静态PHP入侵,PHP伪静态与防注入

PHP伪静态&＃xff0c;主要是为了隐藏传递的参数名&＃xff1b;于网上搜索后整理伪静态四法

//伪静态方法一

// localhost/php100/test.php?id|1&＃64;action|2

$Php2Html_FileUrl &＃61; $_SERVER["REQUEST_URI"];

echo $Php2Html_FileUrl."
";// /php100/test.php?id|1&＃64;action|2

$Php2Html_UrlString &＃61; str_replace("?","",str_replace("/", "", strrchr(strrchr($Php2Html_FileUrl, "/"),"?")));

echo $Php2Html_UrlString."
";// id|1&＃64;action|2

$Php2Html_UrlQueryStrList &＃61; explode("&＃64;", $Php2Html_UrlString);

print_r($Php2Html_UrlQueryStrList);// Array ( [0] &＃61;> id|1 [1] &＃61;> action|2 )

echo "
";

foreach($Php2Html_UrlQueryStrList as $Php2Html_UrlQueryStr)

{

$Php2Html_TmpArray &＃61; explode("|", $Php2Html_UrlQueryStr);

print_r($Php2Html_TmpArray);// Array ( [0] &＃61;> id [1] &＃61;> 1 ) ; Array ( [0] &＃61;> action [1] &＃61;> 2 )

echo "
";

$_GET[$Php2Html_TmpArray[0]] &＃61; $Php2Html_TmpArray[1];

}

//echo &＃39;假静态&＃xff1a;$_GET变量
&＃39;;

print_r($_GET); // Array ( [id|1&＃64;action|2] &＃61;> [id] &＃61;> 1 [action] &＃61;> 2 )

echo "
";

echo "

echo $_GET[id]."
";// 1

echo $_GET[action];// 2

?>

//伪静态方法二

// localhost/php100/test.php/1/2

$filename &＃61; basename($_SERVER[&＃39;SCRIPT_NAME&＃39;]);

echo $_SERVER[&＃39;SCRIPT_NAME&＃39;]."
";// /php100/test.php

echo $filename."
";// test.php

if(strtolower($filename)&＃61;&＃61;&＃39;test.php&＃39;){

if(!empty($_GET[id])){

$id&＃61;intval($_GET[id]);

echo $id."
";

$action&＃61;intval($_GET[action]);

echo $action."
";

}else{

$nav&＃61;$_SERVER[&＃39;REQUEST_URI&＃39;];

echo "1:".$nav."
";// /php100/test.php/1/2

$script&＃61;$_SERVER[&＃39;SCRIPT_NAME&＃39;];

echo "2:".$script."
";// /php100/test.php

$nav&＃61;ereg_replace("^$script","",urldecode($nav));

echo $nav."
"; // /1/2

$vars&＃61;explode("/",$nav);

print_r($vars);// Array ( [0] &＃61;> [1] &＃61;> 1 [2] &＃61;> 2 )

echo "
";

$id&＃61;intval($vars[1]);

$action&＃61;intval($vars[2]);

}

echo $id.&＃39;&&＃39;.$action;

}

?>

//伪静态方法三

function mod_rewrite(){

global $_GET;

$nav&＃61;$_SERVER["REQUEST_URI"];

echo $nav."
";

$script_name&＃61;$_SERVER["SCRIPT_NAME"];

echo $script_name."
";

$nav&＃61;substr(ereg_replace("^$script_name","",urldecode($nav)),1);

echo $nav."
";

$nav&＃61;preg_replace("/^.ht(m){1}(l){0,1}$/","",$nav);//这句是去掉尾部的.html或.htm

echo $nav."
";

$vars &＃61; explode("/",$nav);

print_r($vars);

echo "
";

for($i&＃61;0;$i

$_GET["$vars[$i]"]&＃61;$vars[$i&＃43;1];

}

return $_GET;

}

mod_rewrite();

$year&＃61;$_GET["year"];//结果为&＃39;2006&＃39;

echo $year."
";

$action&＃61;$_GET["action"];//结果为&＃39;_add&＃39;

echo $action;

?>

//伪静态方法四

//利用server变量 取得PATH_INFO信息 该例中为 /1,100,8630.html   也就是执行脚本名后面的部分

if(&＃64;$path_info &＃61;$_SERVER["PATH_INFO"]){

//正则匹配一下参数

if(preg_match("/\/(\d&＃43;),(\d&＃43;),(\d&＃43;)\.html/si",$path_info,$arr_path)){

$gid     &＃61;intval($arr_path[1]); //取得值 1

$sid     &＃61;intval($arr_path[2]);   //取得值100

$softid   &＃61;intval($arr_path[3]);   //取得值8630

}else die("Path:Error!");

//相当于soft.php?gid&＃61;1&sid&＃61;100&softid&＃61;8630

}else die(&＃39;Path:Nothing!&＃39;);

?>

PHP防注入&＃xff0c;主要是为了防止恶意写入后台数据库&＃xff1b;

//防注入函数

function inject_check($sql_str){

$check&＃61;eregi(&＃39;select|insert|update|delete|\&＃39;|\/\*|\*|\.\.\/|\.\/|union|into|load_file

|outfile&＃39;, $sql_str);

if($check){

echo "输入非法内容";

exit();

}else{

return $sql_str;

}

}

//接收传递参数后进行转换

$_GET[type]&＃61;inject_check($_GET[type]);

//之后再使用转换后的参