PHP 防止SQL注入漏洞

PHP 防止SQL注入漏洞

开发项目时，不止要考虑项目快速上线，考虑到项目的质量，同时重中之重要考虑到项目的安全性，防止数据泄露，防止数据库被删除，防止数据被篡改等严重的漏洞问题，今天分享一个简单的SQL注入防御，通过在项目入口文件直接引用该类，能防御大部分的表单提交注入的sql语句。涉及到一些特殊的SQL指令，需要自行添加。

代码

<?php
//+----------------------------------------------------------
//+- 防止sql注入攻击
//+----------------------------------------------------------

class XssFilter{

    public static function getIntance(){
        $post  = file_get_contents('php://input');
        if(!empty($post)){
            $_POST = array_merge($_POST, json_decode($post, JSON_UNESCAPED_UNICODE));
        }
        XssFilter::inspection($_GET);
        XssFilter::inspection($_POST);
    }

    /**
     * 字段白名单，提交的表单字段白名单
     * @return array
     */
    private static function blacklist(){
        return array(
            "content"
        );
    }

    //避免SQL漏洞
    private static function inspection(&$requests){
        if(!empty($requests)){
            foreach ($requests as $kk=>&$vv){
                if(is_array($vv)){
                    XssFilter::inspection($vv);
                }else{
                    $kk             = htmlspecialchars($kk, ENT_QUOTES); //过滤键值
                    if(!in_array($kk, XssFilter::blacklist())){
                        if(!XssFilter::is_json($vv)){
                            //判断不是json数据进行处理
                            $str    = XssFilter::filterWords($vv);
                            $str    = XssFilter::clearSQLFilter($str);
                            $str    = filter_var($str, FILTER_SANITIZE_STRING); //字符串过滤
                            $vv     = htmlspecialchars($str, ENT_QUOTES);
                        }
                    }
                }
            }
        }
    }

    //判断是否是json字符串
    private static function is_json($string) {
        json_decode($string);
        return (json_last_error() == JSON_ERROR_NONE);
    }

    //sql过滤
    private static function clearSQLFilter($str){
        $str = str_ireplace("and",      "",$str);
        $str = str_ireplace("execute",  "",$str);
        $str = str_ireplace("update",   "",$str);
        $str = str_ireplace("count",    "",$str);
        $str = str_ireplace("chr",      "",$str);
        $str = str_ireplace("mid",      "",$str);
        $str = str_ireplace("master",   "",$str);
        $str = str_ireplace("truncate", "",$str);
        $str = str_ireplace("char",     "",$str);
        $str = str_ireplace("declare",  "",$str);
        $str = str_ireplace("select",   "",$str);
        $str = str_ireplace("create",   "",$str);
        $str = str_ireplace("delete",   "",$str);
        $str = str_ireplace("insert",   "",$str);
        $str = str_ireplace("'",        "",$str);
        $str = str_ireplace('"',        "",$str);
        $str = str_ireplace(" ",        "",$str);
        $str = str_ireplace("or",       "",$str);
        $str = str_ireplace("=",        "",$str);
        $str = str_ireplace("%20",      "",$str);
        $str = str_ireplace("where",    "",$str);
        $str = str_ireplace("having",   "",$str);
        $str = str_ireplace("union",    "",$str);
        $str = str_ireplace("all",      "",$str);
        return $str;
    }

    /**
     * 正则过滤
     * @param unknown $str
     */
    private static function filterWords($str) {
        $farr   = array(
            "/<(\\/?)(script|i?frame|style|html|body|title|link|meta|object|\\?|\\%)([^>]*?)>/isU",
            "/(<[^>]*)on[a-zA-Z]+\s*=([^>]*>)/isU",
            "/select|eval|dosomething|addslashes|return_var|command|shell_exec|system|insert|update|delete|\'|\/\*|\*|\.\.\/|\.\/|union|into|load_file|outfile|dump/is",
            "/^(EXP|NEQ|GT|EGT|LT|ELT|OR|XOR|LIKE|NOTLIKE|NOT BETWEEN|NOTBETWEEN|BETWEEN|NOTIN|NOT IN|IN)$/i"
        );
        $str    = preg_replace($farr, "" ,$str);
        return $str;
    }
}

XssFilter::getIntance();