php防止sql注入之过滤分页参数

$this->load->library ( 'pagination' );
$config ['base_url'] = site_url () . '/guest/show';
$config ['total_rows'] = $c;
$config ['per_page'] = $pernum = 15;
$config ['uri_segment'] = 3;
$config ['use_page_numbers'] = TRUE;
$config ['first_link'] = '第一页';
$config ['last_link'] = '最后一页';
$config ['num_links'] = 5;
$this->pagination->initialize ( $config );
if (! $this->uri->segment ( 3 )) {
    $currentnum = 0;
} else {
    $currentnum = is_numeric($this->uri->segment ( 3 ))?(intval($this->uri->segment ( 3 ) - 1)) * $pernum:0;
}
 
$current_page=is_numeric($this->uri->segment ( 3 ))?intval($this->uri->segment ( 3 )):1;
if($current_page){
    $data ['title'] = '第'.$current_page.'页-留言本-大冶实验高中首届宏志班网站';
}
else{
    $data ['title'] = '留言本-大冶实验高中首届宏志班网站';
}
 
$data ['liuyan'] = $this->ly->getLy ( $pernum, $currentnum );

 
$current_page=is_numeric($this->uri->segment ( 3 ))?intval($this->uri->segment ( 3 )):1;
$currentnum = is_numeric($this->uri->segment ( 3 ))?(intval($this->uri->segment ( 3 ) - 1)) * $pernum;

<?php
   class ValidationCode
   {
    //属性
    private $width;
    private $height;
    private $codeNum;
       private  $image;
    private $disturbColorNum;  //干扰元素数目
    private  $checkCode;
    function __construct($width=80,$height=20,$codeNum=4)
     {
     $this->width=$width;
     $this->height=$height;
     $this->codeNum=$codeNum;
     $number=floor($width*$height/15);
     if($number>240-$codeNum)
    {
      $this->disturbColorNum=240-$codeNum;
     }else
      {
      $this->disturbColorNum=$number;
      }
      $this->checkCode=$this->createCheckcode();
    }
    function getCheckCode()
    {
           return $this->checkCode;
    }
    private function createImage(){
          $this->image=imagecreatetruecolor($this->width,$this->height);
    $backcolor=imagecolorallocate($this->image,rand(225,255),rand(225,255),rand(255,255));
    imagefill($this->image,0,0,$backcolor);
    $border=imagecolorallocate($this->image,0,0,0);
    imagerectangle($this->image,0,0,$this->width-1,$this->height-1,$border);
    }
    private function setDisturbColor(){
     for($i=0;$i<$this->disturbColorNum;$i++){
      $color=imagecolorallocate($this->image,rand(0,255),rand(0,255),rand(0,255));
     imagesetpixel($this->image,rand(1,$this->width-2),rand(1,$this->height-2),$color);
     }
     for($i=0;$i<10;$i++)
     {
                  $color=imagecolorallocate($this->image,rand(0,255),rand(0,255),rand(0,255));
      imagearc($this->image,rand(-10,$this->width),rand(-10,$this->height),rand(30,300),rand(20,300),55,44,$color);
     }
    }
      private function outputText($fontFace=""){
    for($i=0;$i<$this->codeNum;$i++)
    {
     $fontcolor=imagecolorallocate($this->image,rand(0,128),rand(0,128),rand(0,128));
    if($fontFace=="")
   {
     $fontsize=rand(3,5);
     $x=floor($this->width/$this->codeNum)*$i+5;
     $y=rand(0,$this->height-15);
     imagechar($this->image,$fontsize,$x,$y,$this->checkCode{$i},$fontcolor);
    }
    else
   {
     $fontsize=rand(12,16);
     $x=floor(($this->width-8)/$this->codeNum)*$i+8;
     $y=rand($fontsize,$this->height-8);
     imagettftext($this->image,$fontsize,rand(-45,45),$x,$y,$fontcolor,$fontFace,$this->checkCode{$i});
    }
    }
   }

   private function createCheckCode(){
    $code="23456789abcdefghijkmnpqrstuvwrst";
    $str="";
    for($i=0;$i<$this->codeNum;$i++)
    {
     $char=$code{rand(0,strlen($code)-1)};
     $str.=$char;
    }
    return $str;
   }
   private function outputImage()
    {
    if(imagetypes()&IMG_GIF)
     {
       header("Content-Type:image/gif");
        imagepng($this->image);
     }else if(imagetypes()&IMG_JPG)
     {
        header("Content-Type:image/jpeg");
        imagepng($this->image);
     }else if(imagetypes()&IMG_PNG)
     {
        header("Content-Type:image/png");
      imagepng($this->image);
     }else if(imagetypes()&IMG_WBMP){
                 header("Content-Type:image/vnd.wap.wbmp");
     imagepng($this->image);
     }else
     {
      die("PHP不支持图片验证码");
     }
    }
        //通过该方法向浏览器输出图像
    function  showImage($fontFace="")
    {
     //创建图像背景
            $this->createImage();
     //设置干扰元素
           $this->setDisturbColor();
     //向图像中随机画出文本
     $this->outputText($fontFace);
     //输出图像
     $this->outputImage();
    }

    function __destruct()
    {
     imagedestroy($this->image);
    }
   }
   function checklogin(){
        if(empty($_POST['name']))
                die( '用户名不能为空');
    if(empty($_POST['password']))
     die("密码不能为空");
    if($_SESSION['code']!=$_POST['vertify'])
     die("验证码输入不正确".$_SESSION['code']);
  
