这段代码是否安全,可以防止XSS攻击?
<?php
$string = "<b>hello world!</b>";
echo "without filtering:".$string;
echo "<br>";
$filtered = htmlspecialchars($string); // insert into database filtered
echo "After filtering:".$filtered;
echo "<br>";
$de_filtering = htmlspecialchars_decode($filtered); //retrieve from database and display
echo "After de-filtering:".$de_filtering;
?>
htmlspecialchars
,而是使用你所用数据库的转义方法(例如mysql_real_escape_string
)。 - gen_Eric