PHP Security-Output escape

Output escape

Another basis for Web application security is to escape the output or encode special characters to ensure that the original intent remains the same. For example, O ' Reilly needs to be escaped into o\ ' Reilly before being routed to the MySQL database. A backslash before a single quote represents a single quotation mark as part of the data itself, not its original meaning.

The output escaping I mean is specifically divided into three steps:

L Recognition Output

L Output Escape

L distinguish between escaped and non-escaped data

It is necessary to only escape filtered data. Although escaping can prevent many common security vulnerabilities, it does not replace input filtering. Contaminated data must first be filtered and then escaped.

When escaping the output, you must first identify the output. Typically, this is much simpler than identifying input because it relies on the actions you take. For example, when you identify the output of the client, you can look up the following statements in your code:

echoprintprintf<?=

As a developer of an application, you need to know where each output is to an external system. They make up the output.

Like filtering, the escape process varies depending on the situation. Filtering is also different for different types of data processing methods, and escaping is based on the different ways you can transfer information to different systems.

There are built-in functions available in PHP for escaping some common output targets, including clients, databases, and URLs. It's important to be foolproof if you're going to write an algorithm of your own. It is necessary to find a reliable and complete list of the special characters in the external system, and how they are represented, so that the data is retained rather than translated.

The most common output target is the client, and using Htmlentities () to escape the data before it is emitted is the best method. As with other string functions, the input is a string that is processed for output. However, the best way to use the Htmlentities () function is to specify two optional parameters for it: The escape method of the quotation marks (the second parameter) and the character set (the third parameter). The escape method for quotation marks should be specified as Ent_quotes, which is designed to escape both single and double quotes, which is the most thorough, and the character set argument must be matched to the character set used by the page.

To differentiate whether the data is escaped, I recommend defining a naming mechanism. For escaping data that is output to the client, I use the $html array for storage, which is first initialized to an empty array, saving all filtered and escaped data.

CODE:

<?php   $html = Array (  );  $html [' username '] =htmlentities ($clean [' username '], ent_quotes, ' UTF-8 ');  echo "<p>welcome back,{$html [' username ']}.</p>";   ? >

Little Tips

The Htmlspecialchars () function is basically the same as the htmlentities () function, whose parameter definitions are identical, except that the escape of htmlentities () is more thorough.

by $html[' username ' to output the username to the client, you can ensure that the special characters are not interpreted by the browser incorrectly. If the username contains only letters and numbers, it is not necessary to actually escape, but this embodies the principle of deep defense. Escaping any output is a very good habit and it can dramatically improve the security of your software.

Another common output target is the database. If possible, you need to escape the data in the SQL statement using PHP built-in functions. For MySQL users, the best escape function is mysql_real_escape_string (). Addslashes () is the last option if you are using a database that does not have PHP built-in escape functions available.

The following example illustrates the correct escape technique for a MySQL database:

CODE:

<?php   $mysql = Array (  );  $mysql [' username '] =mysql_real_escape_string ($clean [' username ']);  $sql = "SELECT * from Profile          WHERE  username = ' {$mysql [' username ']} '";  $result = mysql_query ($sql);   ? >

The above is the PHP security-output escaped content, more relevant content please pay attention to topic.alibabacloud.com (www.php.cn)!

