PHP filters special characters in form submission (anti-injection)

This article will summarize some methods commonly used in PHP to prevent PHP injection and SQL injection. PHP provides several functions such as htmlspecialchars/addslashes/stripslashes/strip_tags/mysql_real_escape_string, which you need to know about. Friends can refer to it.

The following is a summary of the processing of common special characters in forms:

Test string:

The code is as follows

Copy code

代码如下

复制代码

$dbstr='D:test
http://www.bKjia.c0m,天缘博客
'!='1' OR '1'

PHP OUTPUT"; ?>';

$dbstr='D:test

http://www.bKjia.c0m, Tianyuan Blog

'!='1' OR '1'

代码如下

复制代码

header("Content-Type: text/html; charset=UTF-8");
echo "------------------------------------------------------
rn";
echo $dbstr."
rn------------------------------------------------------
rn";
$str=fnAddSlashes($_POST['dd']);
echo $str."
rn------------------------------------------------------
rn";

$str = preg_replace("/s(?=s)/","1",$str);//多个连续空格只保留一个
$str = str_replace("r","
",$str);
$str = str_replace("n","
",$str);
$str = preg_replace("/((
)+)/i", "
", $str);//多个连续
标签只保留一个

$str=stripslashes($str);
echo strip_tags($str)."
rn------------------------------------------------------
rn";
echo htmlspecialchars($str)."
rn------------------------------------------------------
rn";
echo htmlentities($str)."
rn------------------------------------------------------
rn";
echo mysql_escape_string($str)."
rn------------------------------------------------------
rn";

PHP OUTPUT"; ?>';

Test code:

The code is as follows

Copy code

header("Content-Type: text/html; charset=UTF-8");

代码如下	复制代码
function fnAddSlashes($data) { if(!get_magic_quotes_gpc()) //只对POST/GET/cookie过来的数据增加转义 return is_array($data)?array_map('addslashes',$data):addslashes($data); else return $data; }

echo "------------------------------------------------ ------
rn"; echo $dbstr."
rn----------------------------------------- ----------------
rn"; $str=fnAddSlashes($_POST['dd']); echo $str."
rn----------------------------------------- ----------------
rn"; $str = preg_replace("/s(?=s)/","1",$str);//Reserve only one of multiple consecutive spaces $str = str_replace("r","
",$str); $str = str_replace("n","
",$str); $str = preg_replace("/((
)+)/i", "
", $str);//Multiple consecutive
tags are only retained a $str=stripslashes($str); echo strip_tags($str)."
rn---------------------------------- ------------------
rn"; echo htmlspecialchars($str)."
rn---------------------------------- ------------------
rn"; echo htmlentities($str)."
rn---------------------------------- ------------------
rn"; echo mysql_escape_string($str)."
rn---------------------------------- ------------------
rn";

The string contains: backslash path, single and double quotes, HTML tags, links, unblocked HTML tags, database syntax tolerance, JS execution judgment, PHP execution judgment, multiple consecutive carriage returns, line feeds and spaces. Some of the concepts are inclusive 2. Form submission data processing 1. Forced to add backslash Since some hosts enable the magic quote get_magic_quotes_gpc by default, and some may turn it off, it is best to force the addition of backslashes in the program so that they can be processed uniformly. The characters involve single quotes, double quotes and backslashes.

The code is as follows	Copy code
function fnAddSlashes($data) { If(!get_magic_quotes_gpc()) //Only add escaping to the data from POST/GET/cookie return is_array($data)?array_map('addslashes',$data):addslashes($data); else return $data; }

2. Processing of special characters

The following are several commonly used string processing, which can be chosen depending on the specific situation. Since the submitted form data has been escaped above, if you need to replace or filter the content, you need to consider the impact of addslashes on relevant characters, and you need to consider the addition of backslashes when replacing or searching. Other character substitutions have no effect, such as rn substitution.

A. Keep only one of multiple consecutive spaces

The code is as follows

Copy code

代码如下	复制代码
$data = preg_replace("/s(?=s)/","1",$data );//多个连续空格只保留一个

$data = preg_replace("/s(?=s)/","1",$data );//Reserve only one of multiple consecutive spaces

B. Replace carriage return and line feed with

代码如下	复制代码
$data = str_replace("r"," ",$data ); $data = str_replace("n"," ",$data );

//The default
in html is not blocked, and
is blocked in xhtml. It is recommended to use
. More differences:

C. Multiple consecutive
only keep one

代码如下	复制代码
$data = preg_replace("/(( )+)/i", " ", $data );//多个连续标签只保留一个

D. Filter all HTML tags

This method filters out all potentially dangerous tags, including HTML, links, unblocked HTML tags, JS, and PHP.

Use function strip_tags($data)

After use, this function will filter all HTML tags (including links), PHP tags, JS codes, etc. The links will retain the original text of the link but remove the tag and href part of the content, while PHP tags and JS tags will Remove the whole, including the content in the middle, as shown below:

E. Don’t filter tags, just HTML them

This method is to process all the original submitted content as ordinary text.

Use the function htmlspecialchars($data). After the function is executed, all submitted data will be displayed as ordinary text, as shown below:

The execution result of using htmlentities function (garbled characters are displayed in Chinese):

3. Write to database

Advanced trusted users can directly write to the database after using addslashes($data), but addslashes cannot intercept single quotes replaced by 0xbf27, so it is best to use mysql_real_escape_string or mysql_escape_string to escape, but before escaping The backslashes need to be removed first (assuming addslashes is enabled by default).

代码如下

复制代码

function fnEscapeStr($data)

{

if (get_magic_quotes_gpc())
{
$data= stripslashes($value);
}
$data="'". mysql_escape_string($value) ."'";
return $data;
}

$data=fnEscapeStr($data);

The code is as follows	Copy code
function fnEscapeStr($data) { if (get_magic_quotes_gpc()) { $data= stripslashes($value); } $data="'". mysql_escape_string($value) ."'"; return $data; } $data=fnEscapeStr($data);

PHP universal anti-injection security code

代码如下

复制代码