- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43
- 44
- 45
- 46
- 47
- 48
- 49
- 50
- 51
- 52
- 53
- 54
- 55
- 56
- 57
- 58
- 59
- 60
- 61
- 62
- 63
- 64
- 65
- 66
- 67
- 68
- 69
- 70
- 71
- 72
- 73
- 74
- 75
- 76
- 77
- 78
- 79
- 80
- 81
- 82
- 83
- 84
- 85
- 86
- 87
- 88
- 89
- 90
class SqlXssFilter {
private static $sql_keywords = array(
'ADD',
'ADD CONSTRAINT',
'ALTER',
'ALTER COLUMN',
'ALTER TABLE',
'ALL',
'AND',
'ANY',
'AS',
'ASC',
'BACKUP DATABASE',
'BETWEEN',
'CASE',
'CHECK',
'COLUMN'
'CONSTRAINT',
'CREATE',
'CREATE DATABASE',
'CREATE INDEX',
'CREATE OR REPLACE VIEW',
'CREATE TABLE',
'CREATE PROCEDURE',
'CREATE UNIQUE INDEX',
'CREATE VIEW',
'DATABASE',
'DEFAULT',
'DELETE',
'DESC',
'DISTINCT',
'DROP',
'DROP COLUMN',
'DROP CONSTRAINT',
'DROP DATABASE',
'DROP DEFAULT',
'DROP INDEX',
'DROP TABLE',
'DROP VIEW',
'EXEC',
'EXISTS',
'FOREIGN KEY',
'FROM',
'FULL OUTER JOIN',
'GROUP BY',
'HAVING',
'IN',
'INDEX',
'INNER JOIN',
'INSERT INTO',
'INSERT INTO SELECT',
'IS NULL',
'IS NOT NULL',
'JOIN',
'LEFT JOIN',
'LIKE',
'LIMIT',
'NOT',
'NOT NULL',
'OR',
'ORDER BY',
'OUTER JOIN',
'PRIMARY KEY',
'PROCEDURE',
'RIGHT JOIN',
'ROWNUM',
'SELECT',
'SELECT DISTINCT',
'SELECT INTO',
'SELECT TOP',
'SET',
'TABLE',
'TOP',
'TRUNCATE TABLE',
'UNION',
'UNION ALL',
'UNIQUE',
'UPDATE',
'VALUES',
'VIEW',
'WHERE'
);
// XSS and SQL-inject filter
public static function filterInputData(&$str) {
// remove html tags
$res = strip_tags($str);
$res = str_replace(self::sql_keywords, "", $str);
return $res;
}
}