Poor PHP code simplification

Source: Internet
Author: User
Tags echo command

Copy codeThe Code is as follows:
<?
Echo ("<p> search results for query :").
$ _ GET ['query']. ". </p> ";
?>

The main problem with this Code is that it directly displays the data submitted by the user on the webpage, resulting in an XSS vulnerability. There are actually many ways to fill this vulnerability. So what code is what we want?
Copy codeThe Code is as follows:
<?
Echo ("<p> search results for query :").
Htmlspecialchars ($ _ GET ['query']). ". </p> ";
?>


This is the minimum requirement. The XSS vulnerability is filled by the htmlspecialchars function, thus blocking invalid characters.
Copy codeThe Code is as follows:
<? Php
If (isset ($ _ GET ['query'])
Echo '<p> search results for query :',
Htmlspecialchars ($ _ GET ['query'], ENT_QUOTES). '. </p> ';
?>

The person who can write this code should be the one I want to hire:
* <? Replaced with <? Php, which is more in line with XML specifications.
* Determine whether the $ _ GET ['query'] value is null before outputting it.
* The extra parentheses in the echo command are removed.
* The string is limited by single quotes, which saves PHP time to search for replaceable variables from the string.
* Use commas instead of periods to save the echo time.
* The ENT_QUOTES identifier is passed to the htmlspecialchars function to ensure that single quotes are escaped. Although this is not the most important one, it is also a good habit.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.