云服务器网:购买云服务器和VPS必上的网站!

怎么防止:怎么防止xss和sql注入攻击

怎样避免xss和sql注入攻击避免xss和sql注入攻击的通用方法:php防sql注入和xss攻击通用过滤以下:function string_remove_xss($html) {preg_match_all(\”/\\/is\”, $html, $ms);$se

怎样避免xss和SQL注入攻击

避免xss和sql注入攻击的通用方法:

php防sql注入和xss攻击通用过滤以下:

function string_remove_xss($html) {

preg_match_all("/\<([^\/is", $html, $ms);

$searchs[] = '<';

$replaces[] = '<';

$searchs[] = '>';

$replaces[] = '>';

if ($ms[1]) {

$allowtags = 'img|a|font|div|table|tbody|caption|tr|td|th|br|p|b|strong|i|u|em|span|ol|ul|li|blockquote';

$ms[1] = array_unique($ms[1]);

foreach ($ms[1] as $value) {

$searchs[] = "";

$value = str_replace('&', '_uch_tmp_str_', $value);

$value = string_htmlspecialchars($value);

$value = str_replace('_uch_tmp_str_', '&', $value);

$value = str_replace(array('\\', '/*'), array('.', '/.'), $value);

$skipkeys = array('onabort','onactivate','onafterprint','onafterupdate','onbeforeactivate','onbeforecopy','onbeforecut','onbeforedeactivate',

'onbeforeeditfocus','onbeforepaste','onbeforeprint','onbeforeunload','onbeforeupdate','onblur','onbounce','oncellchange','onchange',

'onclick','oncontextmenu','oncontrolselect','oncopy','oncut','ondataavailable','ondatasetchanged','ondatasetcomplete','ondblclick',

'ondeactivate','ondrag','ondragend','ondragenter','ondragleave','ondragover','ondragstart','ondrop','onerror','onerrorupdate',

'onfilterchange','onfinish','onfocus','onfocusin','onfocusout','onhelp','onkeydown','onkeypress','onkeyup','onlayoutcomplete',

'onload','onlosecapture','onmousedown','onmouseenter','onmouseleave','onmousemove','onmouseout','onmouseover','onmouseup','onmousewheel',

'onmove','onmoveend','onmovestart','onpaste','onpropertychange','onreadystatechange','onreset','onresize','onresizeend','onresizestart',

'onrowenter','onrowexit','onrowsdelete','onrowsinserted','onscroll','onselect','onselectionchange','onselectstart','onstart','onstop',

'onsubmit','onunload','javascript','script','eval','behaviour','expression','style','class');

$skipstr = implode('|', $skipkeys);

$value = preg_replace(array("/($skipstr)/i"), '.', $value);

if (!preg_match("/^[\/|\s]?($allowtags)(\s+|$)/is", $value)) {

$value = '';

}

$replaces[] = empty($value) ? '' : "";

}

}

$html = str_replace($searchs, $replaces, $html);

return $html;

}

//php防sql注入和xss攻击通用过滤

function string_htmlspecialchars($string, $flags = null) {

if (is_array($string)) {

foreach ($string as $key => $val) {

$string[$key] = string_htmlspecialchars($val, $flags);

}

} else {

if ($flags === null) {

$string = str_replace(array('&', '"', ''), array('&', '"', ''), $string);

if (strpos($string, '&#') !== false) {

$string = preg_replace('/&((#(\d{3,5}|x[a-fA-F0⑼]{4}));)/', '&\\1', $string);

}

} else {

if (PHP_VERSION < '5.4.0') {

$string = htmlspecialchars($string, $flags);

} else {

if (!defined('CHARSET') || (strtolower(CHARSET) == 'utf⑻')) {

$charset = 'UTF⑻';

} else {

$charset = 'ISO⑻859⑴';

}

$string = htmlspecialchars($string, $flags, $charset);

}

}

}

return $string;

}

本文来源:https://www.yuntue.com/post/62849.html | 云服务器网,转载请注明出处!

关于作者: yuntue

云服务器(www.yuntue.com)是一家专门做阿里云服务器代金券、腾讯云服务器优惠券的网站,这里你可以找到阿里云服务器腾讯云服务器等国内主流云服务器优惠价格,以及海外云服务器、vps主机等优惠信息,我们会为你提供性价比最高的云服务器和域名、数据库、CDN、免费邮箱等企业常用互联网资源。

为您推荐

发表回复

您的电子邮箱地址不会被公开。 必填项已用*标注