安全表单输入需要哪些功能？

问题描述：

On my registration form I have four inputs:

username  
password
email address
web address

Can't figure which off all available sanitizing methods is really needed:

strip_tags()
substr()
mysql_real_escape_string()
trim()
htmlentities()
addslashes()
. . . (you may add more)

Somewhere I found that a function is a must have, somewhere this function is declared as deprecated or less valuable the another one ...

Could someone be so kind to create a list of priorities for all four inputs above.

Note: PDO - prepared statements are already used for communication with database.

在我的注册表格中，我有四个输入： p>

  username  
password 
email地址
web地址
  code>  pre> 
 
 无法确定真正需要的所有可用消毒方法： p> 
 
 
  用strip_tags（）
substr（）
mysql_real_escape_string（）
trim（）
htmlentities（）
addslashes（）
。  。  。  （你可以添加更多）
  code>  pre> 
 
 在某个地方我发现一个函数是必须有 code>，某个地方这个函数被声明为 不推荐使用 code>或对另一个人不太有价值...  code>  p> 
 
 
有人可以如此善意为上面所有四个输入创建优先级列表。   p> 
 
 

注意： PDO  - 预备语句 code>已用于与数据库通信。 p> 
  div>

答

First you need to be clear about hat for you like to sanitize.

Because you use allready prepared statements there is no need for: mysql_real_escape_string()

If you like to deny you users the use of html, to avoid XSS you should perhaps use strip_tags()

To secure your html display agains not printable characters htmlentities() But in times of UTF-8 its a little obsolet.

For password input it can be used trim() because it helps if youser copys passwords with leading / attached space. Because outlook add spaces. But not everybody think this is an good idea, to trim passwords.

Depends on your Templating system it could be an good idea to use addslashes() for pre defined input values like

<input type="text" value="<?php addslashes($value); ?>" />

because it could be possible to do:

my value " /><script>evil things</script><

To have some kind of XSS in autocomplete forms.

答

In a few words:

When you add your data to database - use PDO's prepared statements with placeholders. That's it, nothing else is required.
When you output something from anywhere on the html page - you need to perform htmlspecialchars($string, ENT_QUOTES, 'UTF-8');, where the $string is the string you want to output in a "safe" manner.

安全表单输入需要哪些功能？

相关推荐