PHP 用于预翻SQL inj和XSS的基本脚本

Posted 2021-05-15

function filterInput(&$input)
{
	$_SERVER['GPC_STATUS'] = get_magic_quotes_gpc(); // We do not want to call get_magic_quotes_gpc() function for each element of array
	array_walk_recursive($input, 'sanitizeIt'); // Sanitize each element of array
}

function sanitizeIt(&$str)
{
	if($_SERVER['GPC_STATUS']) // Just check variable
		$str = stripslashes($str);

	$str = htmlspecialchars(rawurldecode(trim($str)), ENT_QUOTES, 'UTF-8');
}

/** **** Examples ****

	--- Without sanitize ---
		URL: /index.php?monkey=<foo>'bar\D
		Script:
			print_r($_GET);
		Result:
			Array
			(
				[monkey] => <foo>\'bar\\d
			)
	--- With sanitize ---
		URL: /index.php?monkey=<foo>'bar\D
		Script:
			filterInput($_GET);
			print_r($_GET);
		Result:
			Array
			(
				[monkey] => <foo>'bar\d
			)
**/