360提供的php防注入代码

1. //Code By Safe3
2. function customError($errno, $errstr, $errfile, $errline)
3. {
4. echo "Error number: [$errno],error on line $errline in $errfile
   " ;
5. die();
6. }
7. set_error_handler("customError",E_ERROR);
8. $getfilter="'|(and|or)\\b.+?(>|$postfilter="\\b(and|or)\\b.{1,6}?(=|>|$cookiefilter="\\b(and|or)\\b.{1,6}?(=|>|function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq){
10. if(is_array($StrFiltValue))
11. {
12. $StrFiltValue=implode($StrFiltValue);
13. }
14. if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){
15. //slog("
    
    操作IP: ".$_SERVER["REMOTE_ADDR"]."
    操作时间: ".strftime("%Y-%m-%d %H:%M:%S")."
    操作页面:".$_SERVER["PHP_SELF"]."
    提交方式: ".$_SERVER["REQUEST_METHOD"]."
    提交参数: ".$StrFiltKey."
    提交数据: ".$StrFiltValue);
16. print "360websec notice:Illegal operation!" ;
17. exit();
18. }
19. }
20. //$ArrPGC=array_merge($_GET,$_POST,$_COOKIE);
21. foreach($_GET as $key=>$value){
22. StopAttack($key,$value,$getfilter);
23. }
24. foreach($_POST as $key=>$value){
25. StopAttack($key,$value,$postfilter);
26. }
27. foreach($_COOKIE as $key=>$value){
28. StopAttack($key,$value,$cookiefilter);
29. }
30. /*
31. if (file_exists('update360.php')) {
32. echo "请重命名文件update360.php，防止黑客利用
    ";
33. die();
34. }
35. */
36. function slog($logs)
37. {
38. $toppath=$_SERVER["DOCUMENT_ROOT"]."/log.htm";
39. $Ts=fopen($toppath,"a+");
40. fputs($Ts,$logs."\r\n");
41. fclose($Ts);
42. }

复制代码

php