How to filter unsafe strings in php: 1. Add "backslash" to special characters through the mysql_real_escape_string function; 2. Add backslash to special characters through the addslashes function; 3. Use htmlentities Functions filter user input data and more.
The operating environment of this article: windows7 system, PHP7.1 version, DELL G3 computer
phpHow to filter unsafe strings? Summary of the use of character security filtering functions in PHP
This article mainly briefly introduces the character security filtering functions in PHP. It is very useful for preventing SQL injection attacks and XSS attacks. It is recommended to everyone here.
In the process of WEB development, we often need to obtain data entered by users from all over the world. However, we "can never trust user-entered data." Therefore, in various web development languages, functions are provided to ensure the security of user input data. In PHP, there are some very useful and convenient functions that can help you prevent problems like SQL injection attacks, XSS attacks, etc.
mysql_real_escape_string()
This function was used to prevent SQL injection attacks in PHP It provides great help. It adds "backslash" to special characters, such as single quotes and double quotes, to ensure that the user's input is safe before using it to query. But you should note that you are using this function while connected to the database. But now the mysql_real_escape_string() function is basically no longer needed. All new application development should use libraries like PDO to operate the database. In other words, we can use ready-made statements to prevent SQL injection attacks.
addslashes()
This function is very similar to the mysql_real_escape_string() above, The same backslash is added for special characters, but be careful not to use this function when the value of magic_quotes_gpc in the setting file php.ini is "on". When magic_quotes_gpc = on, automatically runs addslashes() on all GET, POST and COOKIE data. Do not use addslashes() on strings that have been escaped by magic_quotes_gpc, as this will result in double escaping. You can check the value of this variable through the get_magic_quotes_gpc() function in PHP.
3htmlentities()
This function is very useful for filtering user input data. It Characters can be converted into HTML entities. For example, when the user enters the character "<", it will be converted into the HTML entity "<" by this function (you will see "<" when viewing the source code), thus preventing XSS and SQL injection attacks. Unrecognized character sets will be ignored and replaced by ISO-8859-1
##htmlspecialchars()
This function is very similar to the above. Some characters in HTML have special meanings. If you want to reflect such meanings, they must be converted into HTML entities. This function will return the converted string.
strip_tags()
This function can remove all HTML from the string. JavaScript and PHP tags, of course, you can also ignore filtering some specific tags by setting the second parameter of this function.
intval()
intval is not actually a filtering function; is to convert the variable into an integer type. It is very useful when we need to get an integer parameter. You can use this function to make your PHP code safer, especially when you are parsing integer data such as id and age.
Let’s summarize PHP’s methods for processing special characters in form submissions, which mainly involve the joint use of several functions such as htmlspecialchars/addslashes/stripslashes/strip_tags/mysql_real_escape_string. Let’s communicate with everyone.
1. Several PHP functions related to special character processing
Function name
Definition
Introduction
htmlspecialchars
will be used with, Convert single and double quotation marks, greater than and less than signs into HTML format
In addition to the above htmlspecialchars characters, it also includes double-byte character display into encoding, etc.
addslashes
Single and double quotes, backslashes and NULL plus backslash escape
The changed characters include single quotation mark ('), double quotation mark ("), backslash backslash (\) and the null character NULL.
stripslashes
Remove backslash characters
Remove backslash characters in the string. If there are two consecutive backslashes, remove one and leave one. If there is only one backslash, just remove it.
quotemeta
Add quotation symbols
Add the backslash "\" symbol in front of characters such as \\ * ? [ ^ ] ( $ ) in the string.
nl2br()
Convert newline characters to
strip_tags
Remove HTML and PHP tags
Remove any HTML tags and PHP tags in the string, including the content between tag blocks. Note that if there are errors in the string HTML and PHP tags, an error will also be returned.
mysql_real_escape_string
Escape special characters in SQL strings
Escape \x00 \n \r Space \ ' " \x1a, which is very effective for multi-byte character processing. mysql_real_escape_string will determine the character set, but mysql_escape_string does not need to be considered.
The above is the detailed content of How to filter unsafe strings in php. For more information, please follow other related articles on the PHP Chinese website!
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
PHP 8.4 brings several new features, security improvements, and performance improvements with healthy amounts of feature deprecations and removals.
This guide explains how to install PHP 8.4 or upgrade to PHP 8.4 on Ubuntu, Debian, or their derivati
Visual Studio Code, also known as VS Code, is a free source code editor — or integrated development environment (IDE) — available for all major operating systems.
With a large collection of extensions for many programming languages, VS Code can be c
If you are an experienced PHP developer, you might have the feeling that you’ve been there and done that already.You have developed a significant number of applications, debugged millions of lines of code, and tweaked a bunch of scripts to achieve op
This tutorial demonstrates how to efficiently process XML documents using PHP. XML (eXtensible Markup Language) is a versatile text-based markup language designed for both human readability and machine parsing. It's commonly used for data storage an
JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,
A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase.
What is a vowel?
Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase:
a, e, i, o, u
Example 1
Input: String = "Tutorialspoint"
Output: 6
explain
The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total
Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.
