Common escape functions in PHP

1. addslashes

Addslashes escapes special characters in SQL statements, including ('), ("), (), (NUL, this function is used when the DBMS does not have its own escape function. However, if the DBMS has its own escape function, it is recommended to use the original function. For example, MySQL has the mysql_real_escape_string function to escape SQL. Note that magic_quotes_gpc is enabled by default before PHP5.3. It is mainly used to perform the addslashes operation on $ GET, $ POST, and $ cookies. Therefore, you do not need to repeatedly call addslashes on these variables, otherwise, it will be double escaping. However, magic_quotes_gpc has been deprecated in PHP5.3 and removed from PHP5.4. If you use the latest PHP version, do not worry about this problem. Stripslashes is the unescape function of addslashes.

2. htmlspecialchars

Htmlspecialchars converts several special characters in HTML into HTML Entity (Format: & xxxx;), including (&), ('), ("), (<), (>) five characters.

& (AND) => &
"(Double quotation marks) =>" (when ENT_NOQUOTES is not set)
'(Single quotes) =>' (when ENT_QUOTES is set)
<(Minor sign) => <
> (Greater than the number) =>
Htmlspecialchars can be used to filter $ GET, $ POST, and $ COOKIE data to prevent XSS attacks. Note that the htmlspecialchars function only escapes HTML characters that are considered to have security risks. to escape all HTML characters that can be escaped, use htmlentities. Htmlspecialchars_decode is the decode function of htmlspecialchars.

3. htmlentities

Htmlentities converts the escaped content in HTML to HTML Entity. Html_entity_decode is the decode function of htmlentities.

4. mysql_real_escape_string

Mysql_real_escape_string will call the MySQL library function mysql_real_escape_string, escape (\ x00), (\ n), (\ r), (), ('), (\ x1a, add a backslash () to prevent SQL injection. Note that you do not need to call stripslashes for unescape when reading database data, because these backslashes are added when the database executes SQL statements, when data is written to the database, the backslash will be removed. Therefore, the content written to the database is the raw data, and the backslash will not be added before.

5. strip_tags

Strip_tags filters NUL, HTML, and PHP tags.

6. Conclusion

PHP built-in security functions cannot completely avoid XSS. We recommend that you use HTML Purifier.