PHP防止跨站攻击的脚本

直接把该文件放置到入口文件中即可防止对应的跨站攻击

<?php
//防止跨站攻击脚本
$referer=empty($_SERVER['HTTP_REFERER']) ? array() : array($_SERVER['HTTP_REFERER']);
function customError($errno, $errstr, $errfile, $errline)
{ 
    echo "<b>Error number:</b> [$errno],error on line $errline in $errfile<br />";
    die();
}
set_error_handler("customError",E_ERROR);

$getfilter="'|<[^>]*?>|^\\+\/v(8|9)|\\b(and|or)\\b.+?(>|<|=|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$postfilter="^\\+\/v(8|9)|\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|<\\s*img\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
$cookiefilter="\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)";
function StopAttack($StrFiltKey,$StrFiltValue,$ArrFiltReq){  

    $StrFiltValue=arr_foreach($StrFiltValue);
    if (preg_match("/".$ArrFiltReq."/is",$StrFiltValue)==1){   
            refreshto("http://www.qp1001.com","您的提交带有不合法参数,谢谢合作!");
            exit();
    }
    if (preg_match("/".$ArrFiltReq."/is",$StrFiltKey)==1){   
            refreshto("http://www.qp1001.com","您的提交带有不合法参数,谢谢合作!");
            exit();
    }  
} 

foreach($_GET as $key=>$value){ 
    StopAttack($key,$value,$getfilter);
}
foreach($_POST as $key=>$value){ 
    StopAttack($key,$value,$postfilter);
}
foreach($_COOKIE as $key=>$value){ 
    StopAttack($key,$value,$cookiefilter);
}
foreach($referer as $key=>$value){ 
    StopAttack($key,$value,$getfilter);
}

function arr_foreach($arr) {
    static $str;
    if (!is_array($arr)) {
    return $arr;
    }
    foreach ($arr as $key => $val ) {

    if (is_array($val)) {
        arr_foreach($val);
    } else {

      $str[] = $val;
    }
    }
    return implode($str);
}
?>