用户输入，发送到数据库之前清理和消毒

问题描述

我在这里搜索了很多问题，并且发现它们很老或者暗示使用准备好的语句 PDO ，我没有使用即可。所以我需要你的帮助。

我有一个小型讨论/聊天框，用户使用 echo >从数据库中获取数据？

真的，感谢您的帮助和善意

解决方案首先，保持文本的逻辑和清洁：

  trim（） - 确定
 htmlentities（ $ comment，ENT_NOQUOTES） - 否;稍后做
 mysqli_real_escape_string（） - 是的; API要求
 nl2br（） - 否;见下面
  

这些建议背后的逻辑：数据库中的数据应该只是普通数据。不是htmlentities，而不是br标签。但是，您必须执行escape_string才能将数据从PHP传递到MySQL;转义将不会被存储。

但是...这只是中间步骤。数据来自哪里？老版本的PHP试图保护你添加了可以正常工作的逃逸和其他垃圾，但是搞砸了MySQL。关闭这种魔法转义，并获得原始数据。

数据在哪里？可能是HTML？在选择数据返回表之后，然后首先执行 htmlentities（）和（可选） nl2br（）;

注意，如果您希望保留诸如< I> （对于斜体），您正在寻求麻烦 - 很大的麻烦。所有黑客需要做的是< script> ... 为您的网页和可能的整个系统注入各种各样的瑕疵。

I've searched a lot of the questions here and I found that they either very old or suggesting using prepared statements PDO which I am not using. So I need your help please.

I have a small discussion/chat box where a user submit a message using a <textarea>

What I need is sanitize and filter the user input so it only accepts plain texts (e.g. no tags, no html tags, no scripts no links, etc). Also, it is important to allow line breaks.

Based on my reading I am doing the following in the following order:

1. trim()
2. htmlentities($comment, ENT_NOQUOTES)
3. mysqli_real_escape_string()
4. nl2br()

Is what I am doing is right? or I am missing something?

Also is there anything I have to do when echoing the data from the db?

really, appreciate your help and kindness

解决方案

First, keep the text logical and clean:

trim() -- OK
htmlentities($comment, ENT_NOQUOTES)  -- No; do later
mysqli_real_escape_string()  -- Yes; required by API
nl2br()  -- No; see below

The logic behind those recommendations: The data in the database should be just plain data. Not htmlentities, not br-tags. But, you must do the escape_string in order to pass data from PHP to MySQL; the escapes will not be stored.

But... That is only the middle step. Where did the data come from? Older versions of PHP try to "protect" you be adding escapes and other junk that works OK for HTML, but screws up MySQL. Turn off such magic escaping, and get the raw data.

Where does the data go to? Probably HTML? After SELECTing the data back out of the table, then first do htmlentities() and (optionally) nl2br();

Note, if you are expecting to preserve things like <I> (for italic), you are asking for trouble -- big trouble. All a hacker needs to do is <script> ... to inject all sorts of nastiness into your web page and possibly your entire system.

这篇关于用户输入，发送到数据库之前清理和消毒的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！