Do you use PDO to filter user input?

How to filter if you use it?

Reply content:

How to filter if you use it?

Simple filtering definitely needs to be filtered, like data length, data type, and so on, PDO just solves the problem of SQL injection. Other procedural logic problems have to be solved by themselves.

It is better to filter it out, although PDO preprocessing can prevent SQL injection. Like intval ; trim These simple character processing is not much to say. Filter mainly consider some special characters, as follows I deal with the character of a method, you can refer to, I hope to help you

/** * description 过滤转义POST|GET的数据 */function isEscape($val, $isboor = false) {    if (! get_magic_quotes_gpc ()) {        $val = addslashes ( $val );    }    if ($isboor) {        $val = strtr ( $val, array (                "%" => "\%",                "_" => "\_"         ) );    }    return $val;}

PHP version <=5.3.6 my local test set setattribute (Pdo::attr_emulate_prepares, false) also local processing prepare, do not know is not my test problem, tested two PHP version PHP 5.2.3/5.2.17

The pit will be filtered! Also filtering XSS, etc.

Like XSS.

