Home > Article > Backend Development > A brief description of the character security filtering function in PHP

A brief description of the character security filtering function in PHP

墨辰丷Original: 2018-06-13 09:50:581690browse

This article mainly briefly introduces the character security filtering function in PHP, which is very useful for preventing SQL injection attacks and XSS attacks. It is recommended to everyone here.

In the process of WEB development, we often need to obtain data entered by users from all over the world. However, we "can never trust user-entered data." Therefore, in various web development languages, functions are provided to ensure the security of user input data. In PHP, there are some very useful and convenient functions that can help you prevent problems like SQL injection attacks, XSS attacks, etc.

1. mysql_real_escape_string()

This function once provided great help in preventing SQL injection attacks in PHP. It uses special characters such as single quotes and double quotes, plus a "backslash" to ensure that the user's input is safe before using it to query. But you should note that you are using this function while connected to the database.
But now the mysql_real_escape_string() function is basically no longer needed. All new application development should use libraries like PDO to operate the database. In other words, we can use ready-made statements to prevent SQL injection attacks.

2. addslashes()

This function is very similar to mysql_real_escape_string() above. It also adds backslashes to special characters, but be careful when setting Do not use this function when the value of magic_quotes_gpc in the file php.ini is "on". When magic_quotes_gpc = on, automatically runs addslashes() on all GET, POST and COOKIE data. Do not use addslashes() on strings that have been escaped by magic_quotes_gpc, as this will result in double escaping. You can check the value of this variable through the get_magic_quotes_gpc() function in PHP.

3. htmlentities()

This function is very useful for filtering user input data. It can convert characters into HTML entities. For example, when the user enters the character "<", it will be converted into the HTML entity "<" by this function (you will see "<" when viewing the source code), thus preventing XSS and SQL injection attacks. Unrecognized character sets will be ignored and replaced by ISO-8859-1

4. htmlspecialchars()

This function is very similar to the above, HTML Some characters in have special meanings. If you want to reflect such meanings, they must be converted into HTML entities. This function will return the converted string.

5. strip_tags()

This function can remove all HTML, JavaScript and PHP tags in the string. Of course, you can also set the second parameter of this function. parameter, ignore filtering some specific tags.

6. intval()

intval is not actually a filtering function. Its function is to convert variables into integer types. It is very useful when we need to get an integer parameter. You can use this function to make your PHP code safer, especially when you are parsing integer data such as id and age.

This is a summary of how PHP handles special characters in form submissions, mainly involving the joint use of several functions such as htmlspecialchars/addslashes/stripslashes/strip_tags/mysql_real_escape_string. Let’s communicate with everyone.
1. Several PHP functions related to special character processing

##htmlentities()All characters are converted into HTML formatIn addition to the above htmlspecialchars characters, it also includes double words Section characters are displayed as encodings, etc. ##addslashesstripslashes##quotemetaAdd quotation symbolsAdd the backslash "\" symbol in front of characters such as \\ * ? [ ^ ] ( $ ) in the string. nl2br()Convert newline characters to Remove HTML and PHP tagsEscape special characters in SQL strings

The above is the detailed content of A brief description of the character security filtering function in PHP. For more information, please follow other related articles on the PHP Chinese website!

Statement：

The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Previous article：Detailed graphic explanation of the usage of stdClass in phpNext article：Detailed graphic explanation of the usage of stdClass in php

See more

Function name	Definition	Introduction
htmlspecialchars	Convert ampersands, single and double quotation marks, greater than and less than signs into HTML format	& into & "Turn into" ' Turn into' >Convert>


Single and double quotes, backslashes and NULL plus backslash escape	The changed characters include single quotation mark ('), double quotation mark ("), backslash backslash (\) and the null character NULL.
Remove backslash characters	Remove backslash characters in the string. If there are two consecutive backslashes, remove one and leave one. If there is only one backslash, just remove it.


		##strip_tags
Remove any HTML tags and PHP tags in the string, including the content between tag blocks. Note that if there are errors in the string HTML and PHP tags, an error will also be returned.		mysql_real_escape_string
Escape \x00 \n \r Space \ ' " \x1a, which is very effective for multi-byte character processing. mysql_real_escape_string will determine the character set, but mysql_escape_string does not need to be considered.		These are PHP's built-in string filtering functions, which are very simple and practical. I hope my friends can make good use of them. Summary: The above is the entire content of this article, I hope it will be helpful to everyone's study. Related recommendations: How to use php to add subtitles to videos using ffmpeg php regular expression class to implement UBB code filtering PHP method to obtain text display dot matrix width and height

A brief description of the character security filtering function in PHP

Related articles