这些安全功能够用吗？
我正在尝试保护我的网站，这样我就不会受到 sql 注入或 xss 的攻击。
这是我的代码：
//here's the form (abbreviated)
<form>
<label for="first_name" class="styled">First Name:</label>
<input type="text" id="first_name" name="first_name" value="<?php if (!empty($first_name)) echo $first_name; ?>" /><br />
//submit button etc
</form>
if (isset($_POST['submit'])) {
//gets rid of extra whitesapce and escapes
$first_name = mysqli_real_escape_string($dbc, trim($_POST['first_name']));
//check if $first_name is a string
if(!is_string($first_name)
{
echo "not string";
}
//then insert into the database.
.......
}
mysqli_real_escape_string：我知道这个函数会转义某些字母，例如 \n \r，所以当数据输入到 dbc 时，所有转义字母旁边都会有 '\' ？
这个脚本足以阻止大多数 sql 注入吗？只是转义并检查数据是否是字符串。对于整数值（例如用户输入价格），我只是：
is_numeric()。我应该如何使用
htmlspecialchars？我应该只在回显和显示用户数据时使用它吗？或者我在将数据插入数据库时也应该使用它吗？什么时候应该使用
strip_tags或htmlspecialchars？
因此，对于所有这些函数：
if (isset($_POST['submit'])) {
//gets rid of extra whitesapce and escapes
$first_name = mysqli_real_escape_string($dbc, trim($_POST['first_name']));
//check if $first_name is a string
if(!is_string($first_name)
{
echo "not string";
}
//gets rid of any <,>,&
htmlspecialchars($first_name);
//strips any tags with the first name
strip_tags($first_name)
//then insert into the database.
.......
}
我应该使用哪些函数进行 sql 注入，哪些函数应该用于 xss？
用户什么时候可以插入针对我的 xss 脚本？什么时候有表格？
I am trying to secure my site so I'm not vulnerable to sql injection or xss.
Here's my code:
//here's the form (abbreviated)
<form>
<label for="first_name" class="styled">First Name:</label>
<input type="text" id="first_name" name="first_name" value="<?php if (!empty($first_name)) echo $first_name; ?>" /><br />
//submit button etc
</form>
if (isset($_POST['submit'])) {
//gets rid of extra whitesapce and escapes
$first_name = mysqli_real_escape_string($dbc, trim($_POST['first_name']));
//check if $first_name is a string
if(!is_string($first_name)
{
echo "not string";
}
//then insert into the database.
.......
}
mysqli_real_escape_string: I know that this function escapes certain letters like \n \r, so when the data gets inputted into the dbc, would it have '\' next to all the escaped letters?
Will this script be enough to prevent most sql injection? just escaping and checking if the data is a string. For integers values(like users putting in prices), i just:
is_numeric().How should I use
htmlspecialchars? Should I use it only when echoing and displaying user data? Or should I also use this when inserting data to a database?When should I use
strip_tagsorhtmlspecialchars?
So with all these functions:
if (isset($_POST['submit'])) {
//gets rid of extra whitesapce and escapes
$first_name = mysqli_real_escape_string($dbc, trim($_POST['first_name']));
//check if $first_name is a string
if(!is_string($first_name)
{
echo "not string";
}
//gets rid of any <,>,&
htmlspecialchars($first_name);
//strips any tags with the first name
strip_tags($first_name)
//then insert into the database.
.......
}
Which functions should I use for sql injection and which ones should I use for xss?
When can a user insert xss scripts against me? When there is a form?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
检查数据是否是字符串是没有用的：字符串正是您用于注入的内容。
real_escape_string 是一种合理但不能保证避免 SQL 注入的方法，因为转义例程存在出现错误且无法正确转义的风险（事实上，之前已经存在错误）。正确的方法是使用 参数化查询 - 这将分开查询结构中的数据，使得注入不可能。但是，如果您绝对不能使用参数化查询，则 real_escape_string （在打开连接时使用 set_charset）是最好的选择。
您将希望在用户可以触摸的任何内容上使用 htmlspecialchars，并且您希望在它显示在页面上时使用它。如果您希望用户格式化帖子或其他内容，那么您应该为他们提供一种类似于 BBCode 的格式化语言（并在运行 htmlspecialchars 后转换 BBCode）。如果您需要存储纯 HTML，您不会想使用 htmlspecialchars，但您会想确保只有受信任的人才能在那里写入。例如，如果您正在编写博客，那么在博客文章本身中允许使用纯 HTML 可能没问题，因为只有博客编辑才能在那里编写内容。但是，您不想在评论中允许它，因为每个人都可以在那里写东西，而这只会使像 跨站脚本。
Checking if data is a string is useless: strings are exactly what you'd use for injections.
real_escape_string is a reasonable, but not guaranteed way of avoiding SQL injections, because escaping routines have a risk of being buggy and not escaping things correctly (in fact, there have been bugs previously). The right way to do it is to used parameterized queries - this separates the data from the structure of the query, making injection impossible. If you absolutely cannot use parameterized queries, however, real_escape_string (with a set_charset when the connection is opened) is the best you can do.
You will want to use htmlspecialchars on anything the user can touch, and you want to use it at the moment it is shown on a page. If you want users to format posts or anything, then you should provide them with a formatting language a la BBCode (and convert the BBCode after running htmlspecialchars). If you need to store pure HTML, you wouldn't want to use htmlspecialchars, but you'd want to make damn sure that only trusted people can write there. For example, if you're writing a blog, it might be okay to allow pure HTML in the blog post itself, because only the blog editors can write stuff there. However, you wouldn't want to allow it in the comments, because everyone can write stuff there, and that would just make it too easy to do stuff like cross-site scripting.
对于 SQL 注入，
mysql_real_escape_string应该可以工作。 （为了完全确定，您可以使用准备好的语句）对于 XSS，
htmlspecialchars应该可以工作。strip_tags可能不那么安全，因为有人可以巧妙地伪装他们的 JavaScript。For SQL injection,
mysql_real_escape_stringshould work. (To be totally sure, you can use prepared statements)For XSS,
htmlspecialcharsshould work.strip_tagsmight not be as safe, as someone could cleverly disguse their javascript.每当您在 HTML 中嵌入用户提供的信息时，都应该使用
htmlspecialchars。每当您在 SQL 中嵌入用户提供的信息时，都应该使用 mysql_real_escape_string。遵循这些规则，你应该没问题。但请注意，更好的数据库安全解决方案是使用准备好的/参数化查询（请参阅 此处和此处），因为这些将为您处理逃逸，消除您遗忘的可能性。
另外，不要忘记检查魔术引号。
Whenever you are embedding user-supplied information in HTML, you should use
htmlspecialchars. Whenever you are embedding user-supplied information in SQL, you should usemysql_real_escape_string. Follow these rules and you should be OK.Note, however, that a better solution for database security would be to use prepared/parametrized queries (see here and here), as these will handle the escaping for you, eliminating the possibility of your forgetting.
Also, don't forget to check for magic quotes.
如果您要打印 HTML，则应首先使用 HTML Purifier 清理它。将其视为
strip_tags()的高级（且可自定义）版本。为了插入数据库，我使用准备好的语句。这是万无一失的。
If you are printing HTML you should clean it with HTML Purifier first. Think of it as an advanced (and customizable) version of
strip_tags().For insertion into database, I use prepared statements. It's foolproof.