php中使用is_numberic函数注意事项

$s = is_numeric($_GET['s'])?$_GET['s']:0;
$sql="insert into test(type)values($s);";  //是 values($s) 不是values('$s')
mysql_query($sql);

$id = intval($_GET['id']);

echo intval(42); // 42
echo intval(4.2); // 4
echo intval('42'); // 42
echo intval('+42'); // 42
echo intval('-42'); // -42
echo intval(042); // 34
echo intval('042'); // 42
echo intval(1e10); // 1410065408
echo intval('1e10'); // 1
echo intval(0x1A); // 26
echo intval(42000000); // 42000000
echo intval(420000000000000000000); // 0
echo intval('420000000000000000000'); // 2147483647
echo intval(42, 8); // 42
echo intval('42', 8); // 34
?>

<?php
if($_POST){
    if($_SESSION["token"]!=$_POST["token"]){
        die("非法提交！");
    }else{
        echo "安全提交!";
    }
}
$_SESSION["token"]=md5(rand(1,999));//没生成一次表单，修改一次值，不要在post处理前修改它，不然无法比对 www.111cn.net
?>
<form action="1.php" method="post">
<input type="hidden" value="<?php echo $_SESSION["token"]?>" name="token">
<input type="submit" value="提交" />
</form>

<?php

$value = $_COOKIE[“value”]; //读取上一次设置的Cookie值

if（count（$_POST）） {

$long = “”;

while（list（$key,$value）=each（$_POST））$long.=$value;

$hash = md5（$long）；

setcookie（“value”,$hash,time（）+60*60）； //重新设置cookie

}

if（$value!=$hash） {

// 如果两次的MD5值不一样就对数据进行进一步操作

} else {

//如果两次MD5的值相同，告知用户提交失败 ,为重复提交表单

}

?>

<?php

/* 全局安全处理 */

switch ($_GET['task'])
{
case 'print_form':
include '/inc/presentation/form.inc';
break;

case 'process_form':
$form_valid = false;
include '/inc/logic/process.inc';
if ($form_valid)
{
include '/inc/presentation/end.inc';
}
else
{
include '/inc/presentation/form.inc';
}
break;

default:
include '/inc/presentation/index.inc';
break;
}

?>

<?php

switch ($_POST['form'])
{
case 'login':
$allowed = array();
$allowed[] = 'form';
$allowed[] = 'username';
$allowed[] = 'password';

$sent = array_keys($_POST);

if ($allowed == $sent)
{
include '/inc/logic/process.inc';
}

break;
}

?>

<?php

$clean = array();

$email_pattern = '/^[^@s<&>]+@([-a-z0-9]+.)+[a-z]{2,}$/i';

if (preg_match($email_pattern, $_POST['email']))
{
$clean['email'] = $_POST['email'];
}

?>

<?php

$clean = array();

switch ($_POST['color'])
{
case 'red':
case 'green':
case 'blue':
$clean['color'] = $_POST['color'];
break;
}

?>

<?php

$clean = array();

if ($_POST['num'] == strval(intval($_POST['num'])))
{
$clean['num'] = $_POST['num'];
}

?>

<?php

$clean = array();

if ($_POST['num'] == strval(floatval($_POST['num'])))
{
$clean['num'] = $_POST['num'];
}

?>

<?PHP
//PHP整站防注入程序，需要在公共文件中require_once本文件
//判断magic_quotes_gpc状态
if (@get_magic_quotes_gpc ()) {
$_GET = sec ( $_GET );
$_POST = sec ( $_POST );
$_COOKIE = sec ( $_COOKIE );
$_FILES = sec ( $_FILES );
}
$_SERVER = sec ( $_SERVER );
function sec(&$array) {
//如果是数组，遍历数组，递归调用
if (is_array ( $array )) {
foreach ( $array as $k => $v ) {
$array [$k] = sec ( $v );
}
} else if (is_string ( $array )) {
//使用addslashes函数来处理
$array = addslashes ( $array );
} else if (is_numeric ( $array )) {
$array = intval ( $array );
}
return $array;
}
//整型过滤函数
function num_check($id) {
if (! $id) {
die ( '参数不能为空！' );
} //是否为空的判断
else if (inject_check ( $id )) {
die ( '非法参数' );
} //注入判断
else if (! is_numetic ( $id )) {
die ( '非法参数' );
}
//数字判断
$id = intval ( $id );
//整型化
return $id;
}
//字符过滤函数
function str_check($str) {
if (inject_check ( $str )) {
die ( '非法参数' );
}
//注入判断
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
function search_check($str) {
$str = str_replace ( "_", "_", $str );
//把"_"过滤掉
$str = str_replace ( "%", "%", $str );
//把"%"过滤掉
$str = htmlspecialchars ( $str );
//转换html
return $str;
}
//表单过滤函数
function post_check($str, $min, $max) {
if (isset ( $min ) && strlen ( $str ) < $min) {
die ( '最少$min字节' );
} else if (isset ( $max ) && strlen ( $str ) > $max) {
die ( '最多$max字节' );
}
return stripslashes_array ( $str );
}
//防注入函数
function inject_check($sql_str) {
return eregi ( 'select|inert|update|delete|'|/*|*|../|./|UNION|into|load_file|outfile', $sql_str );
// www.111cn.net 进行过滤，防注入
}
function stripslashes_array(&$array) {
if (is_array ( $array )) {
foreach ( $array as $k => $v ) {
$array [$k] = stripslashes_array ( $v );
}
} else if (is_string ( $array )) {
$array = stripslashes ( $array );
}
return $array;
}
?>

