PHP $_POST 用户名卫生 - 这怎么不行

发布于 2024-12-10 09:25:55 字数 799 浏览 5 评论 0原文

我已经用谷歌搜索并搜索了所有内容，但我无法找到答案。

为什么下面的 PHP 代码让加号通过：（

$aValid = array('-', '_', '.');

if (ctype_alnum(str_replace($aValid, '', $_POST['Rusername']))){

如果用户输入 1234+，它会继续有效？？？）。

我通常会找到一个旁路，但这真的有必要吗？

$aValid = array('-', '_', '.'); 
if (ctype_alnum(str_replace($aValid, '', (htmlentities ( trim ( $_POST['Rusername'] ) , ENT_NOQUOTES ))))){
    echo "+ ok";
}else{
    echo "+ not ok";
}

我想使用这种验证，并在需要时向 $aValid 添加特殊字符。

在插入 MySQL 之前，我会执行 mysql_real_escape_string 或准备好的语句。

任何想法为什么 + 符号可以用于第一段代码。在我看来确实不应该。

最新更新 - 我需要几个小时的低级调试 HTTP 标头才能弄清楚我的 A 端更改了 Content-Type，以便 + 符号在到达 PHP if 子句之前变成了空格（在我的白名单中允许）...

多么棒的经历——我希望它永远不会发生在你身上——:)

提醒自己：如果 jQuery 在这个验证过程中扮演了如此重要的角色，那么应该提及它......

原文

I've googled and searched SO and everything, but I can't come to an answer.

Why is the PHP code below letting plus sign through:

$aValid = array('-', '_', '.');

if (ctype_alnum(str_replace($aValid, '', $_POST['Rusername']))){

(If user types 1234+ it goes on like it vas valid????).

I, normally, found a bypass, but is it really necessary;

$aValid = array('-', '_', '.'); 
if (ctype_alnum(str_replace($aValid, '', (htmlentities ( trim ( $_POST['Rusername'] ) , ENT_NOQUOTES ))))){
    echo "+ ok";
}else{
    echo "+ not ok";
}

I would like to use this kind of validation and just add special chars to $aValid when needed.

Before inserting to MySQL I would do mysql_real_escape_string or prepared statements.

Any ideas why the + sign is ok for first piece of code. In my opinion it really should't be.

Latest update - I needed few hours of low-level debugging HTTP headers to figure iz out that my A side changed the Content-Type so that the + sign became space before it got to PHP if clause (alowed in my whitelist)...

What an - I hope it will never happen to you - experience :)

Reminder to myself: jQuery should be mentioned if it was such a major player in this validation process...

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

多谢你的绝情让我学会死心 2024-12-17 09:25:55

您应该做的是检查过程的每个阶段，而不是将它们全部放入一行：

$name = $_POST['Rusername'];
var_dump($name);
$name = str_replace($aValid, '', $name);
var_dump($name);

等等...基本调试。如果声明中有多个阶段，请检查每个单独的阶段。 ctype 可能工作得很好，但 str_replace 不知怎的让你失败了。

What you should do is inspect each stage of the process, rather than slamming them all into a single line:

$name = $_POST['Rusername'];
var_dump($name);
$name = str_replace($aValid, '', $name);
var_dump($name);

etc... Basic debugging. If you've got multiple stages in a statement, then check each individual stage. ctype may be working perfectly fine, but the str_replace is failing you somehow.

回复收藏 0 原文