PHP利用str_replace防注入的方法


Posted in PHP onNovember 10, 2013

PHP各种过滤字符函数

   <?php
    /**
    * 安全过滤函数
    *
    * @param $string
    * @return string
    */
    function safe_replace($string) {
    $string = str_replace('%20','',$string);
    $string = str_replace('%27','',$string);
    $string = str_replace('%2527','',$string);
    $string = str_replace('*','',$string);
    $string = str_replace('"','"',$string);
    $string = str_replace("'",'',$string);
    $string = str_replace('"','',$string);
    $string = str_replace(';','',$string);
    $string = str_replace('<','<',$string);
    $string = str_replace('>','>',$string);
    $string = str_replace("{",'',$string);
    $string = str_replace('}','',$string);
    $string = str_replace('','',$string);
    return $string;
    }
    ?>

    <?php
    /**
    * 返回经addslashes处理过的字符串或数组
    * @param $string 需要处理的字符串或数组
    * @return mixed
    */
    function new_addslashes($string) {
    if(!is_array($string)) return addslashes($string);
    foreach($string as $key => $val) $string[$key] = new_addslashes($val);
    return $string;
    }
    ?>

    <?php
    //对请求的字符串进行安全处理
    /*
    $safestep
    0 为不处理,
    1 为禁止不安全HTML内容(javascript等),
    2 完全禁止HTML内容,并替换部份不安全字符串(如:eval(、union、CONCAT(、--、等)
    */
    function StringSafe($str, $safestep=-1){
    $safestep = ($safestep > -1) ? $safestep : 1;
    if($safestep == 1){
    $str = preg_replace("#script:#i", "script:", $str);
    $str = preg_replace("#<[/]{0,1}(link|meta|ifr|fra|scr)[^>]*>#isU", '', $str);
    $str = preg_replace("#[ ]{1,}#", ' ', $str);
    return $str;
    }else if($safestep == 2){
    $str = addslashes(htmlspecialchars(stripslashes($str)));
    $str = preg_replace("#eval#i", 'eval', $str);
    $str = preg_replace("#union#i", 'union', $str);
    $str = preg_replace("#concat#i", 'concat', $str);
    $str = preg_replace("#--#", '--', $str);
    $str = preg_replace("#[ ]{1,}#", ' ', $str);
    return $str;
    }else{
    return $str;
    }
    }
    ?>

    <?php
       /**
        +----------------------------------------------------------
        * 输出安全的html,用于过滤危险代码
        +----------------------------------------------------------
        * @access public
        +----------------------------------------------------------
        * @param string $text 要处理的字符串
        * @param mixed $tags 允许的标签列表,如 table|td|th|td
        +----------------------------------------------------------
        * @return string
        +----------------------------------------------------------
        */
       static public function safeHtml($text, $tags = null)
       {
           $text =  trim($text);
           //完全过滤注释
           $text = preg_replace('/<!--?.*-->/','',$text);
           //完全过滤动态代码
           $text =  preg_replace('/<?|?'.'>/','',$text);
           //完全过滤js
           $text = preg_replace('/<script?.*/script>/','',$text);
           $text =  str_replace('[','[',$text);
           $text = str_replace(']',']',$text);
           $text =  str_replace('|','|',$text);
           //过滤换行符
           $text = preg_replace('/ ? /','',$text);
           //br
           $text =  preg_replace('/<br(s/)?'.'>/i','[br]',$text);
           $text = preg_replace('/([br]s*){10,}/i','[br]',$text);
           //过滤危险的属性,如:过滤on事件lang js
           while(preg_match('/(<[^><]+)(lang|on|action|background|codebase|dynsrc|lowsrc)[^><]+/i',$text,$mat)){
               $text=str_replace($mat[0],$mat[1],$text);
           }
           while(preg_match('/(<[^><]+)(window.|javascript:|js:|about:|file:|document.|vbs:|cookie)([^><]*)/i',$text,$mat)){
               $text=str_replace($mat[0],$mat[1].$mat[3],$text);
           }
           if( empty($allowTags) ) { $allowTags = self::$htmlTags['allow']; }
           //允许的HTML标签
           $text =  preg_replace('/<('.$allowTags.')( [^><[]]*)>/i','[12]',$text);
           //过滤多余html
           if ( empty($banTag) ) { $banTag = self::$htmlTags['ban']; }
           $text =  preg_replace('/</?('.$banTag.')[^><]*>/i','',$text);
           //过滤合法的html标签
           while(preg_match('/<([a-z]+)[^><[]]*>[^><]*</1>/i',$text,$mat)){
               $text=str_replace($mat[0],str_replace('>',']',str_replace('<','[',$mat[0])),$text);
           }
           //转换引号
           while(preg_match('/([[^[]]*=s*)("|')([^2=[]]+)2([^[]]*])/i',$text,$mat)){
               $text=str_replace($mat[0],$mat[1].'|'.$mat[3].'|'.$mat[4],$text);
           }
           //空属性转换
           $text =  str_replace('''','||',$text);
           $text = str_replace('""','||',$text);
           //过滤错误的单个引号
           while(preg_match('/[[^[]]*("|')[^[]]*]/i',$text,$mat)){
               $text=str_replace($mat[0],str_replace($mat[1],'',$mat[0]),$text);
           }
           //转换其它所有不合法的 < >
           $text =  str_replace('<','<',$text);
           $text = str_replace('>','>',$text);
           $text = str_replace('"','"',$text);
           //反转换
           $text =  str_replace('[','<',$text);
           $text =  str_replace(']','>',$text);
           $text =  str_replace('|','"',$text);
           //过滤多余空格
           $text =  str_replace('  ',' ',$text);
           return $text;
       }
    ?>

