确保评论安全
我正在尝试创建一个评论系统。我正在使用 php-OEmbed 类和 HTML 净化器。我可以使用什么过滤器来确保评论可以安全地插入到我的数据库中？我知道您可以使用 PHP 过滤器，例如 FILTER_SANITIZE_STRING，但是这些不会将 HTML 转换为实体吗？
另外，如果您使用诸如 WMD 编辑器之类的东西，那么您是否必须在客户端使用某些东西作为好吧（比如 PHP Markdown）以确保它是安全的？
I'm experimenting with creating a commenting system. I'm using php-OEmbed class and HTML Purifier. What filter can I use to ensure that the comments are safe to be inserted into my database? I know you can use PHP filters such as FILTER_SANITIZE_STRING, but won't these turn the HTML into entities?
Also if you use something like the WMD editor, do you then have to use something on the client side as well (like PHP Markdown) to ensure that it is safe?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您不需要使用任何过滤器来进行 SQL 注入。更好的解决方案是使用准备好的语句。例如，PDO 提供 PDOStatement。
You don't need to use any filter for SQL injection. A preferable solution is to use prepared statements. For instance, PDO provides PDOStatement.
基本上，每当您将用户输入发送到某个地方时，您都需要对其进行清理。
当您将其放入数据库时，您需要通过引用 SQL 特殊字符来防止 SQL 注入（准备好的语句将为您执行此操作）。当您将其发送到浏览器时，您需要转义 HTML 特殊字符（PHP 有执行此操作的函数）以防止脚本注入。
可能还有其他地方也需要转义特殊字符。例如，如果您将注释发送到服务器上的 Bash 脚本以进行某种处理。在这种情况下，您需要引用或转义 Bash 特定的特殊字符。
重要的是不要在错误的阶段引用/转义：例如，当您将 HTML 实体放入数据库时，不要对其进行转义，除非您完全确定自己在做什么。当您将其从数据库中拉出并准备将其发送到浏览器时，很容易再次意外地转义，或者在数据库连接失败时发送错误消息时根本不会转义（这可能会导致 XSS 漏洞） ）。在最后一刻逃跑，你很可能会避免这些陷阱。
Basically you need to sanitize user input whenever you send it somewhere.
When you put it into your database you need to prevent SQL injection by quoting SQL special characters (prepared statements will do this for you). When you send it to a browser you need to escape HTML special characters (PHP has functions for doing this) to prevent script injection.
There may be other places where you need to escape special characters, too. For example, if you send the comments to a Bash script on the server to do some kind of processing. In that case you'd need to quote or escape Bash-specific special characters.
It's important to not quote/escape at the wrong stage: for example, don't escape HTML entities when you put it into the database unless you are absolutely sure of what you're doing. It's very easy to accidentally escape things again when you pull it out of the database and prepare to send it to a browser, or not escape things at all if you are sending an error message if the database connection fails (this could cause an XSS vulnerability). Do your escaping at the last moment and you will most likely avoid these pitfalls.