_php tutorials for escaping functions commonly used in PHP

1. addslashes

Addslashes escapes special characters in SQL statements, including ('), ("), (), (NUL) four characters, which are used when the DBMS does not have its own escape function, but if the DBMS has its own escape function, it is recommended to use the original function. For example, MySQL has the mysql_real_escape_string function to escape SQL. Note that before PHP5.3, MAGIC_QUOTES_GPC is turned on by default and is performed addslashes operations on $get, $POST, $COOKIE, so you do not need to call addslashes repeatedly on these variables, or double Escaping's. However, MAGIC_QUOTES_GPC in PHP5.3 has been abandoned, from the beginning of PHP5.4 has been removed, if you use the latest version of PHP can not worry about this problem. Stripslashes is the unescape function for addslashes.

2. Htmlspecialchars

Htmlspecialchars escapes several special characters in HTML into the form HTML Entity (format:&xxxx;), including (&), ('), ("), (<), (>) five characters.

& (And) = &
"(double quotes) = =" (When Ent_noquotes is not set)
' (single quotes) = ' (when ent_quotes set)
< (less than) = <
> (greater than) = >
Htmlspecialchars can be used to filter $get, $POST, $COOKIE data, and prevent XSS. Note that the Htmlspecialchars function simply escapes HTML characters that are considered to have security implications, and if you want to escape all the characters that can be escaped from HTML, use Htmlentities. Htmlspecialchars_decode is the decode function for Htmlspecialchars.

3. Htmlentities

Htmlentities escapes the contents of HTML that can be escaped to HTML Entity. Html_entity_decode is the decode function for htmlentities.

4. mysql_real_escape_string

Mysql_real_escape_string will call MySQL's library function mysql_real_escape_string, yes (\x00), (\ n), (\ R), (), ('), (\X1A) escaped, that is, precede the backslash (), Prevent SQL injection. Note that you do not need to call stripslashes to unescape when reading database data, because these backslashes are added when the database executes SQL, and the backslash is removed when the data is written to the database, so the content written to the database is the original data. Does not have a backslash in front of it.

5. Strip_tags

Strip_tags will filter out nul,html and PHP tags.

6. Conclusion

PHP comes with a security function that does not completely avoid XSS, and it is recommended to use HTML purifier

http://www.bkjia.com/PHPjc/736834.html www.bkjia.com true http://www.bkjia.com/PHPjc/736834.html techarticle 1. Addslashes Addslashes escapes special characters in SQL statements, including ('), ("), (), (NUL) four characters, which are used when the DBMS does not have its own escape function, but ...

