php传递url参数加密验证的解决方案（加密解密、安全验证过滤）

在项目开发中，需要对url传递的参数进行加密解密，如：?m=Surveyor&a=applyAgencyInfo&act=showAgency&pro_id=47&pro_types=1中的pro_id=47牵涉修改、删除、增加等权限的操作，如果作为明文传递，存在很大的安全隐患。那么有哪些方式来对url传递的参数进行安全过滤呢？

一、JSON数据输出加密

在读取mysql数据表时，将对应的id直接加密输出：

 public function getProject()
    {
        global $db, $res;
        dbc();
        @$p = $_GET['page'] == "" ? 1 : $_GET['page'];
        @$pagesize = $_GET['limit'] == "" ? 15 : $_GET['limit'];
        @$limit = ($p - 1) * $pagesize;
        //用户ID解密
        $user_id = AuthCode($_COOKIE['user_id'], 'DECODE', 'LOCKDATAV', '');
        $sql = "select pro_id,user_id,pro_types,pro_name,pro_serial,pro_category,pro_condition,pro_audit,pro_declarant FROM " . $db->table('project') . " WHERE user_id =" . $user_id;
        $sql .= " ORDER BY pro_id DESC LIMIT " . $limit . "," . $pagesize;
        $row = $db->queryall($sql);

        //获取总记录;
        $sql_c = "select pro_id FROM " . $db->table('project') . " WHERE user_id =" . $user_id;
        $sql_c .= " ORDER BY pro_id DESC";
        $row_c = $db->queryall($sql_c);

        //项目pro_id加密
        foreach ($row as $k => $v) {
            $row[$k]['dpro_id'] = lockAuth($v['pro_id'], 'LOCKDATAV', '');
        }

        /*信息输出*/
        $res['code'] = 0;
        $res['msg'] = 0;
        $res['count'] = count($row_c);
        $res["data"] = $row;
        die(json_encode_lockdata($res));
    }

1.核心代码

  //项目pro_id加密
        foreach ($row as $k => $v) {
            $row[$k]['dpro_id'] = lockAuth($v['pro_id'], 'LOCKDATAV', '');
        }

2.封装函数

/*项目加密*/
function lockAuth($tex, $key, $type = "encode")
{
    $chrArr = array('a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
        'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
        '0', '1', '2', '3', '4', '5', '6', '7', '8', '9');
    if ($type == "decode") {
        if (strlen($tex) < 14) return false;
        $verity_str = substr($tex, 0, 8);
        $tex = substr($tex, 8);
        if ($verity_str != substr(md5($tex), 0, 8)) {
            //完整性验证失败
            return false;
        }
    }
    $key_b = $type == "decode" ? substr($tex, 0, 6) : $chrArr[rand() % 62] . $chrArr[rand() % 62] . $chrArr[rand() % 62] . $chrArr[rand() % 62] . $chrArr[rand() % 62] . $chrArr[rand() % 62];
    $rand_key = $key_b . $key;
    $rand_key = md5($rand_key);
    $tex = $type == "decode" ? base64_decode(substr($tex, 6)) : $tex;
    $texlen = strlen($tex);
    $reslutstr = "";
    for ($i = 0; $i < $texlen; $i++) {
        $reslutstr .= $tex{$i} ^ $rand_key{$i % 32};
    }

    //加密
    if ($type != "decode") {
        $reslutstr = trim($key_b . base64_encode($reslutstr), "==");
        $reslutstr = substr(md5($reslutstr), 0, 8) . $reslutstr;
    }
    return $reslutstr;
}

二、同步验证传值

如：&act=showAgency&pro_id=47&token=92208612f2dae1b7f43ad8121b9f74e6

其中token的加密方式为pro_id，key动态加密即可。

/*
 * $id，需要加密的字符串
 * $key，加密密钥
 *  */
function getToken($id, $key)
{
    return md5($id . $key);
}

在获取id的页面进行验证即可。

@漏刻有时