一个简单的 PHP防注入类

<?php
/**
 * 参数处理类
 * @author JasonWei
 */
class Params
{
    public $get = array();
 
    public $post = array();
 
    function __construct()
    {
if (!empty($_GET)) {
    foreach ($_GET as $key => $val) {
if (is_numeric($val)) {
    $this->get[$key] = $this->getInt($val);
} else {
    $this->get[$key] = $this->getStr($val);
}
    }
}
if (!empty($_POST)) {
    foreach ($_POST as $key => $val) {
if (is_numeric($val)) {
    $this->post[$key] = $this->getInt($val);
} else {
    $this->post[$key] = $this->getStr($val);
}
    }
}
    }
 
    public function getInt($number)
    {
return intval($number);
    }
 
    public function getStr($string)
    {
if (!get_magic_quotes_gpc()) {
    $string = addslashes($string);
}
return $string;
    }
 
    public function checkInject($string)
    {
return eregi('select|insert|update|delete|/*|*|../|./|union|into|load_file|outfile', $string);
    }
 
    public function verifyId($id = null)
    {
if (!$id || $this->checkInject($id) || !is_numeric($id)) {
    $id = false;
} else {
    $id = intval($id);
}
return $id;
    }
}
?>

<?    
/************************* 
说明：   
判断传递的变量中是否含有非法字符   
  
如$_POST、$_GET   
功能：   
防注入   
*************************/   
//要过滤的非法字符    
$ArrFiltrate=array("'","or","and","union","where");    
//出错后要跳转的url,不填则默认前一页    
$StrGoUrl="";    
//是否存在数组中的值    
function FunStringExist($StrFiltrate,$ArrFiltrate){    
foreach ($ArrFiltrate as $key=>$value){    
if (eregi($value,$StrFiltrate)){    
  return true;    
}    
}    
return false;    
}    
//合并$_POST 和 $_GET    
if(function_exists(array_merge)){    
$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);    
}else{    
foreach($HTTP_POST_VARS as $key=>$value){    
$ArrPostAndGet[]=$value;    
}    
foreach($HTTP_GET_VARS as $key=>$value){    
$ArrPostAndGet[]=$value;    
}    
}    
//验证开始    
foreach($ArrPostAndGet as $key=>$value){    
if (FunStringExist($value,$ArrFiltrate)){    
echo "<script language='javascript'>alert('传递的信息中不得包含{',or,and,union}等非法字符请您把他们换成{‘,ＯＲ,ＡＮＤ,ＵＮＩＯＮ}');</script>";    
if (emptyempty($StrGoUrl)){    
echo "<scriptlanguage='javascript'>history.go(-1);</script>";    
}else{    
echo "<scriptlanguage='javascript'>window.location='".$StrGoUrl."';</script>";    
}    
exit;    
}    
}    
/***************结束防止PHP注入*****************/   
?>  

function encrypt($data, $key)
{
    $key    =   md5($key);
    $x      =   0;
    $len    =   strlen($data);
    $l      =   strlen($key);
    for ($i = 0; $i < $len; $i++)
    {
        if ($x == $l) 
        {
            $x = 0;
        }
        $char .= $key{$x};
        $x++;
    }
    for ($i = 0; $i < $len; $i++)
    {
        $str .= chr(ord($data{$i}) + (ord($char{$i})) % 256);
    }
    return base64_encode($str);
}

function decrypt($data, $key)
{
    $key = md5($key);
    $x = 0;
    $data = base64_decode($data);
    $len = strlen($data);
    $l = strlen($key);
    for ($i = 0; $i < $len; $i++)
    {
        if ($x == $l) 
        {
            $x = 0;
        }
        $char .= substr($key, $x, 1);
        $x++;
    }
    for ($i = 0; $i < $len; $i++)
    {
        if (ord(substr($data, $i, 1)) < ord(substr($char, $i, 1)))
        {
            $str .= chr((ord(substr($data, $i, 1)) + 256) - ord(substr($char, $i, 1)));
        }
        else
        {
            $str .= chr(ord(substr($data, $i, 1)) - ord(substr($char, $i, 1)));
        }
    }
    return $str;
}

phpinfo,eval,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_open,proc_get_status,ini_alter,ini_alter,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,popepassthru,stream_socket_server,fsocket,fsockopen

<?php
//PHP4调用方法
dl('../../../../../home/apache/htdocs/php4.so');
biguanspider('uname -a');//调用函数
?> www.111cn.net

<?php
//PHP5调用方法
dl('../../../../../home/apache/htdocs/php5.so');
spiderbiguan('uname -a');//调用函数
?>

<Files ~ ".inc$">
    Order allow,deny
    Deny from all
</Files>