Summary of filtering special dangerous characters in php _ PHP Tutorial

Summary of php filter for special dangerous characters. In the website, we may encounter some security problems when submitting forms or getting url values. below I have summarized some common solutions to filter dangerous and special characters, I hope this tutorial may encounter some security problems when submitting forms or getting url values on websites. below I will summarize some common solutions to filter dangerous and special characters, I hope this tutorial will be helpful to you.

Generally, php can use the addslashes function to process the passed characters (get_magic_quotes_gpc () is required for processing, otherwise it will be escaped again !), In this way, we can meet certain security requirements.
For example

The code is as follows:
If (! Get_magic_quotes_gpc ()){ Add_slashes ($ _ GET ); Add_slashes ($ _ POST ); Add_slashes ($ _ COOKIE ); } Function add_slashes ($ string ){ If (is_array ($ string )){ Foreach ($ string as $ key => $ value ){ $ String [$ key] = add_slashes ($ value ); } } Else { $ String = addslashes ($ string ); } Return $ string; }

However, you can perform further re-encoding and decoding as follows:

The code is as follows:

// Encoding Function htmlencode ($ str ){ If (empty ($ str) return; If ($ str = "") return $ str; $ Str = trim ($ str ); $ Str = str_replace ("&", "& amp;", $ str ); $ Str = str_replace (">", "& gt;", $ str ); $ Str = str_replace ("<", "& lt;", $ str ); $ Str = str_replace (chr (32), "& nbsp;", $ str ); $ Str = str_replace (chr (9), "& nbsp;", $ str ); $ Str = str_replace (chr (34), "&", $ str ); $ Str = str_replace (chr (39), "& #39;", $ str ); $ Str = str_replace (chr (13), "<br/>", $ str ); $ Str = str_replace ("'", "'' ", $ str ); $ Str = str_replace ("select", "sel & #101; ct", $ str ); $ Str = str_replace ("join", "jo & #105; n", $ str ); $ Str = str_replace ("union", "un & #105; on", $ str ); $ Str = str_replace ("where", "wh & #101; re", $ str ); $ Str = str_replace ("insert", "ins & #101; rt", $ str ); $ Str = str_replace ("delete", "del & #101; te", $ str ); $ Str = str_replace ("update", "up & #100; ate", $ str ); $ Str = str_replace ("like", "lik & #101;", $ str ); $ Str = str_replace ("drop", "dro & #112;", $ str ); $ Str = str_replace ("create", "cr & #101; ate", $ str ); $ Str = str_replace ("modify", "mod & #105; fy", $ str ); $ Str = str_replace ("rename", "ren & #097; me", $ str ); $ Str = str_replace ("alter", "alt & #101; r", $ str ); $ Str = str_replace ("cast", "ca & #115;", $ str ); Return $ str; }

In this way, the external data can be stored in the database with greater confidence. However, when the data is retrieved from the database, you must re-decode it when it is displayed on the front-end:

The code is as follows:

// Decoding Function htmldecode ($ str ){ If (empty ($ str) return; If ($ str = "") return $ str; $ Str = str_replace ("sel &# 101; ct", "select", $ str ); $ Str = str_replace ("jo & #105; n", "join", $ str ); $ Str = str_replace ("un & #105; on", "union", $ str ); $ Str = str_replace ("wh & #101; re", "where", $ str ); $ Str = str_replace ("ins & #101; rt", "insert", $ str ); $ Str = str_replace ("del & #101; te", "delete", $ str ); $ Str = str_replace ("up & #100; ate", "update", $ str ); $ Str = str_replace ("lik & #101;", "like", $ str ); $ Str = str_replace ("dro & #112;", "drop", $ str ); $ Str = str_replace ("cr & #101; ate", "create", $ str ); $ Str = str_replace ("mod & #105; fy", "modify", $ str ); $ Str = str_replace ("ren & #097; me", "rename", $ str ); $ Str = str_replace ("alt & #101; r", "alter", $ str ); $ Str = str_replace ("ca & #115;", "cast", $ str ); $ Str = str_replace ("& amp;", "&", $ str ); $ Str = str_replace ("& gt;", ">", $ str ); $ Str = str_replace ("& lt;", "<", $ str ); $ Str = str_replace ("& nbsp;", chr (32), $ str ); $ Str = str_replace ("& nbsp;", chr (9), $ str ); $ Str = str_replace ("&", chr (34), $ str ); $ Str = str_replace ("& #39;", chr (39), $ str ); $ Str = str_replace ("<br/>", chr (13), $ str ); $ Str = str_replace ("'' "," '", $ str ); Return $ str; }

Although there is a step more encoding and decoding process, the security aspect will go further. let's choose what to do.

A few more

The code is as follows:

Function safe_replace ($ string ){ $ String = str_replace ('','', $ string ); $ String = str_replace (''', '', $ string ); $ String = str_replace (''', '', $ string ); $ String = str_replace ('*', '', $ string ); $ String = str_replace ('"', '"', $ string ); $ String = str_replace ("'", '', $ string ); $ String = str_replace ('"','', $ string ); $ String = str_replace (';', '', $ string ); $ String = str_replace ('<', '<', $ string ); $ String = str_replace ('>', '>', $ string ); $ String = str_replace ("{", '', $ string ); $ String = str_replace ('}', '', $ string ); Return $ string; }

More comprehensive

The code is as follows:

// Process submitted data Function htmldecode ($ str ){ If (empty ($ str) | "" = $ str ){ Return ""; } $ Str = strip_tags ($ str ); $ Str = htmlspecialchars ($ str ); $ Str = nl2br ($ str ); $ Str = str_replace ("? "," ", $ Str ); $ Str = str_replace ("*", "", $ str ); $ Str = str_replace ("! "," ", $ Str ); $ Str = str_replace ("~ "," ", $ Str ); $ Str = str_replace ("$", "", $ str ); $ Str = str_replace ("%", "", $ str ); $ Str = str_replace ("^", "", $ str ); $ Str = str_replace ("^", "", $ str ); $ Str = str_replace ("select", "", $ str ); $ Str = str_replace ("join", "", $ str ); $ Str = str_replace ("union", "", $ str ); $ Str = str_replace ("where", "", $ str ); $ Str = str_replace ("insert", "", $ str ); $ Str = str_replace ("delete", "", $ str ); $ Str = str_replace ("update", "", $ str ); $ Str = str_replace ("like", "", $ str ); $ Str = str_replace ("drop", "", $ str ); $ Str = str_replace ("create", "", $ str ); $ Str = str_replace ("modify", "", $ str ); $ Str = str_replace ("rename", "", $ str ); $ Str = str_replace ("alter", "", $ str ); $ Str = str_replace ("cast", "", $ str ); $ Farr = array ("// s +/", // filter unnecessary spaces "/<(//?) (Img | script | I? Frame | style | html | body | title | link | meta | /? |/%) ([^>] *?)> /IsU ", // filter"/(<[^>] *) On [a-zA-Z] +/s * = ([^>] *>)/isU ") // filter javascript on events ; $ Tarr = array ("", "", // If you want to clear insecure labels directly, leave it blank. ""); Return $ str; }

...