PHP 输出帮助
代码 -
$price = mysqli_real_escape_string($connect,trim($results['price']));
从数据库中检索价格，然后使用 -
echo $price;
问题 - 这对于 XSS 或 SQL 注入是否足够安全？它仅包含数字。
谢谢
Code -
$price = mysqli_real_escape_string($connect,trim($results['price']));
price is retrieved from the database, and then echoed using -
echo $price;
Question - Is this safe enough from XSS or SQL Injection? It simply includes numbers.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
检查可能应该在数据输入期间完成，但您可以安全地在输出时进行检查。我只会使用
is_numeric或类似的东西可以确保输出确实是一个数字。The checking should probably be done during data input, but you could be safe and also check at output. I would just use
is_numericor something similar to ensure that the output is, indeed, a number.标准做法是使用
htmlspecialchars()或htmlentities()将输出转义到浏览器以防止 XSS。然而，正如另一个答案中提到的，真正的问题是数据库中是否首先存储了正确的数据。在存储到数据库之前，应该对其进行正确的验证和转义。Standard practice is to use
htmlspecialchars()orhtmlentities()to escape output to the browser for protection against XSS. However as mentioned in another answer, the real issue is whether correct data was stored in the database in the first place. It should be properly validated and escaped before storage in the database.为了安全起见，您需要评估
$results['price']的输入是否来自用户输入。如果是，您需要在将其发送到 SQL 之前将其严格验证/清理为预期值。
To be safe you need to asses if the input for
$results['price']from user input.If it is you need to strongly validate/sanitize it as an expected value before sending it to SQL.
如果您的数据仅从数据库读取，您可以使用 mysqli_real_escape_string() 忽略。它对于转义应写入数据库的用户输入非常有价值。
If your data is only read from the db you can ignore using mysqli_real_escape_string(). It's valuable for escaping user input which should be written to the db.
mysqli_real_escape_string() 用于转义要插入数据库的数据，以防止 SQL 注入。与XSS无关。
你必须使用 htmlentities() 来做你想做的事。我建议您阅读 eykanal 答案并使用 is_numeric 进行验证。
mysqli_real_escape_string() is used to escape data about to be inserted IN the database, to prevent SQL Injection. It has nothing to do with XSS.
You have to use htmlentities() to do what you want to do. I suggest you to read eykanal answer and use is_numeric to validate.