PHP通用防注入安全代码

/*************************

说明：

判断传递的变量中是否含有非法字符

如$_post、$_get

功能：

防注入

**************************/

<?php

//要过滤的非法字符

$arrfiltrate=array("'",";","union");

//出错后要跳转的url,不填则默认前一页

$strgourl="";

//是否存在数组中的值

function funstringexist($strfiltrate,$arrfiltrate){

foreach ($arrfiltrate as $key=>$value){

if (eregi($value,$strfiltrate)){

return true;

}

}

return false;

}

//合并$_post 和 $_get

if(function_exists(array_merge)){

$arrpostandget=array_merge($http_post_vars,$http_get_vars);

}else{

foreach($http_post_vars as $key=>$value){

$arrpostandget[]=$value;

}

foreach($http_get_vars as $key=>$value){

$arrpostandget[]=$value;

}

}

//验证开始

foreach($arrpostandget as $key=>$value){

if (funstringexist($value,$arrfiltrate)){

echo "<script language=/"javascript/">alert(/"neeao提示，非法字符/");</script>";

if (empty($strgourl)){

echo "<script language=/"javascript/">history.go(-1);</script>";

}else{

echo "<script language=/"javascript/">window.location=/"".$strgourl."/";</script>";

}

exit;

}

}

?>