从 $_GET/$_POST 获取信息并将其保存到数据库的做法？
当涉及到从 get/post 获取信息并将信息保存到数据库时，当今的最佳实践是什么？数据是否仍像以前一样进行转义，或者是否还有其他做法？另外，HTMLPurifier 可以用在什么地方呢？我目前正在使用它来过滤富文本。
What are today's best practises when it comes to getting information from a get/post and saving information to a database? Is data still escaped like it used to or are there additional practises? Also, where can HTMLPurifier fit in this? I'm currently using it to filter rich text.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
永远不要将 GET 中的数据保存到数据库。
永远不要保存来自 GET 的数据，即使您进行了足够的验证和转义。 GET 不应更改服务器上的信息。
在更改服务器上的任何内容（数据库或服务器文件）之前，检查请求是否是 POST、PUT 或 DELETE（如果适用）
POST 应该更改服务器的状态。因此，在更新表或更改服务器上的任何文件之前，请检查请求方法是否为 post。
处理前验证输入
如果您期望一个整数，请验证输入确实是一个整数。
在数据库查询中使用或添加到输出之前转义输入
出于查询目的转义输入，如果您使用输入直接打印到输出，则去掉斜杠并对其进行清理。
当您拥有用户会话权限时，请使用易过期的令牌进行 POST
如果您有用户登录，请使用访问令牌，并在每次访问或 5 分钟左右更新令牌。
当您没有用户会话时使用访问令牌
正如 Ankur 建议的那样，当您没有登录会话时使用访问令牌。但这并不可靠。
Never Save data from GET to db.
Never ever save data from GET, even if you are doing sufficient validation and escaping. GET is not supposed to change information on server.
Before changing anything on server (DB or Server File) check if request is POST or PUT or DELETE as applicable
POST is supposed to change state of the server. Hence before updating your tables or changing any file on server check if request method is post.
Validate inputs before processing
If you are expecting an integer validate that input is indeed an integer.
Escape inputs before using in db queries or adding to output
For query purposes escape the inputs and in case you are using input to be directly printed to the output then strip the slashes and sanitize it.
Use perishable tokens for POST when you have privilege of user sessions
Use access tokens in case you have user logged in and update the token every access or 5mins or so.
Use access tokens when you don't have user session
As Ankur suggested use access tokens when you don't have login session. But this is not reliable.
您永远不应该假设来自 GET 或 POST 的信息已正确转义，即使您在网站上进行验证，也可以禁用 javascript 并且可以手动编码请求以进行 SQL 注入攻击。生成查询字符串时使用
mysql_real_escape_string()。http://php.net/manual/en/function.mysql -real-escape-string.php
据我通过快速阅读可以看出，HTML Purifier 是解析 WYSIWYG 编辑器或任何您期望正确 HTML 的输出来自用户。它使您可以控制禁止和过滤某些内容（例如脚本），并确保所有标签都正确嵌套和关闭。如果您在从数据库读回数据后将 HTML 转储到页面中，这一点尤其重要。
You should never assume that information from GET or POST is properly escaped, even if you do validation on your website, javascript can be disabled and requests can be manually coded to do an SQL injection attack. Use
mysql_real_escape_string()when generating your query string.http://php.net/manual/en/function.mysql-real-escape-string.php
As far as I can tell from quickly reading up on it, HTML Purifier is to parse output from WYSIWYG editors or anywhere where you're expecting proper HTML from the user. It gives you control to disallow and filter out certain things (like scripts) and makes sure all tags are properly nested and closed. It is especially important if you're dumping the HTML into your page after reading the data back from the database.
在将数据放入数据库之前，切勿将数据转义为表示格式；如果合适的话对其进行清理，但始终让数据库包含“最原始”形式的数据。
在显示之前始终将数据转义为表示格式，除非确定数据不应转义并且不转义是安全的。
Never escape data into a presentation format before putting it in a database; sanitize it if appropriate, but always have the database contain the "rawest" form of the data.
Always escape data into a presentation format before displaying, unless it is certain that the data should not be escaped and that it is safe to not escape it.
好吧，这取决于你的价值观是什么以及它们来自哪里。简短而甜蜜的答案是：
ESCAPE AND SANITIZE，
这意味着确保将所有字符串放在引号中，并确保转义用户提交的字符串中的所有特殊字符。类型匹配和长度检查。
Well it depends on what your values are and where they are coming from. The short and sweet answer is:
ESCAPE AND SANITIZE
which means make sure you put all strings in quotes and make sure you escape all special characters in user submitted strings. Type match and length check.