PHP anti-injection function code summary_PHP tutorial

$magic_quotes_gpc = get_magic_quotes_gpc();
@extract(daddslashes($_COOKIE));
@extract(daddslashes($_POST));
@extract(daddslashes($_GET));
if(!$magic_quotes_gpc) {
$_FILES = daddslashes($_FILES);
}

function daddslashes($string, $force = 0) {
if(!$GLOBALS['magic_quotes_gpc'] || $force) {
if(is_array($string)) {
foreach($string as $key => $val) {
$string[$key] = daddslashes($val, $force);
}
} else {
$string = addslashes($string);
}
}
return $string;
}

$field = explode(',', $data);
array_walk($field, array($this, 'add_special_char'));
$data = implode(',', $field);
/**
* Add backticks on both sides of the field to ensure database security
* @param $value array value
​*/
public function add_special_char(&$value) {
if('*' == $value || false !== strpos($value, '(') || false !== strpos($value, '.') || false !== strpos ( $value, '`')) {
//Do not process include * or use sql method.
} else {
$value = '`'.trim($value).''';
}
return $value;
}
function str_filter($str) {
$str = htmlspecialchars ( $str );
if (! get_magic_quotes_gpc ()) {
$str = addslashes ( $str );
}
//Filter dangerous characters
return preg_replace ( "/["'=]|(and)|(or)|(create)|(update)|(alter)|(delete)|(insert)|(load_file)|(outfile)|(count) |(%20)|(char)/i", "", $str );
}
/*
Function name: str_check()
Function: Filter the submitted string
Parameters: $var: string to be processed
Return value: Return the filtered string
*/
function str_check($str) {
if (! get_magic_quotes_gpc ()) { // Determine whether magic_quotes_gpc is turned on
$str = addslashes ( $str ); // Filter
}
$str = str_replace ( "_", "_", $str ); // Filter out '_'
$str = str_replace ( "%", "%", $str ); // Filter out '%'
return $str;
}

/*
Function name: post_check()
Function: Process the submitted editing content
Parameters: $post: Content to be submitted
Return value: $post: Returns filtered content
*/
function post_check($post) {
if (! get_magic_quotes_gpc ()) { // Determine whether magic_quotes_gpc is open
$post = addslashes ( $post ); // Filter submitted data when magic_quotes_gpc is not turned on
}
$post = str_replace ( "_", "_", $post ); // Filter out '_'
$post = str_replace ( "%", "%", $post ); // Filter out '%'
$post = nl2br ( $post ); // Enter conversion
$post = htmlspecialchars ( $post ); // html tag conversion
return $post;
}
/*
Function name: inject_check()
Function: Detect whether the submitted value contains SQL injection characters, prevent injection, and protect server security
Parameter: $sql_str: Submitted variable
Return value: Return the detection result, true or false
*/
function inject_check($sql_str) {
return eregi('select|insert|and|or|update|delete|'|/*|*|../|./|union|into|load_file|outfile', $sql_str); // Filter
}

/*
Function name: verify_id()
Function: Verify whether the submitted ID value is legal
Parameters: $id: Submitted ID value
Return value: Return the processed ID
*/
function verify_id($id=null) {
if (!$id) { exit('No parameters submitted!'); } // Determine whether it is empty
elseif (inject_check($id)) { exit('The submitted parameter is illegal!'); } // Injection judgment
elseif (!is_numeric($id)) { exit('The submitted parameter is illegal!'); } // Numeric judgment
$id = intval($id); // Integer

return $id;
}

// $rptype = 0 表示仅替换 html标记
// $rptype = 1 表示替换 html标记同时去除连续空白字符
// $rptype = 2 表示替换 html标记同时去除所有空白字符
// $rptype = -1 表示仅替换 html危险的标记
function HtmlReplace($str, $rptype = 0) {
$str = stripslashes ( $str );
if ($rptype == 0) {
$str = htmlspecialchars ( $str );
} else if ($rptype == 1) {
$str = htmlspecialchars ( $str );
$str = str_replace ( "　", ' ', $str );
$str = ereg_replace ( "[rnt ]{1,}", ' ', $str );
} else if ($rptype == 2) {
$str = htmlspecialchars ( $str );
$str = str_replace ( "　", '', $str );
$str = ereg_replace ( "[rnt ]", '', $str );
} else {
$str = ereg_replace ( "[rnt ]{1,}", ' ', $str );
$str = eregi_replace ( 'script', 'ｓｃｒｉｐｔ', $str );
$str = eregi_replace ( "<[/]{0,1}(link|meta|ifr|fra)[^>]*>", '', $str );
 }
 return addslashes ( $str );
}
//递归ddslashes
function daddslashes($string, $force = 0, $strip = FALSE) {
 if (! get_magic_quotes_gpc () || $force) {
  if (is_array ( $string )) {
   foreach ( $string as $key => $val ) {
    $string [$key] = daddslashes ( $val, $force );
   }
  } else {
   $string = addslashes ( $strip ? stripslashes ( $string ) : $string );
  }
 }
 return $string;
}

//递归stripslashes
function dstripslashes($string) {
 if (is_array ( $string )) {
  foreach ( $string as $key => $val ) {
   $string [$key] = $this->dstripslashes ( $val );
  }
 } else {
  $string = stripslashes ( $string );
 }
 return $string;
}
/**
 * 安全过滤函数
 * @param $string 要过滤的字符串
 * @return string 返回处理过的字符串
 */
function safe_replace($string) {
 $string = str_replace('%20','',$string);
 $string = str_replace('%27','',$string);
 $string = str_replace('%2527','',$string);
 $string = str_replace('*','',$string);
 $string = str_replace('"','"',$string);
 $string = str_replace("'",'',$string);
 $string = str_replace('"','',$string);
 $string = str_replace(';','',$string);
 $string = str_replace('<','<',$string);
$string = str_replace('>','>',$string);
 $string = str_replace("{",'',$string);
 $string = str_replace('}','',$string);
 return $string;
}

/**
 * 使用htmlspecialchars处理字符串或数组
 * @param $obj 需要处理的字符串或数组
 * @return mixed 返回经htmlspecialchars处理过的字符串或数组
 */
function new_htmlspecialchars($string) {
 if(!is_array($string))
 return htmlspecialchars($string);
 foreach($string as $key => $val)
 $string[$key] = new_htmlspecialchars($val);
 return $string;
}

//处理禁用HTML但允许换行的内容
function TrimMsg($msg) {
 $msg = trim ( stripslashes ( $msg ) );
 $msg = nl2br ( htmlspecialchars ( $msg ) );
 $msg = str_replace ( "  ", " ", $msg );
 return addslashes ( $msg );
}