php防SQL注入代码(360提供)

2. /**
3. * php防止sql注入
4. * by bbs.it-home.org
5. */
6. class sqlsafe {
7. private $getfilter = "'|(and|or)\\b.+?(>| private $postfilter = "\\b(and|or)\\b.{1,6}?(=|>| private $cookiefilter = "\\b(and|or)\\b.{1,6}?(=|>| /**
8. * 构造函数
9. */
10. public function __construct() {
11. foreach($_GET as $key=>$value){$this->stopattack($key,$value,$this->getfilter);}
12. foreach($_POST as $key=>$value){$this->stopattack($key,$value,$this->postfilter);}
13. foreach($_COOKIE as $key=>$value){$this->stopattack($key,$value,$this->cookiefilter);}
14. }
15. /**
16. * 参数检查并写日志
17. */
18. public function stopattack($StrFiltKey, $StrFiltValue, $ArrFiltReq){
19. if(is_array($StrFiltValue))$StrFiltValue = implode($StrFiltValue);
20. if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue) == 1){
21. $this->writeslog($_SERVER["REMOTE_ADDR"]." ".strftime("%Y-%m-%d %H:%M:%S")." ".$_SERVER["PHP_SELF"]." ".$_SERVER["REQUEST_METHOD"]." ".$StrFiltKey." ".$StrFiltValue);
22. showmsg('您提交的参数非法,系统已记录您的本次操作！','',0,1);
23. }
24. }
25. /**
26. * SQL注入日志
27. */
28. public function writeslog($log){
29. $log_path = CACHE_PATH.'logs'.DIRECTORY_SEPARATOR.'sql_log.txt';
30. $ts = fopen($log_path,"a+");
31. fputs($ts,$log."\r\n");
32. fclose($ts);
33. }
34. }
35. ?>

复制代码