PHP security filtering, validation, escaping

Do not trust external sources

• $_get
• $_post
• $_request
• $_cookie
• $argv
• Php://stdin
• Php://input
• File_get_contents ()
• Remote Database
• Remote API
• Data from the client

Htmlentities

<?php$input = ' <p><script>alert ("You won the Nigerian lottery!"); </script></p> '; Echo htmlentities ($input, ent_quotes, ' UTF-8 ');//<p><script>alert ("You won The Nigerian lottery! "); </script></p>

　　

Htmlpurifier

PHP security filtering, validation, escaping