( "where", "", $str );
- $str = str_replace ( "insert", "", $str );
- $str = str_replace ( "delete", "", $str );
- $str = str_replace ( "update", "", $str );
- $str = str_replace ( "like", "", $str );
- $str = str_replace ( "drop", "", $str );
- $str = str_replace ( "create", "", $str );
- $str = str_replace ( "modify", "", $str );
- $str = str_replace ( "rename", "", $str );
- $str = str_replace ( "alter", "", $str );
- $str = str_replace ( "cast", "", $str );
- $farr = array ("//s+/", //过滤多余的空白
- "/<(//?)(img|script|i?frame|style|html|body|title|link|meta|/?|/%)([^>]*?)>/isU", //过滤 <script 防止引入恶意内容或恶意代码,如果不需要插入flash等,还可以加入<object的过滤
- "/(<[^>]*)on[a-zA-Z]+/s*=([^>]*>)/isU" )//过滤javascript的on事件
- ;
- $tarr = array (" ", "", //如果要直接清除不安全的标签,这里可以留空
- "" );
- return $str;
- }
哈尔滨品用软件有限公司致力于为哈尔滨的中小企业制作大气、美观的优秀网站,并且能够搭建符合百度排名规范的网站基底,使您的网站无需额外费用,即可稳步提升排名至首页。欢迎体验最佳的哈尔滨网站建设。