Collection of commonly used security filtering functions in PHP, collection of PHP functions

Collection of commonly used security filtering functions in PHP, collection of PHP functions_PHP tutorial

WBOY

Release： 2016-07-13 10:17:32

Original

749 people have browsed it

A collection of commonly used security filtering functions in PHP, a collection of PHP functions

Although various development frameworks provide us with good security methods, we still need to pay attention to security issues.
The reason is simple: many small functions and projects do not use the framework, and we need to solve security issues ourselves!

①What are the commonly used security functions:

Copy code The code is as follows:

mysql_real_escape_string()
addslashes()

②The functions of these functions:

The mysql_real_escape_string() and addslashes() functions both escape single quotes and double quotes in the data! That is to prevent sql injection!
But mysql_real_escape_string() takes the character set into consideration and is safer!
After consulting relevant information, we can draw a conclusion: If the current character set is single-byte, these two functions have the same effect and can both play the role of escape filtering. However, who would just use single-byte? ? Especially utf8 is becoming more and more widely used!

③Usage of function:

When understanding the usage of the two functions mysql_real_escape_string() and addslashes(), we must first understand the meaning of the other two functions!

get_magic_quotes_gpc() and get_magic_quotes_runtime(), let’s compare the similarities and differences between the two functions:

Same as:

a. Both are used to obtain the configuration of the php.ini configuration file! Returns 1 when turned on and 0 when turned off!

b. When turned on, data within the specified range will be escaped and filtered!

Different:
a. The two have different scopes of action:
magic_quotes_gpc mainly functions on the web client. Simply put, it mainly filters the data in $_GET, $_POST, and $_COOKE!
magic_quotes_runtime mainly filters the data read from the file or the data obtained from the database query!
b. Different setting times:
magic_quotes_gpc cannot be set at runtime [This setting can only be read when restarting the server]
magic_quotes_runtime can be set at runtime!
Note: The so-called runtime setting means that we can set the configuration in the php.ini file in the script through the ini_set() function!

After understanding the two functions get_magic_quotes_gpc() and get_magic_quotes_runtime(), we should understand: when we detect that the php.ini configuration file has enabled magic_quotes_runtime and magic_quotes_gpc, the data within the specified range will be automatically transferred. righteous! If it is turned off, we need to use mysql_real_escape_string()[or addslashes function for filtering]

④Example:

1. Regardless of whether magic_quotes_gpc and magic_quotes_runctime are turned on or off, the getdata.php script can safely transfer data. The content is as follows:

Copy code The code is as follows:

If(!get_magic_quotes_gpc()) {
          foreach($_GET as $key=> &$value) {
                $value = mysql_real_escape_string($value);
}
}
If(!get_magic_quotes_runtime()) {
          $sourceDataRecord= file('./sourceData.txt');
           if($sourceDataRecord) {
foreach($sourceDataRecord as $sourceKey => &$sourceValue) {
                     $sourceValue = mysql_real_escape_string($sourceValue);
            }
}
}
$gpcData = implode("t", $_GET);
$runtimeData = implode("t", $sourceDataRecord);
echo $gpcData, $runtimeData;
?>

The content in sourceData.txt is as follows:

Copy code The code is as follows:

" It's anoterh sunday afternoon
I'm trunning turning.....turning around "

The url when we request getData.php is as follows:

php.test.com/safe/getdata.php?name=maw'eibin&age=25

The execution results are as follows:

Copy code The code is as follows:

maw'eibin 25" It's anoterh sunday afternoonrn I'm trunning
turning....turning around "

⑤Reference materials:

http://www.bkjia.com/article/35868.htm

I have seen that many PHP security filter functions often replace some characters. Wouldn’t it be bad if the information entered by the user changes? Solution

As you said, security filtering is necessary to restrict user behavior for the sake of security. What kind of users do you think this restriction targets? is a user who intentionally compromises the security of the website. To give a few examples:
Filter the html tags in the title. Because titles are generally plain text, 1. html tags will cause layout confusion 2. Will contain dangerous scripts 3. Encoding characters such as quotation marks into html entities will not affect its final display effect;
replace the < in the text script> tags are filtered out. Because ordinary users will not execute scripts at all. So we generally have two approaches: 1. Remove the script, 2. Encode the tag with HTML entity characters, so that the code snippet can be displayed without executing the code when the article is displayed;
filters the single quotes of the query parameters. This is to prevent sql injection. There are generally three methods to achieve this: 1. Add backslashes to the quotes 2. Remove the quotes 3. Use sql's prepare to dynamically bind parameters;
In short, do not trust any user input, restrictions Or for more ordinary users to better use our services.

What are the PHP filter functions?

addslashes()
mysql_real_escape_string
Used for security filtering when inserting into the database, usually transcoding
htmlspecialchars: There are also some functions in the html series. The one you mentioned is one of the mid-term 1. This is encoding when the data is output to the browser or terminal to prevent the output data from containing malicious js code or other codes and transcoding

strip_tags: This is to remove some html tags , and some PHP tags, you can decide where to use them... You can use them wherever you want to filter these tags