PHP應避免使用addslashes()的情況

[i=s] 本帖最後由 jieforest 於 2012-7-2 10:49 編輯

[size=10.5pt]When peer reviewing PHP code, I often find dangerous uses of addslashes(). It is often believed this is a safe way of escaping user input before passing it to e.g. a SQL query, but in fact it's unsafe. If you find yourself using addslashes(), think twice if you are using it safely:

1. In a MySQL context, use mysql_real_escape_string() instead.

2. MySQLi has an identical mysqli_real_escape_string().

3. PDO provides it's own escape method PDO::quote().

4. PostgreSQL has a wide variety of escape functions: pg_escape_literal() for values, pg_escape_bytea() for columns of type bytea, pg_escape_identifier() is used for escaping identifiers (e.g. table, field names).

5. When trying to pass user input to the command line, use escapeshellarg() and escapeshellcmd() to escape the input.

6. When displaying non-HTML user input anywhere on a webpage, always use htmlentities() or htmlspecialchars().

This one is a little awkward, but I've seen it before so I thought it's worth mentioning: when including user input in URLs, use urlencode() instead of addslashes()!

If you have more suggestions for safe escaping, please leave them in the comments below. Happy safe coding!

來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/301743/viewspace-734284/，如需轉載，請註明出處，否則將追究法律責任。