PHP应避免使用addslashes()的情况

[i=s] 本帖最后由 jieforest 于 2012-7-2 10:49 编辑

[size=10.5pt]When peer reviewing PHP code, I often find dangerous uses of addslashes(). It is often believed this is a safe way of escaping user input before passing it to e.g. a SQL query, but in fact it's unsafe. If you find yourself using addslashes(), think twice if you are using it safely:

1. In a MySQL context, use mysql_real_escape_string() instead.

2. MySQLi has an identical mysqli_real_escape_string().

3. PDO provides it's own escape method PDO::quote().

4. PostgreSQL has a wide variety of escape functions: pg_escape_literal() for values, pg_escape_bytea() for columns of type bytea, pg_escape_identifier() is used for escaping identifiers (e.g. table, field names).

5. When trying to pass user input to the command line, use escapeshellarg() and escapeshellcmd() to escape the input.

6. When displaying non-HTML user input anywhere on a webpage, always use htmlentities() or htmlspecialchars().

This one is a little awkward, but I've seen it before so I thought it's worth mentioning: when including user input in URLs, use urlencode() instead of addslashes()!

If you have more suggestions for safe escaping, please leave them in the comments below. Happy safe coding!

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/301743/viewspace-734284/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/301743/viewspace-734284/