PHP 输入流 php://input使用说明(1/2)

<?php
/**
* php AES加解密类
* 因为java只支持128位加密，所以php也用128位加密，可以与java互转。
* 同时AES的标准也是128位。只是RIJNDAEL算法可以支持128，192和256位加密。
*
* @author Terry
*
*/
class PhpAes
{
/**
* This was AES-128 / CBC / ZeroBytePadding encrypted.
* return base64_encode string
* @author Terry
* @param string $plaintext
* @param string $key
*/
public static function AesEncrypt($plaintext,$key = null)
{
if ($plaintext == '') return '';
if(!extension_loaded('mcrypt'))
throw new CException(Yii::t('yii','AesEncrypt requires PHP mcrypt extension to be loaded in order to use data encryption feature.'));
$size = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC);
$plaintext = self::PKCS5Padding($plaintext, $size);
$module = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
$key=self::substr($key===null ? Yii::app()->params['encryptKey'] : $key, 0, mcrypt_enc_get_key_size($module));
/* Create the IV and determine the keysize length, use MCRYPT_RAND
* on Windows instead */
$iv = substr(md5($key),0,mcrypt_enc_get_iv_size($module));
/* Intialize encryption */
mcrypt_generic_init($module, $key, $iv);

/* Encrypt data */
$encrypted = mcrypt_generic($module, $plaintext);

/* Terminate encryption handler */
mcrypt_generic_deinit($module);
mcrypt_module_close($module);
return base64_encode(trim($encrypted));
}

/**
* This was AES-128 / CBC / ZeroBytePadding decrypted.
* @author Terry
* @param string $encrypted base64_encode encrypted string
* @param string $key
* @throws CException
* @return string
*/
public static function AesDecrypt($encrypted, $key = null)
{
if ($encrypted == '') return '';
if(!extension_loaded('mcrypt'))
throw new CException(Yii::t('yii','AesDecrypt requires PHP mcrypt extension to be loaded in order to use data encryption feature.'));

$ciphertext_dec = base64_decode($encrypted);
$module = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_CBC, '');
$key=self::substr($key===null ? Yii::app()->params['encryptKey'] : $key, 0, mcrypt_enc_get_key_size($module));

$iv = substr(md5($key),0,mcrypt_enc_get_iv_size($module));

/* Initialize encryption module for decryption */
mcrypt_generic_init($module, $key, $iv);

/* Decrypt encrypted string */
$decrypted = mdecrypt_generic($module, $ciphertext_dec);

/* Terminate decryption handle and close module */
mcrypt_generic_deinit($module);
mcrypt_module_close($module);
return self::UnPKCS5Padding($decrypted);
}

private static function strlen($string)
{
return extension_loaded('mbstring') ? mb_strlen($string,'8bit') : strlen($string);
}

private static function substr($string,$start,$length)
{
return extension_loaded('mbstring') ? mb_substr($string,$start,$length,'8bit') : substr($string,$start,$length);
}

private static function PKCS5Padding ($text, $blocksize) {
$pad = $blocksize - (self::strlen($text) % $blocksize);
return $text . str_repeat(chr($pad), $pad);
}

private static function UnPKCS5Padding($text)
{
$pad = ord($text{self::strlen($text)-1});
if ($pad > self::strlen($text)) return false;
if (strspn($text, chr($pad), self::strlen($text) - $pad) != $pad) return false;
return substr($text, 0, -1 * $pad);
}
}

<?php
require_once('./AES.php');
//$aes = new AES();
$aes = new AES(true);// 把加密后的字符串按十六进制进行存储
//$aes = new AES(true,true);// 带有调试信息且加密字符串按十六进制存储
$key = "this is a 32 byte key";// 密钥
$keys = $aes->makeKey($key);
$encode = "123456";// 被加密的字符串
$ct = $aes->encryptString($encode, $keys);
echo "encode = ".$ct."<br>";
$cpt = $aes->decryptString($ct, $keys);
echo "decode = ".$cpt;
?>

function uhtml($str) 
{ 
    $farr = array( 
        "/s+/", //过滤多余空白 
         //过滤 <script>等可能引入恶意内容或恶意改变显示布局的代码,如果不需要插入flash等,还

可以加入<object>的过滤 
        "/<(/?)(script|i?frame|style|html|body|title|link|meta|?|%)([^>]*?)>/isU",
        "/(<[^>]*)on[a-zA-Z]+s*=([^>]*>)/isU",//过滤javascript的on事件 
   ); 
   $tarr = array( 
        " ", 
        "＜123＞",//如果要直接清除不安全的标签，这里可以留空 
        "12", 
   ); 
  $str = preg_replace( $farr,$tarr,$str); 
   return $str; 
}

//get post data
 function PostGet($str,$post=0)
 {
  empty($str)?die('para is null'.$str.'!'):'';
  
  if( $post )
  {
   if( get_magic_quotes_gpc() )
   {
    return htmlspecialchars(isset($_POST[$str])?$_POST

[$str]:'');
   }
   else
   {
    return addslashes(htmlspecialchars(isset($_POST[$str])?

$_POST[$str]:''));
   }
   
  }
  else
  {
   if( get_magic_quotes_gpc() )
   {
    return htmlspecialchars(isset($_GET[$str])?$_GET[$str]:''); 
   }
   else
   {
    return addslashes(htmlspecialchars(isset($_GET[$str])?

