php网站安全问题与文本表单递交安全防范?

Question

php网站安全问题与文本表单递交安全防范

Answer 1

你需要对用户提交的任何数据进行检查并且过滤掉不安全的部分，下面是copy来的，你研究一下。//方法一//过滤',",sql语名addslashes();//方法二，去除所有html标签strip_tags();//方法三过滤可能产生代码function php_sava($str){$farr = array("/s /","/<(/?)(script|i?frame|style|html|body|title|link|meta|?|%)([^>]*?)>/isU","/(<[^>]*)on[a-zA-Z] s*=([^>]*>)/isU",);$tarr = array(" ","＜\1\2\3＞", //如果要直接清除不安全的标签，这里可以留空"\1\2",);$str =&nbsp;preg_replace( $farr,$tarr,$str);return $str;}//php sql防注入代码class sqlin{//dowith_sql($value)function dowith_sql($str){$str =&nbsp;str_replace("and","",$str);$str =&nbsp;str_replace("execute","",$str);$str =&nbsp;str_replace("update","",$str);$str = str_replace("count","",$str);$str = str_replace("chr","",$str);$str = str_replace("mid","",$str);$str = str_replace("master","",$str);$str = str_replace("truncate","",$str);$str = str_replace("char","",$str);$str = str_replace("declare","",$str);$str = str_replace("select","",$str);$str = str_replace("create","",$str);$str = str_replace("delete","",$str);$str = str_replace("insert","",$str);$str = str_replace("'","",$str);$str = str_replace(""","",$str);$str = str_replace(" ","",$str);$str = str_replace("or","",$str);$str = str_replace("=","",$str);$str = str_replace(" ","",$str);//echo $str;return $str;}//aticle()防SQL注入函数//php教程function sqlin(){foreach ($_GET as $key=>$value){$_GET[$key]=$this->dowith_sql($value);}foreach ($_POST as $key=>$value){$_POST[$key]=$this->dowith_sql($value);}}}$dbsql=new sqlin();?>

Answer 2

文本的名字加上中括号即可实现，比如： name="contents" => name="contents[]"，最后提交获取到的数据是一个数组形式的。代码如下：<form name="form1" method="post" action="index.php?action=ok">1.<input type="text" name="contents[]" value="">2.<input type="text" name="contents[]" value="">3.<input type="text" name="contents[]" value=""><input type="submit" value="提交"></form><?phpif($_GET['action'] == 'ok'){$contents = $_POST['contents'];print_r($contents);}?>提交的数据使用时，遍历即可。

Answer 3

假设每个都是name=“col_name[]”，以post方式提交for($i=0;$i<count($_POST['col_name']);$i++){if(empty($_POST['col_name'][$i])){continue;}$sql="INSERT INTO `表名` VALUES(得到的值)";$query=mysql_query($sql);if(!$query){return false;}}