PHP 防止SQL注入漏洞
开发项目时,不止要考虑项目快速上线,考虑到项目的质量,同时重中之重要考虑到项目的安全性,防止数据泄露,防止数据库被删除,防止数据被篡改等严重的漏洞问题,今天分享一个简单的SQL注入防御,通过在项目入口文件直接引用该类,能防御大部分的表单提交注入的sql语句。涉及到一些特殊的SQL指令,需要自行添加。
代码
<?php
//+----------------------------------------------------------
//+- 防止sql注入攻击
//+----------------------------------------------------------
class XssFilter{
public static function getIntance(){
$post = file_get_contents('php://input');
if(!empty($post)){
$_POST = array_merge($_POST, json_decode($post, JSON_UNESCAPED_UNICODE));
}
XssFilter::inspection($_GET);
XssFilter::inspection($_POST);
}
/**
* 字段白名单,提交的表单字段白名单
* @return array
*/
private static function blacklist(){
return array(
"content"
);
}
//避免SQL漏洞
private static function inspection(&$requests){
if(!empty($requests)){
foreach ($requests as $kk=>&$vv){
if(is_array($vv)){
XssFilter::inspection($vv);
}else{
$kk = htmlspecialchars($kk, ENT_QUOTES); //过滤键值
if(!in_array($kk, XssFilter::blacklist())){
if(!XssFilter::is_json($vv)){
//判断不是json数据进行处理
$str = XssFilter::filterWords($vv);
$str = XssFilter::clearSQLFilter($str);
$str = filter_var($str, FILTER_SANITIZE_STRING); //字符串过滤
$vv = htmlspecialchars($str, ENT_QUOTES);
}
}
}
}
}
}
//判断是否是json字符串
private static function is_json($string) {
json_decode($string);
return (json_last_error() == JSON_ERROR_NONE);
}
//sql过滤
private static function clearSQLFilter($str){
$str = str_ireplace("and", "",$str);
$str = str_ireplace("execute", "",$str);
$str = str_ireplace("update", "",$str);
$str = str_ireplace("count", "",$str);
$str = str_ireplace("chr", "",$str);
$str = str_ireplace("mid", "",$str);
$str = str_ireplace("master", "",$str);
$str = str_ireplace("truncate", "",$str);
$str = str_ireplace("char", "",$str);
$str = str_ireplace("declare", "",$str);
$str = str_ireplace("select", "",$str);
$str = str_ireplace("create", "",$str);
$str = str_ireplace("delete", "",$str);
$str = str_ireplace("insert", "",$str);
$str = str_ireplace("'", "",$str);
$str = str_ireplace('"', "",$str);
$str = str_ireplace(" ", "",$str);
$str = str_ireplace("or", "",$str);
$str = str_ireplace("=", "",$str);
$str = str_ireplace("%20", "",$str);
$str = str_ireplace("where", "",$str);
$str = str_ireplace("having", "",$str);
$str = str_ireplace("union", "",$str);
$str = str_ireplace("all", "",$str);
return $str;
}
/**
* 正则过滤
* @param unknown $str
*/
private static function filterWords($str) {
$farr = array(
"/<(\\/?)(script|i?frame|style|html|body|title|link|meta|object|\\?|\\%)([^>]*?)>/isU",
"/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",
"/select|eval|dosomething|addslashes|return_var|command|shell_exec|system|insert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dump/is",
"/^(EXP|NEQ|GT|EGT|LT|ELT|OR|XOR|LIKE|NOTLIKE|NOT BETWEEN|NOTBETWEEN|BETWEEN|NOTIN|NOT IN|IN)$/i"
);
$str = preg_replace($farr, "" ,$str);
return $str;
}
}
XssFilter::getIntance();