这样能做到防注入？
function defend_xss($val){
return is_array($val) ? $val : htmlspecialchars($val);
}
function gpc($name,$w = 'GPC',$default = '',$d_xss=1){
global $curr_script;
if($curr_script==ADMINCP){
$d_xss = 0;
}
$i = 0;
for($i = 0; $i < strlen($w); $i++) {
if($w[$i] == 'G' && isset($_GET[$name])) return $d_xss ? defend_xss($_GET[$name]) : $_GET[$name];
if($w[$i] == 'P' && isset($_POST[$name])) return $d_xss ? defend_xss($_POST[$name]) : $_POST[$name];
if($w[$i] == 'C' && isset($_COOKIE[$name])) return $d_xss ? defend_xss($_COOKIE[$name]) : $_COOKIE[$name];
}
return $default;
}
<?php
$test = gpc('test','P','')
$userid = @$db->result_first("select userid from user where username='$test'");
....以下代码省略
?>
