Two simple methods to prevent SQL injection and XSS attacks in PHP

All printed statements, such as echo and print, must be filtered using htmlentities () before printing. This prevents Xss. Note that htmlentities mysql_real_escape_string () must be written in Chinese ()

Therefore, if an SQL statement is written like this: "select * from cdr where src =". $ userId; must be changed to $ userId = mysql_real_escape_string ($ userId)

All printed statements, such as echo and print, must be filtered using htmlentities () before printing. This prevents Xss. Note that htmlentities ($ name, ENT_NOQUOTES, GB2312) must be written in Chinese ).