Question

我的php CRUD类中有以下方法：

//secure search method
    function secureInput($ary = array()){
        $this->connect();
        $securedArray = array();
        //print_r($ary);
        foreach($ary as $val){
            //echo($val.'<br />');
            $val = str_replace("'","",$val);
            $val = str_replace("#","",$val);
            $val = str_replace("~","",$val);
            $val = str_replace("!","",$val);
            $val = str_replace("%","",$val);
            $val = str_replace("*","",$val);    
            $val = str_replace("drop","",strtolower($val));
            $val = str_replace("show","",strtolower($val));
            $val = str_replace("insert","",strtolower($val));
            $val = str_replace("create","",strtolower($val));
            $val = str_replace("update","",strtolower($val));
            $val = str_replace("select","",strtolower($val));
            $val = str_replace('"',"",$val);
            $val = str_replace("+","",$val);
            $val = str_replace(";","",$val);
            $val = mysql_real_escape_string($val);
            $securedArray[] = $val;
            }
            return $securedArray;
        }

我想使用以下代码来获取输入并返回干净输入（黑客xss证明输入），然后将其用于我的数据库查询，如插入更新和检索等

require_once('classes/classes.php'); 
$crud = new CRUD();
$ar = array("Shah Hussai#n","shahhus';sai;'n3#05@xyz.com","",234);
$name = "";$email = "";$empty ="";$int = "";
$ary = $crud->secureInput($ar); 
if(!isset($ary[0]) || empty($ary[0])){
    echo("Please provide your name<br />");
    }
else{
    //update variables here
    $name = $ary[0];
    $email = $ary[1];
    $empty = $ary[2];
    $int = $ary[3];
    }//if
echo $sql = "INSERT INTO tbl(name,email...) values($name,$email,$empty,$int)";

现在我不确定这是否会保护我的代码免受黑客Cross Scripting和sql注入尝试？或者我应该做些别的事情来安全地接受输入？

提前致谢

Answer 1

为了保护SQL注入，最好使用Prepared Statement。提供的链接可以帮助您。对于其他风险，您最好具体来获得答案。

Answer 2

你可以使用这个课程

http://www.phpclasses.org/package/8291-PHP-Check-request-values-to-detect-hacking-attempts.html

易于使用

成功

从网址获取安全输入并使我的输入黑客安全

2 个答案: