<?php
/*************************

说明：

判断传递的变量中是否含有非法字符

如$_POST、$_GET

功能：

防注入

**************************/

//要过滤的非法字符

$ArrFiltrate=array("'",";","union","=",";","union","=","and","from","WHERE","where","AND","FROM","INSERT","insert","UPDATE","update",'"',"write","-","<",">","%");

//出错后要跳转的url,不填则默认前一页

$StrGoUrl="";

//是否存在数组中的值

function FunStringExist($StrFiltrate,$ArrFiltrate){

foreach ($ArrFiltrate as $key=>$value){

if (eregi($value,$StrFiltrate)){

return true;

}

}

return false;

}

//合并$_POST 和 $_GET

if(function_exists(array_merge)){

$ArrPostAndGet=array_merge($HTTP_POST_VARS,$HTTP_GET_VARS);

}else{

foreach($HTTP_POST_VARS as $key=>$value){

$ArrPostAndGet[]=$value;

}

foreach($HTTP_GET_VARS as $key=>$value){

$ArrPostAndGet[]=$value;

}

}

//验证开始

foreach($ArrPostAndGet as $key=>$value){

if (FunStringExist($value,$ArrFiltrate)){

echo "<script>alert('发现非法字符".$value.$ArrFiltrate.",开发QQ 843848283')</script>";

if (empty($StrGoUrl)){

//echo "<script. language=/"javascript/">history.go(-1);</script>";

}else{

//echo "<script. language=/"javascript/">window.location=/"".$StrGoUrl."/";</script>";

}

exit;

}

}

?>
<?php
class mysqlclass {
	var $db_id;
	var $querynum = 0;

	function connect($dbhost, $dbuser, $dbpw, $dbname, $pconnect = 0) {
		if($pconnect) {
			if(!$this->db_id=@mysql_pconnect($dbhost, $dbuser, $dbpw)) {
				$this->mysql_errormsg('Can not connect to MySQL server');
			}
		} else {
			if(!$this->db_id=@mysql_connect($dbhost, $dbuser, $dbpw)) {
				$this->mysql_errormsg('Can not connect to MySQL server');
			}
		}
		@mysql_query("set names 'gbk'");
@mysql_query('set character_set_client = gbk');
@mysql_query('set character_set_connection = gbk');
@mysql_query('set character_set_results = gbk');
		@mysql_select_db($dbname);
	}

	function select_db($dbname) {
		return @mysql_select_db($dbname,$this->db_id);
	}

	function query($sql) {		
		if(!($query = @mysql_query($sql,$this->db_id))) {
				$this->mysql_errormsg('MySQL Query Error', $sql);
			}		
		$this->querynum++;		
		return $query;
	}
	
	function fetch_array($query, $result_type = MYSQL_ASSOC) {
		return @mysql_fetch_array($query, $result_type);
	}

	function fetch_row($query) {
		$query = @mysql_fetch_row($query);
		return $query;
	}
	
	function num_rows($query) {
		$query = @mysql_num_rows($query);
		return $query;
	}

	function insert_id() {
		$id = @mysql_insert_id();
		return $id;
	}
	
	function free_result($query) {
		return @mysql_free_result($query);
	}
	
	function close() {
		return @mysql_close();
	}
	
	function mysql_errormsg($message = '', $sql = '') {
		echo $message."<br>".$sql."<br>";
		echo $this->errno()." ".$this->error();
		exit;
	}

	function affected_rows() {
		return @mysql_affected_rows();
		//		传回最后查询为INSERT、UPDATE或DELETE所影响的列数目		
	}

	function error() {
		return @mysql_error();
		//从先前MySQL操作传回错误讯息
	}

	function errno() {
		return @intval(mysql_errno());
		//从先前MySQL操作传回错误讯息代号
	}

	function result($query, $row) {
		$query = @mysql_result($query, $row);
		return $query;
		//从MySQL结果传回一格(cell)的内容,效率低.
	}

	function num_fields($query) {
		return @mysql_num_fields($query);
		//传回结果中栏位的数目
	}	
}


$dbhost="sql103.ifastnet.com";
$dbuser="if_4527653"; 
$dbpw="6928233";
$dbname="if_4527653_w745";
//$表前缀="t1_"; 

$db = new mysqlclass;
$db->connect($dbhost,$dbuser,$dbpw,$dbname);
//$db->select_db($dbname);
unset($dbhost, $dbuser, $dbpw, $dbname, $pconnect);




?>