    $username=$_POST['name'];
    $password=md5($_POST['password']);
    //检查是否存在
         conndb($username,$password);
   }
   function conndb($name="",$ps=""){
        $conn=mysql_connect('localhost','root','123456');
       if(!$conn) die("数据库连接失败".mysql_error());
     mysql_select_db('5kan',$conn) or die('选择数据库失败'.mysql_error());
  mysql_set_charset('utf8',$conn);
  $sql="select id from k_user where  username='{$name}' and password='{$ps}'";
  $result=mysql_query($sql) or die("SQL语句错误".mysql_error());
  if(mysql_num_rows($result)>0)  die("登录成功");
  else  die("用户名或者密码错误");
  mysql_close($conn);
   }
    session_start();
   if(!isset($_POST['randnum']))
   {
     $code=new ValidationCode(120,20,4);
     $code->showImage("comicbd.ttf");  //显示在页面
  $_SESSION['code']=$code->getCheckCode();//保存在服务器中
   }
   else
   {
    checklogin();
   }

?>

<?php
session_start();
session_register(‘check’);
$_SESSION[‘check’]=true;
?>

<?php

session_start();
$refs = parse_url($_SERVER['HTTP_REFERER']); //分解参考网页资讯
//检查首页session及来源主机是否相同
if(!($_SESSION['check']) || $refs['host'] != $_SERVER['HTTP_HOST'])
exit;

?>

SetEnvIfNoCase Referer "^" local_ref=1
<FilesMatch ".(gif|jpg)">
Order Allow,Deny
Allow from env=local_ref
</FilesMatch>

[ISAPI_Rewrite]
# 3600 = 1 hour
CacheClockRate 3600
RepeatLimit 32
# Protect httpd.ini and httpd.parse.errors files
# from accessing through HTTP
RewriteCond Host: (.+)
RewriteCond Referer: (?!http://1.*).*
RewriteRule .*.(?:gif|jpg|png|bmp) /force.gif [I,O]

/* PHP中用strpos函数过滤关键字 */
// 关键字过滤函数
function keyWordCheck($content){
// 去除空白
$content = trim($content);
// 读取关键字文本
$content = @file_get_contents('keyWords.txt');
// 转换成数组
$arr = explode("n", $content);
// 遍历检测
for($i=0,$k=count($arr);$i<$k;$i++){
// 如果此数组元素为空则跳过此次循环
if($arr[$i]==''){
continue;
}
// 如果检测到关键字，则返回匹配的关键字,并终止运行
if(@strpos($str,trim($arr[$i]))!==false){
//$i=$k;
return $arr[$i];
}
}
// 如果没有检测到关键字则返回false
return false;
}
$content = '这里是要发布的文本内容。。。';
// 过滤关键字
$keyWord = keyWordCheck($content);
// 判断是否存在关键字
if($keyWord){
echo '你发布的内容存在关键字'.$keyWord;
}else{
echo '恭喜！通过关键字检测';
// 往下可以进行写库操作完成发布动作。
}

/**
 * 被禁止的关键字检测
 *
 * @param string $string  要检测的字符串
 * @param string $fileName 屏蔽关键字文件
 * @return bool
 */
function banwordCheck( $string, $fileName )
{
 if ( !($words = file_get_contents( $fileName )) ){
  die('file read error!');
 }
 $string = strtolower($string);
 $matched = preg_match('/'.$words.'/i', $string, $result);
 if ( $matched && isset($result[0]) && strlen($result[0]) > 0 )
 {
  if ( strlen($result[0]) == 2 ){
   $matched = preg_match('/'.$words.'/iu', $string, $result);
  } 
  if ( $matched && isset($result[0]) && strlen($result[0]) > 0 ) {
   return true;
  }else{
   return false;
  }  
 }else{
  return false;
 }
}

$content = '测试关键字';
if ( banwordCheck($content, './banwords.txt') ){
 echo "matched! ";
}else{
 echo "no match! ";
}

<?php
class sqlsafe {
 private $getfilter = "'|(and|or)\b.+?(>|<|=|in|like)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)";
 private $postfilter = "\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)";
 private $cookiefilter = "\b(and|or)\b.{1,6}?(=|>|<|\bin\b|\blike\b)|\/\*.+?\*\/|<\s*script\b|\bEXEC\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\s+(TABLE|DATABASE)";
 /**
  * 构造函数
  */
 public function __construct() {
  foreach($_GET as $key=>$value){$this->stopattack($key,$value,$this->getfilter);}
  foreach($_POST as $key=>$value){$this->stopattack($key,$value,$this->postfilter);}
  foreach($_COOKIE as $key=>$value){$this->stopattack($key,$value,$this->cookiefilter);}
 }
 /**
  * 参数检查并写日志
  */
 public function stopattack($StrFiltKey, $StrFiltValue, $ArrFiltReq){
  if(is_array($StrFiltValue))$StrFiltValue = implode($StrFiltValue);
  if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue) == 1){  
   $this->writeslog($_SERVER["REMOTE_ADDR"]."    ".strftime("%Y-%m-%d %H:%M:%S")."    ".$_SERVER["PHP_SELF"]."    ".$_SERVER["REQUEST_METHOD"]."    ".$StrFiltKey."    ".$StrFiltValue);
   showmsg('您提交的参数非法,系统已记录您的本次操作！','',0,1);
  }
 }
 /**
  * SQL注入日志
  */
 public function writeslog($log){
  $log_path = CACHE_PATH.'logs'.DIRECTORY_SEPARATOR.'sql_log.txt';
  $ts = fopen($log_path,"a+");
  fputs($ts,$log."rn");
  fclose($ts);
 }
}
?>