如何正确过滤PHP用户的输入？

Question

What is the industry standard to filter input from users (both POST and GET) to avoid SQL injections and things of that nature. So far I am using filter_input() and mysql_real_escape_string() functions? Is that enough and if not, what other methods I should use?

Answer 1

An important rule to live by is FIEO. Filter Input Escape Output.

ANY information that you take and store from a user must be filtered server-side, in order to do this you should be using mysql_real_escape_string. It always should be the last thing you should before adding the value to the database. Validate the users input, ensure it is what you want, remove any symbols or tags if you need to using Regular Expressions, check its length and any other rules - do all this, then finally apply the MySQL function mysql_real_escape_string.

ANY information that you are displaying on your webpage that is dynamic - i.e. has come from a database of user-generated content or has directly come from user input must then be escaped. You must URL encode any symbols, remove (or encode) any HTML tags.

I highly recommend you watch this presentation on web security by expert Chris Shiflett:

http://www.slideshare.net/shiflett/evolution-of-web-security