逃跑并创造鼻涕虫的最佳方法
可能的重复:
PHP 中的 URL 友好用户名?
我在使用正确的函数来转义和创建一个slug
我用过这个:
$slug_title = mysql_real_escape_string()($mtitle);
但有人告诉我不要使用它并使用 urlencode() ,
哪个对于 slug 和安全性更好,它在单词之间插入 - :
正如我在 SO 中看到的那样,
https://stackoverflow.com/questions/941270/validating-a-slug-in-django
Possible Duplicate:
URL Friendly Username in PHP?
im somehow confused in using proper functions to escape and create a slug
i used this :
$slug_title = mysql_real_escape_string()($mtitle);
but someone told me not to use it and use urlencode()
which one is better for slugs and security
as i can see in SO , it inserts - between words :
https://stackoverflow.com/questions/941270/validating-a-slug-in-django
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
使用 MySQL 或 URL 转义都不是正确的方法。
这是一篇文章,它做到了这一点更好:
这也适用于重音字符。
Using either MySQL or URL escaping is not the way to go.
Here is an article that does it better:
This also works correctly for accented characters.
mysql_real_escape_string() 与 urlencode() 的用途不同,两者都不适合创建 slug。
蛞蝓应该是一个清晰的&有意义的短语,简洁地描述了页面。
mysql_real_escape_string() 转义可能改变原始查询字符串用途的危险字符。
urlencode() 使用“%”后跟代表其代码的 2 个十六进制数字(例如,%20 表示空格)来转义无效的 URL 字符。这样,生成的字符串将不是清晰的&有意义,因为令人不快的字符序列,例如 http: //www.domain.com/bad%20slug%20here%20%3C--
因此,任何可能受 urlencode() 影响的字符都应该被省略,除了通常用
替换的空格 -
。mysql_real_escape_string() has different purpose than urlencode() which both aren't appropriate for creating a slug.
A slug is supposed to be a clear & meaningful phrase that concisely describes the page.
mysql_real_escape_string() escapes dangerous characters that can change the purpose of the original query string.
urlencode() escapes invalid URL characters with "%" followed by 2 hex digits that represents their code (e.g. %20 for space). This way, the resulting string will not be clear & meaningful, because of the unpleasant characters sequences, e.g. http://www.domain.com/bad%20slug%20here%20%3C--
Thus any characters which may be affected by urlencode() should be omitted, except for spaces that are usually replaced with
-
.