8 security related php functions

Security issues are an important part to consider in programming languages. Almost any actual language will provide some functions, modules, or other features to ensure security. In the modern Internet, we often have to get input data from users all over the world. However, we all know "never trust user-entered data." Therefore, in various web development languages, functions are provided to ensure the security of user input data. Today, we will take a look at such functions provided in PHP, the most famous open source language.

      In PHP, there are some very useful and convenient functions that can help your website prevent problems like SQL injection attacks, XSS attacks, etc. Let’s take a look at these functions that can ensure project security in PHP. The functions listed below are only the functions I have found to be helpful to your project, and they may not be complete.

1. mysql_real_escape_string()

This function is very helpful for preventing SQL injection attacks in PHP. It adds a "backslash" to special characters, such as single quotes and double quotes, to ensure that the user's input is in It was already safe to use it for queries. But you should note that you are using this function while connected to the database.

     But now the mysql_real_escape_string() function is basically no longer needed. All new application development should use libraries like PDO to operate the database. In other words, we can use ready-made statements to prevent SQL injection attacks.

2. addslashes()

This function is very similar to mysql_real_escape_string() above. But be careful not to use this function when the value of magic_quotes_gpc in the setting file php.ini is "on". By default, magic_quotes_gpc is on, automatically running addslashes() on all GET, POST and COOKIE data. Do not use addslashes() on strings that have been escaped by magic_quotes_gpc as this will result in double escaping. You can check the value of this variable through the get_magic_quotes_gpc() function in PHP.

3. htmlentities()

This function is very useful for filtering user input data. It can convert characters into HTML entities. For example, when the user enters the character "<", it will be converted into the HTML entity < by this function, thus preventing XSS and SQL injection attacks.

4. htmlspecialchars()

Some characters in HTML have special meanings. If you want to reflect such meanings, they must be converted into HTML entities. This function will return the converted string, for example, ' &'amp will be converted to '&'.

5. strip_tags()

This function can remove all HTML, JavaScript and PHP tags from the string. Of course, you can also set the second parameter of the function to make some specific tags appear.

6. md5()

Some developers store very simple passwords, which is not good from a security perspective. The md5() function can generate a 32-character md5 hash of a given string. column, and this process is irreversible, that is, you cannot get the original string from the result of md5().

7. sha1()

This function is similar to md5() above, but it uses a different algorithm and produces a 40-character SHA-1 hash (md5 produces a 32-character hash ).

8. intval()

Don’t laugh, I know this is not a safety-related function, it is converting variables into integer types. However, you can use this function to make your PHP code more secure, especially when you are parsing data like id, age.