php 过滤用户输入
我想知道trim()、strip_tags()和addslashes()的组合是否足以过滤来自$_GET和$_POST的变量值
Am wondering if the combination of trim(), strip_tags() and addslashes() is enough to filter values of variables from $_GET and $_POST
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这取决于您想要执行哪种验证。
以下是一些基本示例：
但最重要的验证是仅接受您期望的值，换句话说：仅在您期望数字时才允许数字值，等等。
That depends what kind of validation you are wanting to perform.
Here are some basic examples:
But the most important validation is only accepting the values you are expecting, in other words: only allow numeric values when you are expecting numbers, etc.
简短的回答：不。
长答案：这取决于。
基本上，如果不考虑您想用它做什么，您就不能说一定量的过滤是足够的或不够的。例如，上面的代码将允许通过“javascript:dostuff();”，如果您碰巧在链接的 href 属性中使用了这些 GET 或 POST 值之一，则这可能没问题，也可能不行。
同样，您可能有一个富文本区域，用户可以在其中进行编辑，因此从中剥离标签并不完全有意义。
我想我想说的是，有一组简单的步骤可以清理您的数据，以便您可以将其划掉并说“完成”。您始终必须考虑这些数据的用途。
Short answer: no.
Long answer: it depends.
Basically you can't say that a certain amount of filtering is or isn't sufficient without considering what you want to do with it. For example, the above will allow through "javascript:dostuff();", which might be OK or it might not if you happen to use one of those GET or POST values in the href attribute of a link.
Likewise you might have a rich text area where users can edit so stripping tags out of that doesn't exactly make sense.
I guess what I'm trying to say is that there is simple set of steps to sanitizing your data such that you can cross it off and say "done". You always have to consider what that data is doing.
这很大程度上取决于您要在哪里使用它。
It highly depends where you are going to use it for.