問題描述

使用htmlspecialchars()函數的PHP PDO在表單驗證和數據庫查詢中將特殊字符轉換為HTML實體真的有必要嗎?

Is converting special characters to HTML entities in form validation and database query using PHP PDO using htmlspecialchars() function really necessary?

例如，我有一個或多或少具有簡單登錄系統的網站:

For example, I have a website with simple login system more or less like:

$username = (string) htmlspecialchars($_POST['user']);
$password = (string) htmlspecialchars($_POST['pass']);

$query = $dbh->prepare("select id where username = ? and password = ?")
$query->execute($username, $password);

請注意，除了所討論的函數之外，我還使用了類型轉換.那么，有必要嗎?或者我可以安全地使用 $username = $_POST['user']; ?

Note that I also use type casting besides the function in question.. So, is it necessary? Or I can safely use $username = $_POST['user']; ?

推薦答案

您的困惑很常見，因為書籍和互聯網(包括 php.net)上的信息和示例具有誤導性或歧義.在開發 Web 應用程序時，您可以學到的最重要的事情是 過濾輸入，轉義輸出.

Your confusion is quite common because information and examples in books and on the internet including php.net are misleading or ambiguous. The most important thing you can learn when developing web apps is filter input, escape output.

過濾輸入這意味著對于任何數據輸入，無論是由用戶在表單上提供的還是由其他來源的文件提供的，都要過濾掉任何不屬于的數據.一個例子是，如果您需要一個數字值，請過濾掉任何非數字字符.另一個例子是限制/確保數據的最大長度.但是，您不必為此發瘋.例如，如果您希望一行文本可以包含幾乎任何字符組合，那么嘗試提出過濾器可能只會讓您的用戶感到沮喪.

Filter Input This means that for any data input whether provided by a user on a form or provided by a file from some other source, filter out anything which does not belong. An example would be that if you expect a numeric value, filter out any non-numeric characters. Another example would be limit/ensure the maximum length of data. However, you don't need to get to crazy with this. For example, if you expect a line of text that can contain literally any combination of characters, then trying to come up with a filter will probably only frustrate your users.

因此，您通常會將輸入數據存儲在數據庫中，并預先提供一些可選的過濾功能.

So, you generally would store input data in your database as provided with optionally some filtering before hand.

轉義輸出轉義輸出的意思是正確保護給定媒體的數據.大多數時候，這個媒體是一個網頁(html).但是，它也可以是純文本、xml、pdf、圖像等.對于 html，這意味著使用 htmlspecialchars() 或 htmlentities()(您可以閱讀差異此處).對于其他媒體類型，您將根據需要進行轉義/轉換(如果合適，則根本不進行轉換).

Escape Output What is meant by escape output is to properly make safe the data for a given media. Most of the time, this media is a web page (html). But, it can also be plain text, xml, pdf, image, etc. For html, this means using htmlspecialchars() or htmlentities() (you can read up on the differences here). For other media types, you would escape/convert as appropriate (or not at all if appropriate).

現在，您的問題是您是否應該對將用作 sql 查詢參數的輸入數據使用 htmlspecialchars().答案是不.您不應以任何方式修改數據.

Now, your question is whether or not you should use htmlspecialchars() on input data that will be used as sql query parameters. The answer is no. You should not modify the data in any way.

是的，$_POST 中包含的數據應該被視為危險.這就是為什么您應該 1) 使用準備好的語句和綁定參數來防止 sql 注入，以及 2) 如果將 $_POST 中的數據放在 html 中，則正確轉義/轉換它.

Yes, the data contained in $_POST should be considered dangerous. Which is why you should 1) guard against sql injection using prepared statements and bound parameters as you are doing and 2) properly escape/convert data found in $_POST if you place it in html.

有許多 PHP 框架可以為您處理這些細節，我建議您選擇并使用一個.但是，如果您不這樣做，您仍然可以構建安全可靠的應用程序.無論您是否使用框架，我強烈建議您閱讀OWASP.不這樣做只會給您的網絡應用程序帶來安全噩夢.

There are many frameworks for PHP which handle these details for you and I recommend you pick and use one. However, if you do not, you can still build a safe and secure application. Whether you use a framework or not, I strongly suggest that you read the recommendations suggested by OWASP. Failure to do so will only result in a security nightmare for your web application.

這篇關于在 PDO 中使用 htmlspecialchars 函數準備和執行的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！