<?php
/*************************
说明：判断传递的变量中是否含有非法字符,如$_POST、$_GET
功能：防注入
**************************/
if(!defined('IN_SYS')){
	exit('Access Denied');
}
//要过滤的非法字符
$ArrFiltrate=array("'",";","`","%20","union","and","or","exec","execute","insert","select","delete","update","truncate","mid","master","declare","create","count","chr","into","load_file","outfile");

//出错后要跳转的url,不填则默认前一页
$StrJumpUrl="/";

//是否存在数组中的值
function FunStringExist($StrFiltrate,$ArrFiltrate){
	foreach ($ArrFiltrate as $key=>$value){
		if (preg_match("/".$value."/",$StrFiltrate)){
			return true;
		}
	}
	return false;
}

//合并$_POST 和 $_GET
if(function_exists(array_merge)){
$ArrPostAndGet=array_merge((array)$HTTP_POST_VARS,(array)$HTTP_GET_VARS);
}else{
foreach($HTTP_POST_VARS as $key=>$value){
$ArrPostAndGet[]=$value;
}
foreach($HTTP_GET_VARS as $key=>$value){
$ArrPostAndGet[]=$value;
}
}
//验证开始
foreach($ArrPostAndGet as $key=>$value){
	if (FunStringExist($value,$ArrFiltrate)){
		echo "<script type=\"text/javascript\">alert(\"Incorrect URL!\");</script>";
		if (empty($StrJumpUrl)){
			echo "<script type=\"text/javascript\">history.go(-1);</script>";
		}else{
			header("location: ".$StrJumpUrl."");
			exit();
		}
	exit;
	}
}