php防止恶意刷新与刷票实现代码

<?php
session_start();
$k=$_GET['k'];
$t=$_GET['t'];
$allowTime = 1800;//防刷新时间
$ip = get_client_ip();
$allowT = md5($ip.$k.$t);
if(!isset($_SESSION[$allowT]))
{
$refresh = true;
$_SESSION[$allowT] = time();
}elseif(time() - $_SESSION[$allowT]>$allowTime){
$refresh = true;
$_SESSION[$allowT] = time();
}else{
$refresh = false;
}
?>

if(isset($_POST))
{ 
if(变量不符合要求)
<script> history.go(-1); </script>
else
操作数据
...
if(操作完成)
header( "location: ".$_SERVER[ 'PHP_SELF ']);
}
<script language= "JavaScript ">
<!--
　javascript:window.history.forward(1);
//-->
</script>

<?php
$c_file="counter.txt"; //文件名赋值给变量
if(!file_exists($c_file)) //如果文件不存在的操作
{
$myfile=fopen($c_file,"w"); //创建文件
fwrite($myfile,"0"); //置入“0”
fclose($myfile); //关闭文件
}
$t_num=file($c_file); //把文件内容读入变量
if($_COOKIE["date"]!="date(Y年m月d日)") //判断COOKIE内容与当前日期是否一致
{
$t_num[0]++; //原始数据自增1
$myfile=fopen($c_file,"w"); //写入方式打开文件
fwrite($myfile,$t_num[0]); //写入新数值
fclose($myfile); //关闭文件
//重新将当前日期写入COOKIE并设定COOKIE的有效期为24小时
setcookie("date","date(Y年m月d日)",time()+60*60*24);
}
?>

<?php      
    function post_check($post)    
    {    
    if (!get_magic_quotes_gpc()) // 判断magic_quotes_gpc是否为打开    
    {    
    $post = addslashes($post); // 进行magic_quotes_gpc没有打开的情况对提交数据的过滤    
    }    
    $post = str_replace("_", "_", $post); // 把 '_'过滤掉    
    $post = str_replace("%", "%", $post); // 把' % '过滤掉    
    $post = nl2br($post); // 回车转换    
    $post= htmlspecialchars($post); // html标记转换        
    return $post;    
    }    
    ?>

或

 <?php          
    function inject_check($sql_str)    
    {    
    return eregi('select|insert|update|delete|'|    
    function verify_id($id=null)    
    {    
    if (!$id) { exit('没有提交参数！'); } // 是否为空判断    
    elseif (inject_check($id)) { exit('提交的参数非法！'); } // 注射判断    
    elseif (!is_numeric($id)) { exit('提交的参数非法！'); } // 数字判断    
    $id = intval($id); // 整型化         
    return $id;    
    }    
    ?>

<?php
$item  =  "Zak's and Derick's Laptop" ;
$escaped_item  =  mysql_real_escape_string ( $item );
printf  ( "Escaped string: %sn" ,  $escaped_item );
?>

以上例子将产生如下输出：

Escaped string: Zak's and Derick's Laptop

<?php
$item = "Zak's Laptop";
$escaped_item = mysql_escape_string($item);
printf ("Escaped string: %sn", $escaped_item);
?>
输出：
Escaped string: Zak's Laptop

$dbstr='D:test
<a href="http://www.111cn.net">http://www.111cn.net</a>,天缘博客
'!='1' OR '1'
</DIV>
<script  language="javascript" type="text/javascript">alert("Fail");</script>

<?php echo "<br/>PHP OUTPUT"; ?>';

 header("Content-Type: text/html; charset=UTF-8");
echo "------------------------------------------------------<br/>rn";
echo  $dbstr."<br/>rn------------------------------------------------------<br/>rn";
$str=fnAddSlashes($_POST['dd']);
echo $str."<br/>rn------------------------------------------------------<br/>rn";

$str = preg_replace("/s(?=s)/","\1",$str);//多个连续空格只保留一个
$str = str_replace("r","<br/>",$str);
$str = str_replace("n","<br/>",$str);
$str = preg_replace("/((<br/?>)+)/i", "<br/>", $str);//多个连续<br/>标签只保留一个

