清理/过滤用户评论的最佳方法？

发布于 2024-08-05 02:39:03 字数 1674 浏览 5 评论 0原文

我目前正在使用此过程来清理/过滤用户输入的评论 ->
这个用于去除斜杠...然后

 if (get_magic_quotes_gpc()) {
        function stripslashes_deep($value)
        {
            $value = is_array($value) ?
                        array_map('stripslashes_deep', $value) :
                        stripslashes($value);

            return $value;
        }

        $_POST = array_map('stripslashes_deep', $_POST);
        $_GET = array_map('stripslashes_deep', $_GET);
        $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
        $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
    }

注释通过这个函数来清理数据...

   function my_strip_tags($str) {
                $strs=explode('<',$str);
                $res=$strs[0];
                for($i=1;$i<count($strs);$i++)
                {
                    if(!strpos($strs[$i],'>'))
                        $res = $res.'&lt;'.$strs[$i];
                    else
                        $res = $res.'<'.$strs[$i];
                }
             return strip_tags($res);   
    }

之后它使用准备好的语句直接进入数据库..

function add_comment($comment,$type,$update_id,$user_id){
            $query="INSERT INTO comment_updates (updateid,userid,comment) VALUES(?,?,?)";
                if($stmt=$this->conn->prepare($query)) {
                $stmt->bind_param('sss',$update_id,$user_id,$comment);
                $stmt->execute();
                    if($this->conn->affected_rows==1){
                    $stmt->close();
                    return true;
                    }
            }
        }

我只是想知道这是否足够安全或者是否他们还有其他更好的选择...谢谢

原文

I am currently using this process to Sanitize/Filter comment entered by users ->
This one is used to strip slashes... and

 if (get_magic_quotes_gpc()) {
        function stripslashes_deep($value)
        {
            $value = is_array($value) ?
                        array_map('stripslashes_deep', $value) :
                        stripslashes($value);

            return $value;
        }

        $_POST = array_map('stripslashes_deep', $_POST);
        $_GET = array_map('stripslashes_deep', $_GET);
        $_COOKIE = array_map('stripslashes_deep', $_COOKIE);
        $_REQUEST = array_map('stripslashes_deep', $_REQUEST);
    }

Then the comment goes through this function to sanitize the data...

   function my_strip_tags($str) {
                $strs=explode('<',$str);
                $res=$strs[0];
                for($i=1;$i<count($strs);$i++)
                {
                    if(!strpos($strs[$i],'>'))
                        $res = $res.'<'.$strs[$i];
                    else
                        $res = $res.'<'.$strs[$i];
                }
             return strip_tags($res);   
    }

After this it goes straight into the database using prepared statement..

function add_comment($comment,$type,$update_id,$user_id){
            $query="INSERT INTO comment_updates (updateid,userid,comment) VALUES(?,?,?)";
                if($stmt=$this->conn->prepare($query)) {
                $stmt->bind_param('sss',$update_id,$user_id,$comment);
                $stmt->execute();
                    if($this->conn->affected_rows==1){
                    $stmt->close();
                    return true;
                    }
            }
        }

I just wanted to know if this is secure enough or if their are any other better alternatives...Thanks

分享到QQ

分享到微博