    <?php
    function RemoveXSS($val) { 
       // remove all non-printable characters. CR(0a) and LF(0b) and TAB(9) are allowed 
       // this prevents some character re-spacing such as <javascript> 
       // note that you have to handle splits with , , and later since they *are* allowed in some          // inputs 
       $val = preg_replace('/([x00-x08,x0b-x0c,x0e-x19])/', '', $val); 
       // straight replacements, the user should never need these since they're normal characters 
       // this prevents like <IMG SRC=@avascript:alert('XSS')> 
       $search = 'abcdefghijklmnopqrstuvwxyz'; 
       $search .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'; 
       $search .= '1234567890!@#$%^&*()'; 
       $search .= '~`";:?+/={}[]-_|''; 
       for ($i = 0; $i < strlen($search); $i++) { 
           // ;? matches the ;, which is optional 
           // 0{0,7} matches any padded zeros, which are optional and go up to 8 chars 
           // @ @ search for the hex values 
           $val = preg_replace('/(&#[xX]0{0,8}'.dechex(ord($search[$i])).';?)/i', $search[$i], $val);//with a ; 
           // @ @ 0{0,7} matches '0' zero to seven times 
           $val = preg_replace('/(�{0,8}'.ord($search[$i]).';?)/', $search[$i], $val); // with a ; 
       } 
       // now the only remaining whitespace attacks are , , and  
       $ra1 = Array('javascript', 'vbscript', 'expression', 'applet', 'meta', 'xml', 'blink', 'link', 'style', 'script', 'embed', 'object', 'iframe', 'frame', 'frameset', 'ilayer', 'layer', 'bgsound', 'title', 'base'); 
       $ra2 = Array('onabort', 'onactivate', 'onafterprint', 'onafterupdate', 'onbeforeactivate', 'onbeforecopy', 'onbeforecut', 'onbeforedeactivate', 'onbeforeeditfocus', 'onbeforepaste', 'onbeforeprint', 'onbeforeunload', 'onbeforeupdate', 'onblur', 'onbounce', 'oncellchange', 'onchange', 'onclick', 'oncontextmenu', 'oncontrolselect', 'oncopy', 'oncut', 'ondataavailable', 'ondatasetchanged', 'ondatasetcomplete', 'ondblclick', 'ondeactivate', 'ondrag', 'ondragend', 'ondragenter', 'ondragleave', 'ondragover', 'ondragstart', 'ondrop', 'onerror', 'onerrorupdate', 'onfilterchange', 'onfinish', 'onfocus', 'onfocusin', 'onfocusout', 'onhelp', 'onkeydown', 'onkeypress', 'onkeyup', 'onlayoutcomplete', 'onload', 'onlosecapture', 'onmousedown', 'onmouseenter', 'onmouseleave', 'onmousemove', 'onmouseout', 'onmouseover', 'onmouseup', 'onmousewheel', 'onmove', 'onmoveend', 'onmovestart', 'onpaste', 'onpropertychange', 'onreadystatechange', 'onreset', 'onresize', 'onresizeend', 'onresizestart', 'onrowenter', 'onrowexit', 'onrowsdelete', 'onrowsinserted', 'onscroll', 'onselect', 'onselectionchange', 'onselectstart', 'onstart', 'onstop', 'onsubmit', 'onunload'); 
       $ra = array_merge($ra1, $ra2); 
       $found = true; // keep replacing as long as the previous round replaced something 
       while ($found == true) { 
           $val_before = $val; 
           for ($i = 0; $i < sizeof($ra); $i++) { 
               $pattern = '/'; 
