To ensure the security of user input in PHP, a cleaning function needs to be written to process input. The specific methods are as follows: 1. Use filter_var to perform basic cleaning, such as filtering HTML tags; 2. Select the corresponding filtering method according to the input type (such as mailbox, URL, integer, text); 3. Use batch processing functions for multi-field input to improve efficiency; 4. Note that back-end verification cannot rely on the front-end, avoid blacklisting strategies, combine parameterized query to prevent SQL injection, and clean data in context when output.

Processing user input is a link that cannot be avoided in any web application. Especially in PHP, unprocessed user input can easily cause security problems, such as SQL injection, XSS attacks, etc. Therefore, it is very necessary to write a reliable function to clean up (sanitize) user input.

The following function can basically cover most scenarios, have a clear structure, and is convenient for subsequent expansion.

1. Use filter_var function for basic cleaning

The built-in filter_var function in PHP is very practical and can clean and verify different types of data. For example, filtering mailboxes, URLs, integers, etc.

 function sanitize_input($data) {
    return filter_var($data, FILTER_SANITIZE_STRING);
}

The above function removes HTML tags and special characters from the data, and is suitable for most text inputs. But be aware that this function will not automatically process arrays or multi-layer data structures. If the array is passed in, additional processing is required.

Tips: FILTER_SANITIZE_STRING has been deprecated after PHP 8.1. It is recommended to use htmlspecialchars() or more specific filters, such as FILTER_SANITIZE_FULL_SPECIAL_CHARS .

2. Different filtering methods should be used to process different types of inputs

Different input types should use different filtering rules, such as:

• Email: Use FILTER_VALIDATE_EMAIL
• URL: Use FILTER_VALIDATE_URL
• Integer: Use FILTER_VALIDATE_INT
• General text: Use htmlspecialchars() or FILTER_SANITIZE_FULL_SPECIAL_CHARS

The function can be extended like this:

 function sanitize_input($data, $type = 'string') {
    switch ($type) {
        case 'email':
            return filter_var($data, FILTER_VALIDATE_EMAIL);
        case 'url':
            return filter_var($data, FILTER_VALIDATE_URL);
        case 'int':
            return filter_var($data, FILTER_VALIDATE_INT);
        case 'string':
        default:
            return htmlspecialchars(trim($data), ENT_QUOTES, 'UTF-8');
    }
}

In this way, you can choose a more accurate processing method according to the input type when using it, such as:

 $email = sanitize_input($_POST['email'], 'email');

3. It can be batch processed when entering multiple fields

If you are processing form submissions, there are often multiple fields that need to be cleaned. You can write a helper function to batch process:

 function sanitize_array($data, $rules = []) {
    $sanitized = [];

    foreach ($data as $key => $value) {
        $type = isset($rules[$key]) ? $rules[$key] : 'string';
        $sanitized[$key] = sanitize_input($value, $type);
    }

    return $sanitized;
}

Example of usage:

 $form_data = [
    'name' => $_POST['name'],
    'email' => $_POST['email'],
    'age' => $_POST['age']
];

$rules = [
    'name' => 'string',
    'email' => 'email',
    'age' => 'int'
];

$sanitized = sanitize_array($form_data, $rules);

This is safe and convenient to handle, and is easier to maintain.

4. Precautions and common misunderstandings

• Don't rely on front-end verification : front-end verification is just user experience optimization, and the back-end must be re-checked.
• Don't just filter "dangerous characters" : the blacklisting method is unreliable and easy to miss, and should be handled with whitelist or security functions.
• Preventing SQL injection requires parameterized queries : Cleaning up input is only the first step, and truly preventing SQL injection also depends on preprocessing statements from PDO or mysqli.
• It is also important to clean the output : for example, when outputting to HTML, JS, and CSS, you must use different functions (such as htmlspecialchars , json_encode , etc.).

Basically that's it. Write a general and safe cleaning function, which is not complicated but is easy to ignore details. Use filter_var and htmlspecialchars well, and then judge with the specific input type, you can deal with most scenarios.

The above is the detailed content of php function to sanitize user input. For more information, please follow other related articles on the PHP Chinese website!