To prevent an xss attack, if I use a php regex to block strange characters like '>
or ;
do I still need to use htmlspecialchars
and htmlentities
?
xss攻击 - 正则表达式或htmlspecialchars
- 写回答
- 好问题 0 提建议
- 追加酬金
- 关注问题
- 邀请回答
-
3条回答 默认 最新
- dpnvrt3119 2011-07-13 15:45关注
PDO does a very effective job of protecting your queries from XSS attacks. No need to worry about whether or not you remembered to protect your queries, because it is automatic. Several other frameworks support this feature as well.
If I'm not using PDO because of a client requirement or the like, I will at the very least build into my connection class an automatic htmlspecialchars function so that I never forget to do it (though this is my least favorite option)
As a UI guy, I always attack my security issues starting on the --front-- end first. Proper and well-designed front-end validation can stop unintentional issues from even getting to the query in the first place, and they're the most effective UI pattern for reporting problems to the user. Blocking elements such as
<
or;
makes sense in most fields, because they just don't fit. You can't rely on the front end solely, though, because a person could bypass it by turning off javascript. But, it's a good first step and a great way to limit improper queries on heavily traffic-ed sites. My validation of choice for quick and effective front-end validation of fields is here.本回答被题主选为最佳回答 , 对您是否有帮助呢?解决 无用评论 打赏 举报
悬赏问题
- ¥15 怎么让数码管亮的同时让led执行流水灯代码
- ¥20 SAP HANA SQL Script 。如何判断字段值包含某个字符串
- ¥85 cmd批处理参数如果含有双引号,该如何传入?
- ¥15 fx2n系列plc的自控成型机模拟
- ¥15 时间序列LSTM模型归回预测代码问题
- ¥50 使用CUDA如何高效的做并行化处理,是否可以多个分段同时进行匹配计算处理?目前数据传输速度有些慢,如何提高速度,使用gdrcopy是否可行?请给出具体意见。
- ¥15 基于STM32,电机驱动模块为L298N,四路运放电磁传感器,三轮智能小车电磁组电磁循迹(两个电机,一个万向轮),如何通过环岛的原理及完整代码
- ¥20 机器学习或深度学习问题?困扰了我一个世纪,晚来天欲雪,能饮一杯无?
- ¥15 c语言数据结构高铁订票系统
- ¥15 关于wkernell.PDB加载的问题,如何解决?(语言-c#|开发工具-vscode)