php快速查找数据库中恶意代码的方法

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

function cleanInput($input) {

$search = array(

'@]*?>.*?@si', // Strip out javascript

'@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags

'@

]*?>.*?

@siU', // Strip style tags properly

'@@' // Strip multi-line comments

);

$output = preg_replace($search, '', $input);

return $output;

}

function sanitize($input) {

if (is_array($input)) {

foreach($input as $var=>$val) {

$output[$var] = sanitize($val);

}

}

else {

if (get_magic_quotes_gpc()) {

$input = stripslashes($input);

}

$input = cleanInput($input);

$output = mysql_real_escape_string($input);

}

return $output;

}

// Usage:

$bad_string = "Hi! It's a good day!";

$good_string = sanitize($bad_string);

// $good_string returns "Hi! It\'s a good day!"

// Also use for getting POST/GET variables

$_POST = sanitize($_POST);

$_GET = sanitize($_GET);