用于登录凭据的php中的卫生脚本

Question

What I am looking for currently is a simple, basic, login credentials sanitation script.

I understand that I make a function to do so and I have one...but all it does right now is strip tags...

am I doomed to use replace? or is there a way i can just remove all special characters and spaces and limit it to only letters and numbers...then as for the password limit it to only letters and numbers exclimation points, periods, and other special chars that cannot affect my SQL query.

Please help :/

Thanks, Matt

Answer 1

Sounds like you want to limit which characters people are allowed to use in their usernames and passwords. Sort of like this.

if (!preg_match('/^[a-zA-Z0-9_]++$/', $username)) {
  // reject username
}

if (!preg_match('/^[a-zA-Z0-9\.!@#$%^&*_-]++$/', $password)) {
  // reject password
}

It's a bad idea to silently replace/remove characters in someone's credentials. You need to give them the feedback that these characters aren't allowed. It's also a bad idea to be too restrictive in what characters you allow in a password, for security reasons which others have already touched upon.