PHP 操作MySQL类,有过滤函数

<?php$cfg_dbhost = '数据库连接地址';$cfg_dbname = '数据库名';$cfg_dbuser = '数据库用户';$cfg_dbpwd = '数据库用户密码';//如果没有前缀，则$cfg_dbprefix=''$cfg_dbprefix = '数据库表前缀';$cfg_db_language = 'utf8';class DedeSql {var $linkID;var $dbHost;var $dbUser;var $dbPwd;var $dbName;var $dbPrefix;var $result;var $queryString;var $parameters;var $isClose;var $safeCheck;//用外部定义的变量初始类，并连接数据库function __construct($pconnect = FALSE, $nconnect = TRUE) {$this->isClose = FALSE;$this->safeCheck = TRUE;if ($nconnect) {$this->Init ( $pconnect );}}function DedeSql($pconnect = FALSE, $nconnect = TRUE) {$this->__construct ( $pconnect, $nconnect );}function Init($pconnect = FALSE) {$this->linkID = 0;$this->queryString = '';$this->parameters = Array ();$this->dbHost = $GLOBALS ['cfg_dbhost'];$this->dbUser = $GLOBALS ['cfg_dbuser'];$this->dbPwd = $GLOBALS ['cfg_dbpwd'];$this->dbName = $GLOBALS ['cfg_dbname'];$this->dbPrefix = $GLOBALS ['cfg_dbprefix'];$this->result ["me"] = 0;$this->Open ( $pconnect );}//用指定参数初始数据库信息function SetSource($host, $username, $pwd, $dbname, $dbprefix = "dede_") {$this->dbHost = $host;$this->dbUser = $username;$this->dbPwd = $pwd;$this->dbName = $dbname;$this->dbPrefix = $dbprefix;$this->result ["me"] = 0;}function SelectDB($dbname) {mysql_select_db ( $dbname );}//设置SQL里的参数function SetParameter($key, $value) {$this->parameters [$key] = $value;}//连接数据库function Open($pconnect = FALSE) {global $dsql;//连接数据库if ($dsql && ! $dsql->isClose) {$this->linkID = $dsql->linkID;} else {$i = 0;while ( ! $this->linkID ) {if ($i > 100)break;if (! $pconnect) {$this->linkID = @mysql_connect ( $this->dbHost, $this->dbUser, $this->dbPwd );} else {$this->linkID = @mysql_pconnect ( $this->dbHost, $this->dbUser, $this->dbPwd );}$i ++;}//复制一个对象副本CopySQLPoint ( $this );}//处理错误，成功连接则选择数据库if (! $this->linkID) {$this->DisplayError ( "DedeCms错误警告：<font color='red'>连接数据库失败，可能数据库密码不对或数据库服务器出错！</font>" );exit ();}@mysql_select_db ( $this->dbName );$mysqlver = explode ( '.', $this->GetVersion () );$mysqlver = $mysqlver [0] . '.' . $mysqlver [1];if ($mysqlver > 4.0) {@mysql_query ( "SET NAMES '" . $GLOBALS ['cfg_db_language'] . "', character_set_client=binary, sql_mode='', interactive_timeout=3600 ;", $this->linkID );}return TRUE;}//为了防止采集等需要较长运行时间的程序超时，在运行这类程序时设置系统等待和交互时间function SetLongLink() {@mysql_query ( "SET interactive_timeout=3600, wait_timeout=3600 ;", $this->linkID );}//获得错误描述function GetError() {$str = mysql_error ();return $str;}//关闭数据库//mysql能自动管理非持久连接的连接池//实际上关闭并无意义并且容易出错，所以取消这函数function Close($isok = FALSE) {$this->FreeResultAll ();if ($isok) {@mysql_close ( $this->linkID );$this->isClose = TRUE;$GLOBALS ['dsql'] = NULL;}}//定期清理死连接function ClearErrLink() {}//关闭指定的数据库连接function CloseLink($dblink) {@mysql_close ( $dblink );}function Esc($_str) {if (version_compare ( phpversion (), '4.3.0', '>=' )) {return @mysql_real_escape_string ( $_str );} else {return @mysql_escape_string ( $_str );}}//执行一个不返回结果的SQL语句，如update,delete,insert等function ExecuteNoneQuery($sql = '') {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}if (! empty ( $sql )) {$this->SetQuery ( $sql );} else {return FALSE;}if (is_array ( $this->parameters )) {foreach ( $this->parameters as $key => $value ) {$this->queryString = str_replace ( "@" . $key, "'$value'", $this->queryString );}}//SQL语句安全检查if ($this->safeCheck)CheckSql ( $this->queryString, 'update' );return mysql_query ( $this->queryString, $this->linkID );}//执行一个返回影响记录条数的SQL语句，如update,delete,insert等function ExecuteNoneQuery2($sql = '') {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}if (! empty ( $sql )) {$this->SetQuery ( $sql );}if (is_array ( $this->parameters )) {foreach ( $this->parameters as $key => $value ) {$this->queryString = str_replace ( "@" . $key, "'$value'", $this->queryString );}}mysql_query ( $this->queryString, $this->linkID );return mysql_affected_rows ( $this->linkID );}function ExecNoneQuery($sql = '') {return $this->ExecuteNoneQuery ( $sql );}function GetFetchRow($id = 'me') {return @mysql_fetch_row ( $this->result [$id] );}function GetAffectedRows() {return mysql_affected_rows ( $this->linkID );}//执行一个带返回结果的SQL语句，如SELECT，SHOW等function Execute($id = "me", $sql = '') {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}if (! empty ( $sql )) {$this->SetQuery ( $sql );}//SQL语句安全检查if ($this->safeCheck) {CheckSql ( $this->queryString );}$t1 = ExecTime ();$this->result [$id] = mysql_query ( $this->queryString, $this->linkID );//$queryTime = ExecTime () - $t1;//查询性能测试//if ($queryTime > 0.05) {//echo $this->queryString . "--{$queryTime}<hr />/r/n";//}if (! empty ( $this->result [$id] ) && $this->result [$id] === FALSE) {$this->DisplayError ( mysql_error () . " <br />Error sql: <font color='red'>" . $this->queryString . "</font>" );}}function Query($id = "me", $sql = '') {$this->Execute ( $id, $sql );}//执行一个SQL语句,返回前一条记录或仅返回一条记录function GetOne($sql = '', $acctype = MYSQL_ASSOC) {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}if (! empty ( $sql )) {#preg_match(string $pattern,string subject) 返回匹配的结果：0 或 1，找到立即停止搜索#preg_match_all(string pattern,string subject) 返回匹配的结果：0 或 n，找到subject最后停止搜索if (! preg_match ( "/LIMIT/i", $sql ))$this->SetQuery ( preg_replace ( "/[,;]$/i", '', trim ( $sql ) ) . " LIMIT 0,1;" );else$this->SetQuery ( $sql );}$this->Execute ( "one" );$arr = $this->GetArray ( "one", $acctype );if (! is_array ( $arr )) {return '';} else {@mysql_free_result ( $this->result ["one"] );return ($arr);}}//执行一个不与任何表名有关的SQL语句,Create等function ExecuteSafeQuery($sql, $id = "me") {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}$this->result [$id] = @mysql_query ( $sql, $this->linkID );}//返回当前的一条记录并把游标移向下一记录// MYSQL_ASSOC、MYSQL_NUM、MYSQL_BOTHfunction GetArray($id = "me", $acctype = MYSQL_ASSOC) {if ($this->result [$id] == 0) {return FALSE;} else {return mysql_fetch_array ( $this->result [$id], $acctype );}}function GetObject($id = "me") {if ($this->result [$id] == 0) {return FALSE;} else {return mysql_fetch_object ( $this->result [$id] );}}// 检测是否存在某数据表function IsTable($tbname) {$prefix = "#@__";$tbname = str_replace ( $prefix, $this->dbPrefix, $tbname );if (mysql_num_rows ( @mysql_query ( "SHOW TABLES LIKE '" . $tbname . "'", $this->linkID ) )) {return TRUE;}return FALSE;}//获得MySql的版本号function GetVersion($isformat = TRUE) {global $dsql;if ($dsql->isClose) {$this->Open ( FALSE );$dsql->isClose = FALSE;}$rs = @mysql_query ( "SELECT VERSION();", $this->linkID );$row = @mysql_fetch_array ( $rs );$mysql_version = $row [0];@mysql_free_result ( $rs );if ($isformat) {$mysql_versions = explode ( ".", trim ( $mysql_version ) );$mysql_version = number_format ( $mysql_versions [0] . "." . $mysql_versions [1], 2 );}return $mysql_version;}//获取特定表的信息function GetTableFields($tbname, $id = "me") {$this->result [$id] = mysql_list_fields ( $this->dbName, $tbname, $this->linkID );}//获取字段详细信息function GetFieldObject($id = "me") {return mysql_fetch_field ( $this->result [$id] );}//获得查询的总记录数function GetTotalRow($id = "me") {if ($this->result [$id] == 0) {return - 1;} else {return mysql_num_rows ( $this->result [$id] );}}//获取上一步INSERT操作产生的IDfunction GetLastID() {//如果 AUTO_INCREMENT 的列的类型是 BIGINT，则 mysql_insert_id() 返回的值将不正确。//可以在 SQL 查询中用 MySQL 内部的 SQL 函数 LAST_INSERT_ID() 来替代。//$rs = mysql_query("Select LAST_INSERT_ID() as lid",$this->linkID);//$row = mysql_fetch_array($rs);//return $row["lid"];return mysql_insert_id ( $this->linkID );}//释放记录集占用的资源function FreeResult($id = "me") {@mysql_free_result ( $this->result [$id] );}function FreeResultAll() {if (! is_array ( $this->result )) {return '';}foreach ( $this->result as $kk => $vv ) {if ($vv) {@mysql_free_result ( $vv );}}}//设置SQL语句，会自动把SQL语句里的#@__替换为$this->dbPrefix(在配置文件中为$cfg_dbprefix),最后返回sql语句function SetQuery($sql) {$prefix = "#@__";#将数据库表 ‘#@__’ 符号换成 $this->dbPrefix 指定的内容$sql = str_replace ( $prefix, $this->dbPrefix, $sql );$this->queryString = $sql;}//调用SetQuery($sql)函数function SetSql($sql) {$this->SetQuery ( $sql );}//显示数据链接错误信息function DisplayError($msg) {$emsg = '';$emsg .= "<div><h3> Error Warning!</h3>/r/n";$emsg .= "<div><a href="http://www.rqjssb.com" mce_href="http://www.rqjssb.com" target='_blank' style="color:red" mce_style="color:red">Technical Support: http://www.rqjssb.com</a></div>";$emsg .= "<div style="line-helght:160%;font-size:14px;color:green" mce_style="line-helght:160%;font-size:14px;color:green">/r/n";$emsg .= "<div style="color:blue" mce_style="color:blue"><br />Error page: <font color='red'>" . $this->GetCurUrl () . "</font></div>/r/n";$emsg .= "<div>Error infos: {$msg}</div>/r/n";$emsg .= "<br /></div></div>/r/n";echo $emsg;$savemsg = 'Page: ' . $this->GetCurUrl () . "/r/nError: " . $msg;//保存MySql错误日志$fp = @fopen ( $errorTrackFile, 'a' );@fwrite ( $fp, '<' . '?php exit();' . "/r/n/*/r/n{$savemsg}/r/n*//r/n?" . ">/r/n" );@fclose ( $fp );}//获得当前的脚本网址function GetCurUrl() {if (! empty ( $_SERVER ["REQUEST_URI"] )) {$scriptName = $_SERVER ["REQUEST_URI"];$nowurl = $scriptName;} else {$scriptName = $_SERVER ["PHP_SELF"];if (empty ( $_SERVER ["QUERY_STRING"] )) {$nowurl = $scriptName;} else {$nowurl = $scriptName . "?" . $_SERVER ["QUERY_STRING"];}}return $nowurl;}}//复制一个对象副本function CopySQLPoint(&$ndsql) {$GLOBALS ['dsql'] = $ndsql;}//获得当前的脚本网址function GetCurUrl() {if (! empty ( $_SERVER ["REQUEST_URI"] )) {$scriptName = $_SERVER ["REQUEST_URI"];$nowurl = $scriptName;} else {$scriptName = $_SERVER ["PHP_SELF"];if (empty ( $_SERVER ["QUERY_STRING"] )) {$nowurl = $scriptName;} else {$nowurl = $scriptName . "?" . $_SERVER ["QUERY_STRING"];}}return $nowurl;}//获得当前的用户IP地址function GetIP() {if (! empty ( $_SERVER ["HTTP_CLIENT_IP"] )) {$cip = $_SERVER ["HTTP_CLIENT_IP"];} else if (! empty ( $_SERVER ["HTTP_X_FORWARDED_FOR"] )) {$cip = $_SERVER ["HTTP_X_FORWARDED_FOR"];} else if (! empty ( $_SERVER ["REMOTE_ADDR"] )) {$cip = $_SERVER ["REMOTE_ADDR"];} else {$cip = '';}preg_match ( "/[/d/.]