PHP安全过滤代码(360提供安全系数高)

3. /**

4. * 过滤危险参数
5. * edit: bbs.it-home.org
6. */
7. //Code By Safe3
8. function customError($errno, $errstr, $errfile, $errline)
9. {
10. echo "Error number: [$errno],error on line $errline in $errfile
    ";
11. die();
12. }
13. set_error_handler("customError",E_ERROR);
14. $getfilter="'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
15. $postfilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
16. $cookiefilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
17. function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq){

18. if(is_array($StrFiltValue))

19. {
20. $StrFiltValue=implode($StrFiltValue);
21. }
22. if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){
23. //slog("
    
    操作IP: ".$_SERVER["REMOTE_ADDR"]."
    操作时间: ".strftime("%Y-%m-%d %H:%M:%S")."
    操作页面:".$_SERVER["PHP_SELF"]."
    提交方式: ".$_SERVER["REQUEST_METHOD"]."
    提交参数: ".$StrFiltKey."
    提交数据: ".$StrFiltValue);
24. print "360websec notice:Illegal operation!";
25. exit();
26. }
27. }
28. //$ArrPGC=array_merge($_GET,$_POST,$_COOKIE);
29. foreach($_GET as $key=>$value){
30. StopAttack($key,$value,$getfilter);
31. } //bbs.it-home.org
32. foreach($_POST as $key=>$value){
33. StopAttack($key,$value,$postfilter);
34. }
35. foreach($_COOKIE as $key=>$value){
36. StopAttack($key,$value,$cookiefilter);
37. }
38. if (file_exists('update360.php')) {
39. echo "请重命名文件update360.php，防止黑客利用
    ";
40. die();
41. }
42. function slog($logs)
43. {
44. $toppath=$_SERVER["DOCUMENT_ROOT"]."/log.htm";
45. $Ts=fopen($toppath,"a+");
46. fputs($Ts,$logs."\r\n");
47. fclose($Ts);
48. }
49. ?>

您可能感兴趣的文章：