               for ($j = 0; $j < strlen($ra[$i]); $j++) { 
                   if ($j > 0) { 
                       $pattern .= '('; 
                       $pattern .= '(&#[xX]0{0,8}([9ab]);)'; 
                       $pattern .= '|'; 
                       $pattern .= '|(�{0,8}([9|10|13]);)'; 
                       $pattern .= ')*'; 
                   } 
                   $pattern .= $ra[$i][$j]; 
               } 
               $pattern .= '/i'; 
               $replacement = substr($ra[$i], 0, 2).'<x>'.substr($ra[$i], 2); // add in <> to nerf the tag 
               $val = preg_replace($pattern, $replacement, $val); // filter out the hex tags 
               if ($val_before == $val) { 
                   // no replacements were made, so exit the loop 
                   $found = false; 
               } 
           } 
       } 
       return $val; 
    }
    ?>
PHP 相关文章推荐
如何对PHP程序中的常见漏洞进行攻击
Oct 09 PHP
php数组(array)输出的三种形式详解
Jun 05 PHP
解析如何屏蔽php中的phpinfo()函数
Jun 06 PHP
163的邮件用phpmailer发送(实例详解)
Jun 24 PHP
为PHP安装imagick时出现Cannot locate header file MagickWand.h错误的解决方法
Nov 03 PHP
PHP文件操作方法汇总
Jul 01 PHP
PHP支付系统设计与典型案例分享
Aug 02 PHP
详解yii2实现分库分表的方案与思路
Feb 03 PHP
php数组指针操作详解
Feb 14 PHP
CakePHP框架Session设置方法分析
Feb 23 PHP
YII框架实现自定义第三方扩展操作示例
Apr 26 PHP
PHP实现创建一个RPC服务操作示例
Feb 23 PHP
PHP加密扩展库Mcrypt安装和实例
Nov 10 #PHP
php中autoload的用法总结
Nov 08 #PHP
PHP用身份证号获取星座和生肖的方法
Nov 07 #PHP
php旋转图片90度的方法
Nov 07 #PHP
提高PHP编程效率的方法
Nov 07 #PHP
PHP imagegrabscreen和imagegrabwindow(截取网站缩略图)的实例代码
Nov 07 #PHP
php获取汉字首字母的函数
Nov 07 #PHP
You might like
PHP 实例化类的一点摘记
2008/03/23 PHP
PHP+JS+rsa数据加密传输实现代码
2011/03/23 PHP
PHP表单验证内容是否为空的实现代码
2016/11/14 PHP
JavaScript限定复选框的选择个数示例代码
2013/08/25 Javascript
js实现通用的微信分享组件示例
2014/03/10 Javascript
jquery 选取方法都有哪些
2014/05/18 Javascript
Express.JS使用详解
2014/07/17 Javascript
jQuery on()方法使用技巧详解
2015/04/16 Javascript
js实现九宫格拼图小游戏
2017/02/13 Javascript
Javascript实现从小到大的数组转换成二叉搜索树
2017/06/13 Javascript
ComboBox(下拉列表框)通过url加载调用远程数据的方法
2017/08/06 Javascript
JQuery判断正整数整理小结
2017/08/21 jQuery
Angular 5.0 来了! 有这些大变化
2017/11/15 Javascript
three.js实现3D影院的原理的代码分析
2017/12/18 Javascript
vue2.0路由切换后页面滚动位置不变BUG的解决方法
2018/03/14 Javascript
微信小程序实现手指触摸画板
2018/07/09 Javascript
对vux点击事件的优化详解
2018/08/28 Javascript
微信小程序textarea层级过高的解决方法
2019/03/04 Javascript
express启用https使用小记
2019/05/21 Javascript
基于vue 实现表单中password输入的显示与隐藏功能
2019/07/19 Javascript
javascript的hashCode函数实现代码小结
2020/08/11 Javascript
python 图片验证码代码
2008/12/07 Python
python编写弹球游戏的实现代码
2018/03/12 Python
Win10环境python3.7安装dlib模块趟过的坑
2019/08/01 Python
在Python3 numpy中mean和average的区别详解
2019/08/24 Python
python 实现兔子生兔子示例
2019/11/21 Python
Python IDE环境之 新版Pycharm安装详细教程
2020/03/05 Python
wordpress添加Html5的表单验证required方法小结
2020/08/18 HTML / CSS
预防传染病方案
2014/06/14 职场文书
个人委托书如何写
2014/09/25 职场文书
大学毕业生自我评价
2015/03/02 职场文书
新学期主题班会
2015/08/17 职场文书
Python实战之OpenCV实现猫脸检测
2021/06/26 Python
sentinel支持的redis高可用集群配置详解
2022/04/01 Redis
电脑开机弹出documents文件夹怎么回事?弹出documents文件夹解决方法
2022/04/08 数码科技
JavaScript中10个Reduce常用场景技巧
2022/06/21 Javascript