PHP some basic security processing Tips _php Tutorial

There are built-in functions available in PHP for escaping some common output targets, including client, database tutorials, and URLs.
It's important to be foolproof if you're going to write an algorithm of your own. It is necessary to find a reliable and complete list of the special characters in the external system, and how they are represented, so that the data is retained rather than translated.
The most common output target is the client, and using Htmlentities () to escape the data before it is emitted is the best method. As with other string functions, the input is a string that is processed for output. However, the best way to use the Htmlentities () function is to specify two optional parameters for it: The escape method of the quotation marks (the second parameter) and the character set (the third parameter). The escape method for quotation marks should be specified as Ent_quotes, which is designed to escape both single and double quotes, which is the most thorough, and the character set argument must be matched to the character set used by the page.
To differentiate whether the data is escaped, I recommend defining a naming mechanism. For escaping data that is output to the client, I use the $html array for storage, which is first initialized to an empty array, saving all filtered and escaped data.

$html = Array ();
$html [' username '] = htmlentities ($clean [' username '], ent_quotes, ' UTF-8 ');
echo "

Welcome back, {$html [' username ']}.

";
?>

Little Tips
The Htmlspecialchars () function is basically the same as the htmlentities () function, whose parameter definitions are identical, except that the escape of htmlentities () is more thorough. by $html[' username '] to output the username to the client, you can ensure that special characters are not browsed
The error is explained by the device. If the username contains only letters and numbers, it is not necessary to actually escape, but this embodies the principle of deep defense. Escaping any output is a very good habit and it can dramatically improve the security of your software.
Another common output target is the database. If possible, you need to escape the data in the SQL statement using PHP built-in functions. For MySQL users, the best escape function is the MySQL tutorial _real_escape_string (). Addslashes () is the last option if you are using a database that does not have PHP built-in escape functions available.
The following example illustrates the correct escape technique for a MySQL database:

$mysql = Array ();
$mysql [' username '] = mysql_real_escape_string ($clean [' username ']);
$sql = "SELECT *
From profile
WHERE username = ' {$mysql [' username ']} ';
$result = mysql_query ($sql);
?>

http://www.bkjia.com/PHPjc/629700.html www.bkjia.com true http://www.bkjia.com/PHPjc/629700.html techarticle there are built-in functions available in PHP for escaping some common output targets, including client, database tutorials, and URLs. If you want to write an algorithm of your own, do the foolproof very heavy ...

