Two simple ways to prevent SQL injection attacks and XSS attacks in PHP_PHP Tutorial

mysql_real_escape_string()

So if the SQL statement is written like this: "select * from cdr where src =".$userId;, it must be changed to $userId=mysql_real_escape_string($userId)

All printing statements such as echo, print, etc. must be filtered using htmlentities() before printing. This can prevent Xss. Note that in Chinese, htmlentities($name,ENT_NOQUOTES,GB2312) must be written.

http://www.bkjia.com/PHPjc/321539.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/321539.htmlTechArticlemysql_real_escape_string() So if the SQL statement is written like this: "select * from cdr where src =". $userId; must be changed to $userId=mysql_real_escape_string($userId) All...