Questions about the escape of submitted content

For more information about the submitted content escaping, please refer to the following link: Generally, when writing a PHP program, do you need to execute escaping before the textarea data is submitted to the database? because if there is php code in the content submitted by textarea will execute the PHP code in it. if you want to escape, what functions are generally used, the data in the external POST will only be treated as strings to handle the issue of escaping the submitted content.
When I write a PHP program
Whether to perform escape processing before the textarea data is submitted to the database
Because if php code is included in the content submitted by textarea, PHP code in the content may be executed.
What functions are generally used to escape them?

------ Solution --------------------
External POST data is processed only as strings and not as code. Filtering user input is a good habit. it can prevent SQL injection. both functions can be used in this respect.
Compared with addslashes, htmlspecialchars can also help you prevent XSS attacks. Therefore, the former is recommended.
------ Solution --------------------
Discussion

Execute PHP code? Nonsense.

Enter the database addslashes.

------ Solution --------------------
The core of anti-SQL injection is to escape single and double quotation marks
Htmlspecialchars will escape it as an HTML object
Addslashes will add the escape character \ before the quotation marks, so Mysql will regard this as a normal quotation mark, rather than the string boundary mark.
------ Solution --------------------
The htmlspecialchars () function converts some predefined characters into HTML objects.
The predefined characters are:
& (And number) become &
"(Double quotation marks)"
'(Single quotes)'
<(Less than) becomes <
> (Greater than) become>

The addslashes () function adds a backslash before the specified predefined character.
The predefined characters are:
Single quotes (')
Double quotation marks (")
Backslash (\)
NULL

After comparing them, you will know what you should choose. textarea should also consider it...


Discussion

Ask someone in the group today to say this.
------------
Htmlspecialchars is only used to process some characters in HTML. if you use addslashes or mysql_escape_string to escape the characters, no problem will occur.
------------

A little dizzy --

------ Solution --------------------
Htmlspecialchars converts the ampersand, single double quotation marks, greater than or less than signs into HTML format
& Convert &
"Convert"
'Convert'
<转成<
> Convert to>

Htmlentities () all characters are converted to HTML format. in addition to the above htmlspecialchars characters, the two-byte characters are also displayed as encoding characters.

Addslashes single double quotation marks, backslash and NULL plus backslash escape
The modified characters include single quotation marks ('), double quotation marks ("), backslash (\), and NULL.

Stripslashes removes the backslash character from the string. If there are two backslash lines in a row, remove one and leave one. If there is only one backslash, remove it directly.

Quotemeta adds a reference symbol to include. \ + *? [^] ($) And other characters are preceded by the backslash "\" symbol.
Nl2br () converts a line break


Strip_tags remove HTML and PHP tags remove any HTML and PHP tags in the string, including the contents between Mark blocking. Note: if the HTML and PHP tags of the string are incorrect, an error is returned.

Special character escape \ x00 \ n \ r space \ '"\ x1a in mysql_real_escape_string escape SQL string, which is very effective for processing multi-byte characters. Mysql_real_escape_string determines the character set, and mysql_escape_string does not need to be considered.

------ Solution --------------------
Whether it is input or program-generated data, you may need to escape the special character "'" in the data warehouse.
The reason is simple:
Php transmits a string to the database. the database parses the string to complete the corresponding operation.
The database and the user have a convention: the character type value is enclosed in single quotes.
So when single quotes appear in the data, the database cannot accurately know whether the single quotes are single quotes or the string end mark.
So there is an escape.

As to whether other processing is required for warehouse receiving, the benevolent sees the wise.
I don't think it is necessary. the database is just a warehouse. what should be put in and retrieved?
To maximize data integrity, make necessary processing when getting and using data.

Of course, you must filter and process the incoming data. but when you want to check the original data that day, it is absolutely impossible.