无夜游魂

特殊字符过滤

2017-01-12 15:30:36

特殊字符过滤:
法一:if(!preg_match('/^[w._]+$/',$username))
   {
         echo 0;
         exit();
   }
法二:
addslashes();//提交之前用这个
stripslashes();//输出用这个
htmlspecialchars(stripslashes());//编辑用这个
//htmlspecialchars("sfsdf",ENT_QUOTES);
法三:这是对提交到数据库的过滤，防止非法输入
$name = trim($_POST['cate_name']);
$name = preg_replace("/<.*?>/","",$name);//过滤到HTML代码,防静态注入
$name = trim($name);//去掉空格
if(!get_magic_quotes_gpc())
{
    $name = addslashes($name);
}
//输出
echo stripslashes($name);
//如果是编辑,edit
echo htmlspecialchars(stripslashes($name));

如果是单单去除HTML标签的话可以用
strip_tags(html_entity_decode($name));
如果$name没有转义过可以直接用strip_tags($name)就可以了

自己写个函数
function trimTags($string)
{
  $string=strip_tags($string);
  $string=str_replace(" ","",$string);
  $string=str_replace("
","",$string);
  $string=trim($string);
  return $string;
}
file_get_contents("1.txt",data,FILE_APPEND)
提示：使用 FILE_APPEND 可避免删除文件中已有的内容。

注释：本函数可安全用于二进制对象。

过滤特殊字符
function tri_espec_num($item)
{
 $item = trim($item);
 $item = urldecode($item);//对网页的路径进行解码
 $item = strip_tags($item);
 $item = preg_replace("/]*?>.*?/",'',$item);//过滤sript 标签段
 $item = preg_replace("/-/","",$item);
 $item = preg_replace("/*/","",$item);
 $item = preg_replace("/+/","",$item);
 $item = preg_replace("/^/","",$item);
 $item = preg_replace("/~/","",$item);
 $item = preg_replace("/`/","",$item);
 $item = preg_replace("/%/","",$item);
 $item = preg_replace("/\$/","",$item);
 $item = preg_replace("///","",$item);
 $item = preg_replace("/&/","",$item);
 $item = preg_replace("/#/","",$item);
 $item = preg_replace("/@/","",$item);
 $item = preg_replace("/  $item = preg_replace("/>/","",$item);
 $item = preg_replace("/?/","",$item);
 $item = preg_replace("/'/","",$item);
 $item = preg_replace("/(/","",$item);
 $item = preg_replace("/)/","",$item);
 $item = preg_replace("/!/","",$item);
 $item = preg_replace("/./","",$item);
 return $item;
}

过滤文本信息中非法输入一些标签，如script,
还有垃圾邮件信息
function StripHtmlCode($str)
 {
  $search = array ("']*?>.*?'si",  // 去掉 javascript
                 "'<[/!]*?[^<>]*?>'si",           // 去掉 HTML 标记
                 "'([ ])[s]+'",                 // 去掉空白字符
                 "'&(quot|#34);'i",                 // 替换 HTML 实体
                 "'&(amp|#38);'i",
                 "'&(lt|#60);'i",
                 "'&(gt|#62);'i",
                 "'&(nbsp|#160);'i",
                 "'&(iexcl|#161);'i",
                 "'&(cent|#162);'i",
                 "'&(pound|#163);'i",
                 "'&(copy|#169);'i",
                 "'&#(d+);'e",
                 );                    // 作为 PHP 代码运行

  $replace = array ("",
                  "",
                  "\1",
                  """,
                  "&",
                  "<",
                  ">",
                  " ",
                  chr(161),
                  chr(162),
                  chr(163),
                  chr(169),
                  "chr(\1)",
                  );
  $text = preg_replace ($search, $replace, $str);
  $text= preg_replace('/(.*?)<\/a>/i', '$2', $text);//单独去掉A标签
  $text = preg_replace('/[.*?]/i', '$2', $text);//单独去除[url=http://ddd]ddd[/url][link=http://ddd]ddd[/link]