form validation

This form uses method="post" method to submit data.

What is the $_SERVER["PHP_SELF"] variable?

$_SERVER["PHP_SELF"] is a super global variable that returns the value of the currently executing script File name, related to document root.

So, $_SERVER["PHP_SELF"] will send the form data to the current page instead of jumping to a different page.

What is the htmlspecialchars() method?

The htmlspecialchars() function converts some predefined characters into HTML entities.

stereotypes are:

# · & (Hehe) to become & amp;

· "(double quotes) to become & quot (Single quotation number) becomes '

· & lt; (less than) to become & lt;

$_SERVER["PHP_SELF"] variables may be used by hackers!

When hackers use cross-site script HTTP links to attack, The $_SERVER["PHP_SELF"] server variable will also be embedded in the script. The reason is that the cross-site script is appended to the path of the executable file, so the string of $_SERVER["PHP_SELF"] will contain the JavaScript behind the HTTP link. Program code.

##XSS is also called CSS (Cross-Site Script), a cross-site scripting attack. Malicious attackers insert malicious HTML code into the Web page. When the page is paged, the html code embedded in the Web will be executed to achieve the special purpose of the malicious user

Specify the following form file name as "test_form.php":

">

Now, we use the URL to specify the submission address "test_form.php ", the above code is modified as follows:

This is good.

However, consider that the user will enter the following address in the browser address bar:

//m.sbmmt.com/test_form.php/%22%3E%3Cscript%3Ealert ('hacked')%3C/script%3E

The above URL will be parsed into the following code and executed:

The script tag is added to the code and the alert command is added. This Javascript code will be executed when the page loads (the user will see a pop-up box). This is just a simple example of how the PHP_SELF variable can be exploited by hackers.

Please note that any JavaScript code can be added in the ">

Failed to try this vulnerability!

Use PHP to verify form data

First of all, we process all the data submitted by the user through PHP's htmlspecialchars() function.

When we use the htmlspecialchars() function, the user tries to submit the following text field:

The above code is safe and can be displayed normally on the page or inserted into emails.

When the user submits the form, we will do the following two things:

1. Use the PHP trim() function to remove unnecessary characters (such as spaces, tabs) in the user input data , newline).

2. Use PHP stripslashes() function to remove backslashes (\) in user input data

Next, let us write these filtering functions in a function we define ourselves, which can greatly improve the reusability of the code.

Name the function test_input().

Now, we can detect all variables in $_POST through the test_input() function. The script code is as follows:

Example

Note that we are executing the above script When, $_SERVER["REQUEST_METHOD"] will be used to detect whether the form has been submitted. If REQUEST_METHOD is POST, the form will be submitted - and the data will be validated. If the form is not submitted validation will be skipped and displayed blank.

1. Use the PHP trim() function to remove unnecessary characters (such as spaces, tabs, newlines) in user input data.

2. Use the PHP stripslashes() function to remove backslashes (\) in user input data

3. Use the test_input() function to detect all variables in $_POST