$_GET[$str]:'')); 
   }
  }
 }

//代理IP直接退出
empty($_SERVER['HTTP_VIA']) or exit('Access Denied');
//防止快速刷新
session_start();
$seconds = '3'; //时间段[秒]
$refresh = '5'; //刷新次数
//设置监控变量
$cur_time = time();
if(isset($_SESSION['last_time'])){
    $_SESSION['refresh_times'] += 1;
}else{
    $_SESSION['refresh_times'] = 1;
    $_SESSION['last_time'] = $cur_time;
}
//处理监控结果
if($cur_time - $_SESSION['last_time'] < $seconds){
    if($_SESSION['refresh_times'] >= $refresh){
        //跳转至攻击者服务器地址
        header(sprintf('Location:%s', 'http://127.0.0.1'));
        exit('Access Denied');
    }
}else{
    $_SESSION['refresh_times'] = 0;
    $_SESSION['last_time'] = $cur_time;
}

$P_S_T = $t_array[0] + $t_array[1];
$timestamp = time();

session_start();
$ll_nowtime = $timestamp ;
if (session_is_registered('ll_lasttime')){
$ll_lasttime = $_SESSION['ll_lasttime'];
$ll_times = $_SESSION['ll_times'] + 1;
$_SESSION['ll_times'] = $ll_times;
}else{
$ll_lasttime = $ll_nowtime;
$ll_times = 1;
$_SESSION['ll_times'] = $ll_times;
$_SESSION['ll_lasttime'] = $ll_lasttime;
}
if (($ll_nowtime - $ll_lasttime)<3){
if ($ll_times>=5){
header(sprintf("Location: %s",'http://127.0.0.1'));
exit;
}
}else{
$ll_times = 0;
$_SESSION['ll_lasttime'] = $ll_nowtime;
$_SESSION['ll_times'] = $ll_times;
}

<?php
/*
 * 防CC攻击郁闷到死，不死版。
 *
 * 如果每秒内网站刷新次数超过2次，延迟5秒后访问。
 */
 
$cc_min_nums = '1';                    //次，刷新次数
$cc_url_time = '5';                    //秒，延迟时间
//$cc_log = 'cc_log.txt';                //启用本行为记录日志
$cc_forward = 'http://localhost';    //释放到URL

//--------------------------------------------

//返回URL
$cc_uri = $_SERVER['REQUEST_URI']?$_SERVER['REQUEST_URI']:($_SERVER['PHP_SELF']?$_SERVER['PHP_SELF']:$_SERVER['SCRIPT_NAME']);
$site_url = 'http://'.$_SERVER ['HTTP_HOST'].$cc_uri;

//启用session
if( !isset( $_SESSION ) ) session_start();
$_SESSION["visiter"] = true;
if ($_SESSION["visiter"] <> true){
 echo "<script>setTimeout("window.location.href ='$cc_forward';", 1);</script>";
 //header("Location: ".$cc_forward);
 exit;
}

$timestamp = time();
$cc_nowtime = $timestamp ;
if (session_is_registered('cc_lasttime')){
 $cc_lasttime = $_SESSION['cc_lasttime'];
 $cc_times = $_SESSION['cc_times'] + 1;
 $_SESSION['cc_times'] = $cc_times;
}else{
 $cc_lasttime = $cc_nowtime;
 $cc_times = 1;
 $_SESSION['cc_times'] = $cc_times;
 $_SESSION['cc_lasttime'] = $cc_lasttime;
}

//获取真实IP
if (isset($_SERVER)){
 $real_ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}else{
 $real_ip = getenv("HTTP_X_FORWARDED_FOR");
}

//print_r($_SESSION);

//释放IP
if (($cc_nowtime - $cc_lasttime)<=0){
 if ($cc_times>=$cc_min_nums){       
 if(!empty($cc_log))    cc_log(get_ip(), $real_ip, $cc_log, $cc_uri);    //产生log
 echo "Wait please, try again later!<script>setTimeout("window.location.href ='$site_url';", 5000);</script>";
 //printf('您的刷新过快，请稍后。');
 //header("Location: ".$cc_forward);
 exit;
 }
}else{
 $cc_times = 0;
 $_SESSION['cc_lasttime'] = $cc_nowtime;
 $_SESSION['cc_times'] = $cc_times;
}

//记录cc日志
function cc_log($client_ip, $real_ip, $cc_log, $cc_uri){   
 $temp_time = date("Y-m-d H:i:s", time() + 3600*8);
 
 $temp_result = "[".$temp_time."] [client ".$client_ip."] ";   
 if($real_ip) $temp_result .= " [real ".$real_ip."] ";
 $temp_result .= $cc_uri . "rn";
 
 $handle = fopen ("$cc_log", "rb");
 $oldcontent = fread($handle,filesize("$cc_log"));
 fclose($handle);
 
 $newcontent = $temp_result . $oldcontent;
 $fhandle=fopen("$cc_log", "wb");
 fwrite($fhandle,$newcontent,strlen($newcontent));
 fclose($fhandle);
}

//获取在线IP
function get_ip() {
 global $_C;
 
 if(empty($_C['client_ip'])) {
 if(getenv('HTTP_CLIENT_IP') && strcasecmp(getenv('HTTP_CLIENT_IP'), 'unknown')) {
 $client_ip = getenv('HTTP_CLIENT_IP');
 } elseif(getenv('HTTP_X_FORWARDED_FOR') && strcasecmp(getenv('HTTP_X_FORWARDED_FOR'), 'unknown')) {
 $client_ip = getenv('HTTP_X_FORWARDED_FOR');
 } elseif(getenv('REMOTE_ADDR') && strcasecmp(getenv('REMOTE_ADDR'), 'unknown')) {
 $client_ip = getenv('REMOTE_ADDR');
 } elseif(isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], 'unknown')) {
 $client_ip = $_SERVER['REMOTE_ADDR'];
 }
 $_C['client_ip'] = $client_ip ? $client_ip : 'unknown';
 }
 return $_C['client_ip'];
}
?>

vim /etc/php.ini

disable_functions = exec,shell_exec,system,passthru,popen