{7,15}/", $cip, $cips );$cip = isset ( $cips [0] ) ? $cips [0] : 'unknown';unset ( $cips );return $cip;}function ExecTime() {$time = explode ( " ", microtime () );$usec = ( double ) $time [0];$sec = ( double ) $time [1];return $sec + $usec;}//SQL语句过滤程序，由80sec提供，这里作了适当的修改if (! function_exists ( 'CheckSql' )) {function CheckSql($db_string, $querytype = 'select') {global $cfg_cookie_encode;#echo $db_string;$clean = '';$error = '';$old_pos = 0;$pos = - 1;$log_file = DEDEINC . '/../data/' . md5 ( $cfg_cookie_encode ) . '_safe.txt';$userIP = GetIP ();$getUrl = GetCurUrl ();//如果是普通查询语句，直接过滤一些特殊语法if ($querytype == 'select') {$notallow1 = "[^0-9a-z@/._-]{1,}(union|sleep|benchmark|load_file|outfile)[^0-9a-z@/.-]{1,}";//$notallow2 = "--|//*";if (preg_match ( "/" . $notallow1 . "/", $db_string )) {fputs ( fopen ( $log_file, 'a+' ), "$userIP||$getUrl||$db_string||SelectBreak/r/n" );exit ( "<font size='5' color='red'>Safe Alert: Request Error step 1 !</font>" );}}//完整的SQL检查while ( TRUE ) {$pos = strpos ( $db_string, '/'', $pos + 1 );if ($pos === FALSE) {break;}$clean .= substr ( $db_string, $old_pos, $pos - $old_pos );while ( TRUE ) {$pos1 = strpos ( $db_string, '/'', $pos + 1 );$pos2 = strpos ( $db_string, '//', $pos + 1 );if ($pos1 === FALSE) {break;} elseif ($pos2 == FALSE || $pos2 > $pos1) {$pos = $pos1;break;}$pos = $pos2 + 1;}$clean .= '$s</span></font> </p>;$old_pos = $pos + 1;}$clean .= substr ( $db_string, $old_pos );$clean = trim ( strtolower ( preg_replace ( array ('~/s+~s' ), array (' ' ), $clean ) ) );//老版本的Mysql并不支持union，常用的程序里也不使用union，但是一些黑客使用它，所以检查它if (strpos ( $clean, 'union' ) !== FALSE && preg_match ( '~(^|[^a-z])union($|[^[a-z])~s', $clean ) != 0) {$fail = TRUE;$error = "union detect";} //发布版本的程序可能比较少包括--,#这样的注释，但是黑客经常使用它们elseif (strpos ( $clean, '/*' ) > 2 || strpos ( $clean, '--' ) !== FALSE || strpos ( $clean, '#' ) !== FALSE) {$fail = TRUE;$error = "comment detect";} //这些函数不会被使用，但是黑客会用它来操作文件，down掉数据库elseif (strpos ( $clean, 'sleep' ) !== FALSE && preg_match ( '~(^|[^a-z])sleep($|[^[a-z])~s', $clean ) != 0) {$fail = TRUE;$error = "slown down detect";} elseif (strpos ( $clean, 'benchmark' ) !== FALSE && preg_match ( '~(^|[^a-z])benchmark($|[^[a-z])~s', $clean ) != 0) {$fail = TRUE;$error = "slown down detect";} elseif (strpos ( $clean, 'load_file' ) !== FALSE && preg_match ( '~(^|[^a-z])load_file($|[^[a-z])~s', $clean ) != 0) {$fail = TRUE;$error = "file fun detect";} elseif (strpos ( $clean, 'into outfile' ) !== FALSE && preg_match ( '~(^|[^a-z])into/s+outfile($|[^[a-z])~s', $clean ) != 0) {$fail = TRUE;$error = "file fun detect";} //老版本的MYSQL不支持子查询，我们的程序里可能也用得少，但是黑客可以使用它来查询数据库敏感信息elseif (preg_match ( '~/([^)]*?select~s', $clean ) != 0) {$fail = TRUE;$error = "sub select detect";}if (! empty ( $fail )) {fputs ( fopen ( $log_file, 'a+' ), "$userIP||$getUrl||$db_string||$error/r/n" );exit ( "<font size='5' color='red'>Safe Alert: Request Error step 2!</font>" );} else {return $db_string;}}}?>