php 中的安全首选项、php 函数来清理输入
我有以下函数可以清理来自用户或 url 的输入：
function SanitizeString($var)
{
$var=stripslashes($var);
$var=htmlentities($var, ENT_QUOTES, 'UTF-8');
$var=strip_tags($var);
return $var;
}
我不知道除了这个 php 函数之外是否还使用该函数：
mysql_real_escape_string()..
我也不知道是否采取了所有预防措施来清理该
输入也有剥离标签的问题..因为我使用的是tiny_MCE..并且不剥离它们很重要..
如何在将html字符送入之前将其状态返回为html字符数据库？
I have the following function that sanitizes input from the user or the url:
function SanitizeString($var)
{
$var=stripslashes($var);
$var=htmlentities($var, ENT_QUOTES, 'UTF-8');
$var=strip_tags($var);
return $var;
}
I dont know whether to use that function in addition to this php function:
mysql_real_escape_string()..
I also dont know if I take all the precautions to sanitize that input
I also have a problem of stripping tags..cause I am using tiny_MCE..and not stripping them is important..
How do I return the state of the html characters as html characters before they were feed into the database?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
无论如何，先验地清理输入都是错误的。剥离标签与数据库有什么关系？从什么时候开始恶意脚本在数据库中运行？
过度谨慎是一件好事，除非你这样做时没有逻辑。
仅根据“可疑”内容需要去的地方进行消毒。
数据库？然后对数据库进行转义，避免SQL注入。使用
mysql_real_escape_string()< /strong> 或参数化查询，然后就可以了。HTML 页面？清理你的 html 以避免 XSS 和其他讨厌的事情。使用
htmlentities()< /strong>，或其他更复杂的解决方案，但在输出之前执行此操作。如果您在数据库中保存一个 html 页面，然后剥离所有标签（顺便说一句，strip_tags() 做得很糟糕，并在
htmlentities()不是最好的事情）？如果您稍后需要返回 html 该怎么办？试想一下，使用要解码 htmlentities() 形式，只需使用..<代码>html_entity_decode()
Sanitizing inputs a priori, no matter what, is wrong. What does stripping tags has to do with databases? Since when malicious scripts run inside a database?
Being overprecautius is a good thing, except when you do it without a logic.
Sanitize only according to where the "suspect" content need to go.
A database? then escape for the database, to avoid SQL injections. Use
mysql_real_escape_string()or parametrized queries and you're set.Html page? Sanitize your html to avoid XSS and other nasty things. Use
htmlentities(), or other more sophisticated solutions, but do that JUST BEFORE OUTPUTTING.What if you save an html page inside your db, and you strip all tags instead (btw, strip_tags() does this job badly, and calling it after
htmlentities()is not the best thing)? What if you later need the html back? Just think about it, what harm does to a database the use of the<script>tag, or a link to a malaware? Aren't they harmful only when they're printed on a page?To decode form htmlentities(), just use..
html_entity_decode()如果您正在讨论如何在将 HTML 放在屏幕上之前对其进行清理（您在问题中没有真正提到，但在评论中提到了），那么它比您想象的要复杂得多。
看看：
http://iamcal.com/publish/articles/php/processing_html/
和
http://www.iamcal.com/publish/articles/php/processing_html_part_2/
If you're talking about how to sanitize the HTML that comes out before you put it on the screen (which you don't really mention in your question but do in your comments), it's far more complicated than you might think.
Take a look at:
http://iamcal.com/publish/articles/php/processing_html/
and
http://www.iamcal.com/publish/articles/php/processing_html_part_2/
在 (MYSQL) 数据库中存储内容时，您需要使用 mysql_real_escape_string。如果您使用 PDO 和准备好的语句，PDO 将为您处理转义。这可以保护您免受 SQL 注入攻击。
当您打印用户生成的内容（文本、评论等）时，您需要在输出任何内容之前使用
htmlspecialchars或htmlentitites等。哪一种适合取决于您的用例。无论您决定选择哪一种，您都只需要一个。这将保护您免受 XSS 攻击。只要禁用魔术引号<，您就永远不需要
stripslashes等< /a>.When storing something in a (MYSQL) database, you'll want to use
mysql_real_escape_string. If you're using PDO and prepared statements, PDO will take care of escaping for you. This protects you from SQL injection attacks.When you print user generated content (texts, comments etc), you'll want to use either
htmlspecialcharsorhtmlentititesor the like before you output anything. Which one is appropriate depends on your use case. Whichever you decide on, you'll only need one. This will protect you from XSS attacks.You never need
stripslashesetc. as long as magic quotes are disabled.