Aşağıdaki kodu inceleyebilir misiniz? Sizce yazdığımız bu kod ile tam güvenlik sağlamış olur muyuz?
İşlemlerin yapıldığı dosyada en üste bu kodu yazıyoruz ve çalıştırıyoruz.
Güvenlikten geçerse işlem devam ediyor. Geçemezse hareket sonlanıyor.

Yorumlarsanız sevinirim.

function cleaninput($input) {
    $search = array(
        '@<script[^>]*?>.*?</script>@si', // Strip out javascript
        '@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
        '@<style[^>]*?>.*?</style>@siU', // Strip style tags properly
        '@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments
    );
    
    $output = preg_replace($search, '', $input);
    return $output;
}

function sanitize($input) {
        if (is_array($input)) {
            foreach ($input as $var => $val) {
                $output[$var] = sanitize($val);
            }
        } else {
            $input  = str_replace('"', "", $input);
            $input  = str_replace("'", "", $input);
            $input  = cleaninput($input);
            $output = htmlentities($input, ENT_QUOTES);
        }
        return @$output;
}

function executeSecurity(){

    $_POST    = sanitize($_POST);
    $_GET     = sanitize($_GET);
    $_REQUEST = sanitize($_REQUEST);
    $_COOKIE  = sanitize($_COOKIE);
    if (isset($_SESSION)) {
        $_SESSION = sanitize($_SESSION);
    }

    $request_uri  = $_SERVER['REQUEST_URI'];
    $query_string = $_SERVER['QUERY_STRING'];
    
    $patterns = array(
        "union",
        "coockie",
        "concat",
        "alter",
        "table",
        "where",
        "exec",
        "shell",
        "wget",
        "**/",
        "/**",
        "0x3a",
        "null",
        "DR/**/OP/",
        "drop",
        "/*",
        "*/",
        "*",
        "--",
        ";",
        "||",
        "'",
        "' #",
        "or 1=1",
        "'1'='1",
        "BUN",
        "S@BUN",
        "char",
        "OR%",
        "`",
        "[",
        "]",
        "<",
        ">",
        "++",
        "script",
        "select",
        "1,1",
        "substring",
        "ascii",
        "sleep(",
        "&&",
        "insert",
        "between",
        "values",
        "truncate",
        "benchmark",
        "sql",
        "mysql",
        "%27",
        "%22",
        "(",
        ")",
        "<?",
        "<?php",
        "?>",
        "../",
        "/localhost",
        "127.0.0.1",
        "loopback",
        ":",
        "%0A",
        "%0D",
        "%3C",
        "%3E",
        "%00",
        "%2e%2e",
        "input_file",
        "execute",
        "mosconfig",
        "environ",
        "scanner",
        "path=.",
        "mod=.",
        "eval\(",
        "javascript:",
        "base64_",
        "boot.ini",
        "etc/passwd",
        "self/environ",
        "md5",
        "echo.*kae",
        "=%27$"
    );
    foreach ($patterns as $pattern) {
        if (strlen($query_string) > 255 OR strpos(strtolower($query_string), strtolower($pattern)) !== false) {
    $activity=	json_encode(['post'=>$_POST,'get'=>$_GET,'request'=>$_REQUEST,'url'=> $_SERVER['REQUEST_URI'],'IP'=>hacker_ip(),'time'=> date('d-m-Y H:i:s')]);		
    $new_filename = date('d-m-Y') . "_" . 'suspicious_activity';
    file_put_contents('logs/' . $new_filename . '.log', $activity, FILE_APPEND);
        echo "IP RECORDED and ACTIVITY BLOCKED";
        exit(1);
        }
    }

}

function hacker_ip() {
    $ipaddress = '';
    if (getenv('HTTP_CLIENT_IP'))
        $ipaddress = getenv('HTTP_CLIENT_IP');
    else if(getenv('HTTP_X_FORWARDED_FOR'))
        $ipaddress = getenv('HTTP_X_FORWARDED_FOR');
    else if(getenv('HTTP_X_FORWARDED'))
        $ipaddress = getenv('HTTP_X_FORWARDED');
    else if(getenv('HTTP_FORWARDED_FOR'))
        $ipaddress = getenv('HTTP_FORWARDED_FOR');
    else if(getenv('HTTP_FORWARDED'))
    $ipaddress = getenv('HTTP_FORWARDED');
    else if(getenv('REMOTE_ADDR'))
        $ipaddress = getenv('REMOTE_ADDR');
    else
        $ipaddress = 'UNKNOWN';
    return $ipaddress;
}

executeSecurity();