PHP/JS：如何清理用户输入/输出
例如，假设我有一个接收并显示用户评论（文本）的网站。我担心接收用户提交内容以及显示提交内容时出现的漏洞。
关注点：
跨站点脚本攻击
SQL 注入
我的问题是是否还有更多攻击可能来自用户文本输入？另外，我可以通过哪些方式防范使用 PHP、Javascript 的此类攻击？
谢谢，圣诞快乐！
For example, let's say I have a website that receives and displays user comments (text). I am concerned with vulnerabilities from receiving user submissions and also when the submissions are displayed.
Concerns:
Cross-site scripting attack
SQL injection
My question is are there more attacks that could come from user text inputs? Also, in what ways can I guard against such attacks using PHP, Javascript?
Thanks, and merry Xmas!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
JavaScript 不是 XSS、CSRF 攻击的屏障，因此您应该关心服务器端保护。如果您谈论函数，那么这些将帮助您防范 XSS：htmlentities()、strip_tags()、utf8_decode()；正如 Zar 所说，mysql_real_escape_string 将帮助您避免 SQL 注入。
有很多文章专门讨论 SQL 注入、XSS、CSRF、会话劫持。转至 http://phpsec.org/projects/guide/ 并阅读全部内容。
JavaScript is not a barrier from XSS, CSRF attacks, so you should care about server side protection. If you talk about functions then these will help you from XSS: htmlentities(), strip_tags(), utf8_decode(); and as Zar said mysql_real_escape_string will help you from SQL injection.
There are a lot of articles devoted to SQL injections, XSS, CSRF, sessions hijacking. Go to http://phpsec.org/projects/guide/ and read it all.
您可以使用
strip_tags($var)来防范 XSS。mysql_real_escape_string($var)将为您提供基本的 SQL 注入保护。You can use
strip_tags($var)to guard yourself against XSS.mysql_real_escape_string($var)will give you basic SQL injection protection.看看 php 过滤器库，它可以清理和验证不同类型的数据，从布尔值到电子邮件地址，函数如 filter_input 和 <一个href="http://www.php.net/manual/en/function.filter-input-array.php" rel="nofollow">filter_input_array 可以使您的应用程序更加安全和智能。
Have a look at php Filter Library, which made to clean and validate different types of data, from boolean to email addresses, functions like filter_input and filter_input_array could make your application more secure and smart.
如果您使用 ajax 将一些表单数据作为 url 的一部分发送到服务器，请像这样对它们进行编码
，并记住在服务器端对它们进行解码。
If you are using ajax to send some form data to the server as part of url, encode them like this
and remember to decode them on the server side.