Highlights of common php Security filter functions and php functions-PHP Tutorial

A collection of common security filter functions in php and a collection of php functions. A collection of common security filter functions in php. although various development frameworks provide us with good security solutions, we still need to pay attention to security issues. Collections of common php Security filter functions and php functions

Although various development frameworks provide us with good security solutions, we should pay attention to security issues.
The reason is simple: many small functions and projects cannot use the framework. we need to solve the security problem on our own!

① Common security functions:

The code is as follows:

Mysql_real_escape_string ()
Addslashes ()

② Functions:

The mysql_real_escape_string () and addslashes () functions escape single quotes and double quotes in data! That is to prevent SQL injection!
However, mysql_real_escape_string () takes into account the character set, which is more secure!
After reading the relevant information, we can draw a conclusion: if the current character set is single-byte, the two functions share the same role and can play the role of escape filtering. However, who will only use a single byte? Especially utf8 is widely used!

③ Function usage:

When you understand the usage of mysql_real_escape_string () and addslashes () functions, you must first understand the meanings of the other two functions!

Get_magic_quotes_gpc () and get_magic_quotes_runtime (). let's compare the similarities and differences between the two functions:

Same:

A. Both are used to obtain the configuration of the php. ini configuration file! 1 is returned when it is enabled, and 0 is returned when it is disabled!

B. When enabled, escape filtering is performed for data within the specified range!

Different:
A. The two have different scopes:
Magic_quotes_gpc mainly applies to web clients. In short, it mainly filters data in $ _ GET, $ _ POST, and $ _ COOKE!
Magic_quotes_runtime is mainly used to filter data read from files or data obtained from database queries!
B. The Setting time is different:
Magic_quotes_gpc cannot be set at runtime [this setting can only be read when the server is restarted]
Magic_quotes_runtime can be set at runtime!
Note: the so-called runtime setting means that we can use the ini_set () function to set the configuration in the php. ini file in the script!

After understanding the functions get_magic_quotes_gpc () and get_magic_quotes_runtime (), we should understand: when we detect php. if magic_quotes_runtime and magic_quotes_gpc are enabled in the ini configuration file, data within the specified range is automatically escaped! If it is disabled, we need to use mysql_real_escape_string () [or the addslashes function for filtering]

④ Example:

1. whether magic_quotes_gpc or magic_quotes_runctime is enabled or disabled, the getdata. php script can transfer data securely. the content is as follows:

The code is as follows:

<? Php
If (! Get_magic_quotes_gpc ()){
Foreach ($ _ GET as $ key =>&$ value ){
$ Value = mysql_real_escape_string ($ value );
}
}
If (! Get_magic_quotes_runtime ()){
$ SourceDataRecord = file ('./sourceData.txt ');
If ($ sourceDataRecord ){
Foreach ($ sourceDataRecord as $ sourceKey => & $ sourceValue ){
$ SourceValue = mysql_real_escape_string ($ sourceValue );
}
}
}
$ GpcData = implode ("\ t", $ _ GET );
$ RuntimeData = implode ("\ t", $ sourceDataRecord );
Echo $ gpcData, $ runtimeData;
?>

The content in sourcedata.txt is as follows:

The code is as follows:

"It's anoterh Sunday afternoon
I'm trunning turnning... turnning around"

The url when we request getData. php is as follows:

Php.test.com/safe/getdata.php? Name = maw'eibin & age = 25

The execution result is as follows:

The code is as follows:

Maw \ 'ibin 25 \ "It \'s anoterh Sunday afternoon \ r \ n I \'m trunning
Turnning... turnning around \"

⑤ References:

Http://www.bkjia.com/article/35868.htm

Many php Security filter functions often replace some characters. isn't the user input very bad? Solution

As you said, security filtering is necessary to restrict user behaviors for security purposes. what users do you want to restrict? It is a user who intentionally harms website security. For example:
Filter the html tags in the title. Because the layout is pure, 1.html tags will lead to layout disorder. 2. dangerous scripts will be contained. 3. encode quotation marks and other characters into html entities without affecting the final display effect;
Filter out the script tag in the text. Because normal users do not execute scripts at all. Therefore, we generally have two methods: 1. remove the script and 2. use html entity character encoding labels so that the code segment can be displayed and the code will not be executed in the displayed article;
Filter single quotes of query parameters. This is to prevent SQL injection. There are three methods to achieve this: 1. add backslashes to quotation marks 2. remove quotation marks 3. dynamically bind parameters with SQL prepare;
In short, do not trust any user input. the restriction is to make better use of our services for more common users.

What are the PHP filter functions?

Addslashes ()
Mysql_real_escape_string
It is used for security filtering when the database is inserted, generally transcoding.
Htmlspecialchars: There are also some functions in the html series. You mentioned this is one of the mid-term functions. this is to encode the data when it is output to a browser or terminal, prevents the output data from being transcoded by malicious js code or other code.

Strip_tags: this is to remove some html tags and some php tags. you can use them wherever you want to filter them.

Although various development frameworks provide us with good security solutions, we still need to pay attention to security issues ....