注入过滤php,php过滤客户提交参数，防注入

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

Warning: strncmp() has been disabled for security reasons in /www/web/default/blog/public_html/wp-includes/formatting.php on line 117

以下代码实现过滤php的$_GET 和$_POST参数

/**

* 安全防范

*/

function Add_S($array)

{

foreach($array as $key=>$value)

{

if(!is_array($value))

{

$value = get_magic_quotes_gpc()?$value:addslashes($value);

$array[$key]=filterHtml($value);

}

Else

{

Add_S($array[$key]);

}

}

return $array;

}

function glstr($var) {

if (is_array($var)) {

return Add_S($var);

}

elseif(strlen($var)){

$var = get_magic_quotes_gpc()?$var:addslashes($var);

$var = filterHtml($var);

}

return $var;

}

function filterHtml($html)

{

$farr = array(

"/[^>]*?)>/eis",

"/]*?)>/eis",

"//eis",

"/(]*?\s+)on[a-z]+\s*?=(\"|')([^\\2]*)\\2([^>]*?>)/isU",//过滤javascript的on事件

"/\s+/",//过滤多余的空白

);

$tarr = array(

"",

"",

"",

"\\1\\4",

" ",

);

$html = preg_replace( $farr,$tarr,$html);

return $html;

}

if (sizeof($_GET)) {

foreach($_GET as $key => $value) {

$_GET[$key] = glstr($value); //

}

}

if (sizeof($_POST)) {

foreach($_POST as $key => $value) {

$_POST[$key] = glstr($value); //

}

}