<?php
function inject_check($sql_str){
$check=eregi('select|insert|update|delete|and|\'|\/\*|\*|\.\.\/|union|into|load_file|outfile',$sql_str); //进行过滤
if($check){
	echo "对不起，你输入的内容不正确，请返回后再操作！<a href='index.php'>网站首页</a>";
	exit();
   }else{
   	return $sql_str;
   } 
}
$_GET['id']=inject_check($_GET['id']);
$_GET['cid']=inject_check($_GET['cid']);
?>