$str=stripslashes($str);
echo strip_tags($str)."<br/>rn------------------------------------------------------<br/>rn";
echo htmlspecialchars($str)."<br/>rn------------------------------------------------------<br/>rn";
echo htmlentities($str)."<br/>rn------------------------------------------------------<br/>rn";
echo mysql_escape_string($str)."<br/>rn------------------------------------------------------<br/>rn";

function fnAddSlashes($data)
{
    if(!get_magic_quotes_gpc()) //只对POST/GET/cookie过来的数据增加转义
        return is_array($data)?array_map('addslashes',$data):addslashes($data);
    else
        return $data;
}

$data = preg_replace("/s(?=s)/","\1",$data );//多个连续空格只保留一个

function fnEscapeStr($data)

{

if (get_magic_quotes_gpc())
{
        $data= stripslashes($value);
}
$data="'". mysql_escape_string($value) ."'";
return $data;
}

$data=fnEscapeStr($data);

if (!get_magic_quotes_gpc()) {

　　$lastname = addslashes($_POST[‘lastname’]);

　　} else {

　　$lastname = $_POST[‘lastname’];

}

$sql = "select count(*) as ctr from users where username02.='".mysql_real_escape_string($username)."' and 03.password='". mysql_real_escape_string($pw)."' limit 1";

function inject_check($sql_str) {
    return eregi('select|insert|and|or|update|delete|'|/*|*|../|./|union|into|load_file|outfile', $sql_str);
}
 
function verify_id($id=null) {
    if(!$id) {
        exit('没有提交参数！');
    } elseif(inject_check($id)) {
        exit('提交的参数非法！');
    } elseif(!is_numeric($id)) {
        exit('提交的参数非法！');
    }
    $id = intval($id);
    
    return $id;
}
 
 
function str_check( $str ) {
    if(!get_magic_quotes_gpc()) {
        $str = addslashes($str); // 进行过滤
    }
    $str = str_replace("_", "_", $str);
    $str = str_replace("%", "%", $str);
    
   return $str;
}
 
 
function post_check($post) {
    if(!get_magic_quotes_gpc()) {
        $post = addslashes($post);
    }
    $post = str_replace("_", "_", $post);
    $post = str_replace("%", "%", $post);
    $post = nl2br($post);
    $post = htmlspecialchars($post);
    
    return $post;
}

function _code($_code_length = 4, $_width = 75, $_height = 25){
    for($i=0;$i<$_code_length;$i++){
        $_nmsg .= dechex(mt_rand(0,15));
    }
    $_SESSION["code"] = $_nmsg;

    $_img = imagecreatetruecolor($_width, $_height);

    $_white = imagecolorallocate($_img, 250, 250, 250);

    imagefill($_img, 0, 0, $_white);

    $_gray = imagecolorallocate($_img, 196, 196, 196);

    imagerectangle($_img, 0, 0, $_width-1, $_height-1, $_gray);

    for ($i=0; $i < 6; $i++) {
        $_md_color = imagecolorallocate($_img, mt_rand(200,255), mt_rand(200,255), mt_rand(200,255));
        imageline($_img, mt_rand(0,$_width), mt_rand(0, $_height),mt_rand(0,$_width), mt_rand(0, $_height), $_md_color);
    }

    for ($i=0; $i < 50; $i++) {
        $_md_color = imagecolorallocate($_img, mt_rand(200,255), mt_rand(200,255), mt_rand(200,255));
        imagestring($_img, 1, mt_rand(1,$_width-5), mt_rand(1, $_height-5), "*", $_md_color);
    }

    for ($i=0; $i < $_code_length ; $i++) {
        $_md_color = imagecolorallocate($_img, mt_rand(0,102), mt_rand(0,102), mt_rand(0,102));
        imagestring($_img, 5, $i * $_width/$_code_length+ mt_rand(1, 10), mt_rand(1, $_height/2), $_SESSION["code"][$i], $_md_color);
    }

    header("Content-Type:image/png");

    imagepng($_img);

    imagedestroy($_img);
}

$getcode = $_POST['code'];

if( $_SESSION["code"] = $getcode )
{
  echo ' 验证合法，进入下一步';
  unset( $_SESSION["code"] );
}
else
{
  echo ' 验证码不正确';
  header('location:vial.php');
}