php安全获取变量
<?php///////////////////////////////////////////////////////////////////////////////
//
// 张树林 - 慧佳工作室
//
// Module Name: init_safe.php
// Abstract: 设置系统安全处理
// Version: 1.0
// Date 2005-06-11
// Author: woods·zhang
// Email: hoojar@163.com
// MSN: hoojar@hotmail.com
//website http://www.hoojar.com/
// Copyright 2001-2006, Hoojar studio All Rights Reserved
//
// 版权 2001-2006，慧佳工作室所有版权保护
//The software for free software, allowing use, copy,
//modify and distribute the software and files. Any
//use of this software must place a copy of all the
//above copyright notice. By the software Huijia studio
//maintenance, if you have any queries please contact us.
//Thank you.
//
//此软件为自由软件，允许使用、拷贝、修改、分发本软件及其文档。
//任何使用此软件的地方都得出现以上版权通告所有副本。此软件由
//慧佳工作室维护，如果您有什么疑问请与我们联系。谢谢使用。
//
///////////////////////////////////////////////////////////////////////////////
/*________________________禁止数据来源于其他主机_________________begin________________________*/
function data_is_from_ours_host()//数据是否来源于我们的主机
{
$HTTP_URL = (isset($_SERVER['HTTP_REFERER'])) ? $_SERVER['HTTP_REFERER'] : "";
if ($HTTP_URL)
{
$HTTP_URL = substr($HTTP_URL, strpos($HTTP_URL, "//") + 2);
$HTTP_URL = substr($HTTP_URL, 0, strpos($HTTP_URL, "/"));
$long_ip = ip2long($HTTP_URL);
if ($long_ip == -1 || FALSE === $long_ip)
{
$ahost = explode(".", $HTTP_URL);
$HTTP_URL = (count($ahost) > 2) ? "{$ahost[1]}.{$ahost[2]}" : $HTTP_URL;
$host_name = $_SERVER["HTTP_HOST"];
$ahost = explode(".", $host_name);
$host_name = (count($ahost) > 2) ? "{$ahost[1]}.{$ahost[2]}" : $host_name;
if ($host_name != $HTTP_URL){return false;}
}
else
{
if ($_SERVER["SERVER_ADDR"] != $HTTP_URL){return false;}
}
return true;
}
return false;
}
/*________________________禁止数据来源于其他主机_________________end________________________*/
//set_error_handler('my_error_handler');
function my_error_handler($number, $string, $file, $line, $context)
{
$error = "= == == == ==\nPHP ERROR\n= == == == ==\n";
$error .= "Number: [$number]\n";
$error .= "String: [$string]\n";
$error .= "File: [$file]\n";
$error .= "Line: [$line]\n";
$error .= "Context:\n" . print_r($context, TRUE) . "\n\n";
error_log($error, 3, $GLOBALS["err_path"]);
}
/*___________________________系统的安全性处理_______________________end______________________*/
/*
function init_var($ob, $type = "string", $dtype = "gp")
$ob 为要取的数据名字
$type 为要取的是什么数据类型 (i, f, d, s, c, b, a)
$dtype 为是取外部变量还是Session cookie get post，或要取session变量则设置成s，取cookie则设置为c
*/
function init_var($ob, $type = "string", $dtype = "")//初始化变量，或分配数据
{
$type = strtolower($type);
$dtype = strtolower($dtype);
switch ($dtype)
{
case "session":
case "s":
$value = isset($_SESSION[$ob]) ? $_SESSION[$ob] : "";
break;
case "get":
case "g":
$value = isset($_GET[$ob]) ? $_GET[$ob] : "";
break;
case "post":
case "p":
$value = isset($_POST[$ob]) ? $_POST[$ob] : "";
break;
case "cookie":
case "c":
$value = isset($_COOKIE[$ob]) ? woods_decode($_COOKIE[$ob]) : "";
break;
default:
$value = isset($_REQUEST[$ob]) ? $_REQUEST[$ob] : "";
}
if ($type != "a" && $type != "array")$value = trim($value);
if ($value === 0 || $value === "0") return "0";
if ($value)
{
switch ($type)
{
case "string":
case "char":
case "s":
case "c":
$type = "string";
return (settype($value, $type)) ? $value: '';
case "float":
case 'f':
$type = "float";
return (settype($value, $type)) ? $value: 0;
case "double":
case 'd':
$type = "double";
return (settype($value, $type)) ? $value: 0;
case "int";
case "integer":
case 'i':
$type = "integer";
return (settype($value, $type)) ? $value: 0;
case "bool":
case "boolean":
case 'b':
$type = "boolean";
return (settype($value, $type)) ? $value: false;
case "array":
case 'a':
$type = "array";
return (settype($value, $type)) ? $value: array();
default:
return '';
}//end switch
}
else
{
switch ($type)
{
case "string":
case "char":
case "s":
case "c":
return "";
case "int";
case "integer":
case "float":
case "double":
case 'i':
case 'f':
case 'd':
return 0;
case "bool":
case "boolean":
case 'b':
return false;
case "array":
case 'a':
return array();
default:
return '';
}//end switch
}//end if
}
?> $_SERVER变量的内容是可以伪造的
再说如果真的那样了，会很不方便的，呵呵。 这也忒复杂了点吧，:L 感觉写的不错！ 想法是不错,但用在程序中的话就有点... 为了一个变量，整了这么长的代码。真:L :L 安全就是复杂.......没错...LZ强悍.支持.
页:
[1]