badword.src.php

内容如下

$badword=array('张三','丰田');

php过滤

require('badword.src.php');
$badword1 = array_combine($badword,array_fill(0,count($badword),'*'));
$bb = '我今天开着上班';
$str = strtr($bb, $badword1);

<?php
function cleanWords1($text) {
 //根据个人需要添加需要过滤的词汇，以"|"作为分隔符
 $badword = "敏感字|敏感字|敏感字|敏感字|敏感字";
 $badwords = explode('|',$badword);
 foreach($badwords as $v){
  $text = str_replace($v,'**',$text);
 }
 return $text;
}
function cleanWords2($text) {
 //根据个人需要添加需要过滤的词汇，以"|"作为分隔符
 $badword = "敏感字|敏感字|敏感字|敏感字|敏感字";
 return preg_replace("/$badword/i",'**',$text);
}
$string="敏感字符串";
echo cleanWords1($string).'<br/>';
echo cleanWords2($string);
?>

<?php

$pdo = new PDO("mysql:host=192.168.0.1;dbname=test;charset=utf8","root");

$st = $pdo->prepare("select * from info where id =? and name = ?");

$id = 21;

$name = 'zhangsan';

$st->bindParam(1,$id);

$st->bindParam(2,$name);

$st->execute();

$st->fetchAll();

?>

$pdo->query('SET NAMES GBK');

$var = chr(0xbf) . chr(0x27) . " OR 1=1 /*";

$query = "SELECT * FROM info WHERE name = ?";

$stmt = $pdo->prepare($query);

$stmt->execute(array($var));

<?php

$pdo = new PDO("mysql:host=192.168.0.1;dbname=test;","root");

$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);

$st = $pdo->prepare("select * from info where id =? and name = ?");

$id = 21; //www.111Cn.nEt

$name = 'zhangsan';

$st->bindParam(1,$id);

$st->bindParam(2,$name);

$st->execute();

$st->fetchAll();

?>

$pdo = new PDO('mysql:host=localhost;dbname=test;charset=utf8', 'root');

$dbhost="localhost";
$dbname="test";
$dbusr="root";
$dbpwd="";
$dbhdl=NULL;
$dbstm=NULL;
 
$opt = array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8',);
$dsn='mysql:host=' . $dbhost . ';dbname=' . $dbname.';charset=utf8';
try {
 $dbhdl = new PDO($dsn, $dbusr, $dbpwd, $opt);//www.111cn.net
 $dbhdl=->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
 //dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_SILENT);//Display none
 //dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_WARNING);//Display warning
 $dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);//Display exception
} catch (PDOExceptsddttrtion $e) {//return PDOException
 print "Error!: " . $e->getMessage() . "<br>";
 die();
}

$dbhost="localhost";
$dbname="test";
$dbusr="root";
$dbpwd="";
$dbhdl=NULL;
$dbstm=NULL;
 
$dsn='mysql:host=' . $dbhost . ';dbname=' . $dbname.';charset=utf8';
try {
 $dbhdl = new PDO($dsn, $dbusr, $dbpwd,);
 $dbhdl=->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
 //dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_SILENT);//Display none
 //dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_WARNING);//Display warning
 $dbhdl->setAttribute(PDO::ATTR_ERRMODE,PDO::ERRMODE_EXCEPTION);//Display exception
 $dbhdl->query('SET NAMES GBK');
} catch (PDOExceptsddttrtion $e) {//return PDOException
 print "Error!: " . $e->getMessage() . "<br>";
 die();
}