<?
/**
*	获取GET参数
*/
foreach ($_GET as $key => $value) {
		$$key = checksql($value);
}
/**
*	获取POST参数
*/
foreach ($_POST as $key => $value) {
		$$key = checksql($value);
}
/**
*	防注入处理
*/
function checksql($str)
{
   $refuse_str=" and | or | select | update | from | where | order | \* | delete | \' | insert | join | values | create | table | database ";
   $arr=explode("|",$refuse_str);
   for($i=0;$i<count($arr);$i++)
   {
			$replace="[\\".$arr[$i]."]";
			$str=eregi_replace($arr[$i],$replace,$str);
   }
   $str = str_replace("\"","“",$str);
   $str = str_replace("\'","‘",$str);
   $str = str_replace("\:","：",$str);
   $str = str_replace("\;","；",$str);
   $str = str_replace("<","&lt;",$str);
   $str = str_replace(">","&gt;",$str);
   return $str;
}
?>