$str=preg_replace("/<[ ]+/si","<",$str)//过滤<__("<"号后面带空格)
$str=preg_replace("/<\!--.*?-->/si","",$str)//注释
$str=preg_replace("/<(\!.*?)>/si","",$str)//过滤DOCTYPE
$str=preg_replace("/<(\/?html.*?)>/si","",$str)//过滤html标签
$str=preg_replace("/<(\/?head.*?)>/si","",$str)//过滤head标签
$str=preg_replace("/<(\/?meta.*?)>/si","",$str)//过滤meta标签
$str=preg_replace("/<(\/?body.*?)>/si","",$str)//过滤body标签
$str=preg_replace("/<(\/?link.*?)>/si","",$str)//过滤link标签
$str=preg_replace("/<(\/?form.*?)>/si","",$str)//过滤form标签
$str=preg_replace("/cookie/si","COOKIE",$str)//过滤COOKIE标签
$str=preg_replace("/<(applet.*?)>(.*?)<(\/applet.*?)>/si","",$str)//过滤applet标签
$str=preg_replace("/<(\/?applet.*?)>/si","",$str)//过滤applet标签
$str=preg_replace("/<(style.*?)>(.*?)<(\/style.*?)>/si","",$str)//过滤style标签
$str=preg_replace("/<(\/?style.*?)>/si","",$str)//过滤style标签
$str=preg_replace("/<(title.*?)>(.*?)<(\/title.*?)>/si","",$str)//过滤title标签
$str=preg_replace("/<(\/?title.*?)>/si","",$str)//过滤title标签
$str=preg_replace("/<(object.*?)>(.*?)<(\/object.*?)>/si","",$str)//过滤object标签
$str=preg_replace("/<(\/?objec.*?)>/si","",$str)//过滤object标签
$str=preg_replace("/<(noframes.*?)>(.*?)<(\/noframes.*?)>/si","",$str)//过滤noframes标签
$str=preg_replace("/<(\/?noframes.*?)>/si","",$str)//过滤noframes标签
$str=preg_replace("/<(i?frame.*?)>(.*?)<(\/i?frame.*?)>/si","",$str)//过滤frame标签
$str=preg_replace("/<(\/?i?frame.*?)>/si","",$str)//过滤frame标签
$str=preg_replace("/<(script.*?)>(.*?)<(\/script.*?)>/si","",$str)//过滤script标签
$str=preg_replace("/<(\/?script.*?)>/si","",$str)//过滤script标签
$str=preg_replace("/javascript/si","Javascript",$str)//过滤script标签
$str=preg_replace("/vbscript/si","Vbscript",$str)//过滤script标签
$str=preg_replace("/on([a-z]+)\s*=/si","On\\1=",$str)//过滤script标签
$str=preg_replace("//si","&＃",$str)//过滤script标签，如javAsCript:alert(
清除空格，换行
function DeleteHtml($str)
{
$str = trim($str)
$str = strip_tags($str,"")
$str = ereg_replace("\t","",$str)
$str = ereg_replace("\r\n","",$str)
$str = ereg_replace("\r","",$str)
$str = ereg_replace("\n","",$str)
$str = ereg_replace(" "," ",$str)
return trim($str)
}
过滤HTML属性
1，过滤所有html标签的正则表达式：
复制代码 代码如下:
</?[^>]+>
//过滤所有html标签的属性的正则表达式：
$html = preg_replace("/<([a-zA-Z]+)[^>]*>/","<\\1>",$html)
3，过滤部分html标签的正则表达式的排除式（比如排除<p>，即不过滤<p>）：
复制代码 代码如下:
</?[^pP/>]+>
4，过滤部分html标签的正则表达式的枚举式（比如需要过滤<a><p><b>等）：
复制代码 代码如下:
</?[aApPbB][^>]*>
5，过滤部分html标签的属性的正则表达式的排除式（比如排除alt属性，即不过滤alt属性）：
复制代码 代码如下:
\s(?!alt)[a-zA-Z]+=[^\s]*
6，过滤部分html标签的属性的正则表达式的枚举式（比如alt属性）：
复制代码 代码如下:
(\s)alt=[^\s]*
<b>asasasas</b>这个html标签是加粗标签，如果你想在浏览器上显示的是加粗的asasasas就直接输出<?php
echo "<b>asasasas</b>"
?>
如果你想输出的<b>asasasas</b>这个字符串的话呢
<?php
echo htmlspecialchars("<b>asasasas</b>")
?>
//php 批量过滤post,get敏感数据if (get_magic_quotes_gpc()) {
$_GET = stripslashes_array($_GET)
$_POST = stripslashes_array($_POST)
}
function stripslashes_array(&$array) {
while(list($key,$var) = each($array)) {
if ($key != 'argc' && $key != 'argv' && (strtoupper($key) != $key || ''.intval($key) == "$key")) {
if (is_string($var)) {
$array[$key] = stripslashes($var)
}
if (is_array($var)) {
$array[$key] = stripslashes_array($var)
}
}
}
return $array
}
//--------------------------
// 替换HTML尾标签,为过滤服务
//--------------------------
function lib_replace_end_tag($str)
{
if (empty($str)) return false
$str = htmlspecialchars($str)
$str = str_replace( '/', "", $str)
$str = str_replace("\\", "", $str)
$str = str_replace(">", "", $str)
$str = str_replace("<", "", $str)
$str = str_replace("<SCRIPT>", "", $str)
$str = str_replace("</SCRIPT>", "", $str)
$str = str_replace("<script>", "", $str)
$str = str_replace("</script>", "", $str)
$str=str_replace("select","select",$str)
$str=str_replace("join","join",$str)
$str=str_replace("union","union",$str)
$str=str_replace("where","where",$str)
$str=str_replace("insert","insert",$str)
$str=str_replace("delete","delete",$str)
$str=str_replace("update","update",$str)
$str=str_replace("like","like",$str)
$str=str_replace("drop","drop",$str)
$str=str_replace("create","create",$str)
$str=str_replace("modify","modify",$str)
$str=str_replace("rename","rename",$str)
$str=str_replace("alter","alter",$str)
$str=str_replace("cas","cast",$str)
$str=str_replace("&","&",$str)
$str=str_replace(">",">",$str)
$str=str_replace("<","<",$str)
$str=str_replace(" ",chr(32),$str)
$str=str_replace(" ",chr(9),$str)
$str=str_replace(" ",chr(9),$str)
$str=str_replace("&",chr(34),$str)
$str=str_replace("'",chr(39),$str)
$str=str_replace("<br />",chr(13),$str)
$str=str_replace("''","'",$str)
$str=str_replace("css","'",$str)
$str=str_replace("CSS","'",$str)
return $str
}
