During the WEB development process, we often need to obtain data entered by users from all over the world. However, we "can never trust user-entered data." Therefore, in various web development languages, functions are provided to ensure the security of user input data. In PHP, there are some very useful and convenient functions that can help you prevent problems like SQL injection attacks, XSS attacks, etc.
1. mysql_real_escape_string()
This function once provided great help in preventing SQL injection attacks in PHP. It adds a "backslash" to special characters, such as single quotes and double quotes, to ensure that the user's input uses it. It was already safe before going to inquire. But you should note that you are using this function while connected to the database.
But now the mysql_real_escape_string() function is basically no longer needed. All new application development should use libraries like PDO to operate the database. In other words, we can use ready-made statements to prevent SQL injection attacks.
2. addslashes()
This function is very similar to the mysql_real_escape_string() above. It also adds backslashes to special characters, but be careful not to use this function when the value of magic_quotes_gpc in the setting file php.ini is "on". When magic_quotes_gpc = on, automatically runs addslashes() on all GET, POST and COOKIE data. Do not use addslashes() on strings that have been escaped by magic_quotes_gpc, as this will result in double escaping. You can check the value of this variable through the get_magic_quotes_gpc() function in PHP.
3. htmlentities()
This function is very useful for filtering user input data, it can convert characters into HTML entities. For example, when the user enters the character "<", it will be converted into the HTML entity "<" by this function (you will see "<" when viewing the source code), thus preventing XSS and SQL injection attacks. Unrecognized character sets will be ignored and replaced by ISO-8859-1
4. htmlspecialchars()
This function is very similar to the above. Some characters in HTML have special meanings. If you want to reflect such meanings, they must be converted into HTML entities. This function will return the converted string.
5. strip_tags()
This function can remove all HTML, JavaScript and PHP tags from the string. Of course, you can also ignore filtering some specific tags by setting the second parameter of the function.
6. intval()
intval is not actually a filtering function. Its function is to convert variables into integer types. It is very useful when we need to get an integer parameter. You can use this function to make your PHP code safer, especially when you are parsing integer data such as id and age.
These are PHP’s built-in string filtering functions, which are very simple and practical. I hope my friends can make good use of them.
