PHP Common Security filter function collection, PHP function collection _php Tutorial

A collection of security filtering functions commonly used in PHP, a collection of PHP functions

While the various development frameworks provide us with a good security approach, we still have to pay attention to security issues.
The reason is simple: many small functions and projects are not used in the framework, we need to solve security problems ourselves!

What are the common security functions of ①:
Copy the Code code as follows:
Mysql_real_escape_string ()
Addslashes ()

② the function of these functions:

Both the mysql_real_escape_string () and the Addslashes () functions escape single and double quotes in the data! That is, prevent SQL injection!
But Mysql_real_escape_string () considered the character set, a bit more secure!
After consulting the relevant information, we can draw a conclusion: the current character set is a single byte, the two functions are the same, can play the role of escape filtering, but who would just use a single byte? Especially the UTF8 is being used more and more widely!

Use of the ③ function:

In understanding the use of the two functions of mysql_real_escape_string () and addslashes (), we must first understand the meaning of the other two functions!

GET_MAGIC_QUOTES_GPC () and Get_magic_quotes_runtime (), let's compare the similarities and differences of the two functions:

Same:

A, both are used to get the configuration of the php.ini configuration file! Returns 1 when turned on, returns 0 when closed!

B, when opened, will be in the specified range of data to escape filtering!

Different:
A, the scope of the two different:
MAGIC_QUOTES_GPC mainly in the Web client, the simple is mainly to $_get, $_post, $_cooke data Filtering!
Magic_quotes_runtime is mainly to filter the data read in the file or the data from the database query!
b, the setting time is different:
MAGIC_QUOTES_GPC cannot be set at run time [this setting can only be read when the server is restarted]
Magic_quotes_runtime can be set at run time!
Note: The so-called runtime settings, that is, we can use the Ini_set () function, in the script in the php.ini file configuration settings!

After understanding the two functions of GET_MAGIC_QUOTES_GPC () and Get_magic_quotes_runtime (), we should understand: when we detect that the php.ini configuration file opens the Magic_quotes_runtime and MAGIC_QUOTES_GPC, the data in the specified range will be automatically escaped! If it is off, we need to use mysql_real_escape_string () [or addslashes function for filtering]

④ Examples:

1, regardless of MAGIC_QUOTES_GPC and magic_quotes_runctime open or close the case of getdata.php script, can be the data security transfer, the content is as follows:
Copy the Code code as follows:
<?php
if (!GET_MAGIC_QUOTES_GPC ()) {
foreach ($_get as $key = & $value) {
$value = mysql_real_escape_string ($value);
}
}
if (!get_magic_quotes_runtime ()) {
$sourceDataRecord = File ('./sourcedata.txt ');
if ($sourceDataRecord) {
foreach ($sourceDataRecord as $sourceKey = & $sourceValue) {
$sourceValue = mysql_real_escape_string ($sourceValue);
}
}
}
$gpcData = implode ("\ T", $_get);
$runtimeData = implode ("\ T", $sourceDataRecord);
Echo $gpcData, $runtimeData;
?>

The content in SourceData.txt is as follows:

Copy the Code code as follows:
"It ' s anoterh Sunday afternoon
I ' m trunning turnning.....turnning around "

The URL of our request getdata.php is as follows:

Php.test.com/safe/getdata.php?name=maw ' eibin&age=25

The results of the implementation are as follows:

Copy the Code code as follows:
Maw\ ' Eibin 25\ "it\ ' s anoterh Sunday afternoon\r\n i\ ' m trunning
Turnning.....turnning around \ "

⑤ Reference:

Http://www.bkjia.com/article/35868.htm

See a lot of PHP security filter functions, often to replace some characters, the user input information changed is not very bad? Solution

As you said, security filtering, restricting user behavior for security purposes is a must, do you think about what kind of user the limit is for? is intended to compromise the security of the site users. For a few examples:
Filter the HTML tags in the header. Because headings are generally plain text, 1.html labels can cause the layout to go out of order. 2. It will contain dangerous script 3. Encoding the quotes and other characters into an HTML entity does not affect its final appearance;
Put the text in the