ThinkPHP default automatic escape solution when submitting a form, thinkphp escape

ThinkPHP default automatic escape solution when submitting a form, thinkphp escape_PHP tutorial

WBOY

Release： 2016-07-13 10:13:09

Original

974 people have browsed it

The solution for ThinkPHP to automatically escape by default when submitting a form, thinkphp escapes

The example in this article describes the solution to ThinkPHP’s default automatic escaping when submitting a form. Share it with everyone for your reference. The specific method is as follows:

1. Question:

When submitting a form to insert data in ThinkPHP, single quotes and double quotes will be automatically escaped, that is, backslashes will be added automatically, but I don’t want to add backslashes to single quotes and double quotes. , when submitting a form to insert data in ThinkPHP, single quotes and double quotes will be automatically escaped, that is, backslashes will be automatically added, but I don’t want to add backslashes to single quotes and double quotes, such as :hds"gh"j'g'h will be automatically escaped to: hds"gh"j'g'h.

Please note that what you need is to cancel this escaping function, rather than using the stripslashes() function to delete these backslashes, that is, you do not need the official automatic escaping function.

2. Solution:

Search the solution online:

1. In the thinkphp directory, open the ThinkPHPLibDriverDb directory in sequence, and modify the escapeString function in the dbmysql.class.php file to:

Copy code The code is as follows:

public function escapeString($str) {
//Modify Zhou Manzi to double escape double quotes
if (!get_magic_quotes_gpc()){
if($this->_linkID) {
return mysql_real_escape_string($str,$this->_linkID);
}else{
return mysql_escape_string($str);
}
} else {
return $str;
}
}

Original function:

Copy code The code is as follows:

public function escapeString($str) {
//Modify Zhou Manzi to double escape double quotes
if($this->_linkID) {
return mysql_real_escape_string($str,$this->_linkID);
}else{
return mysql_escape_string($str);
}
}

2. Add:
to the public document

Copy code The code is as follows:

//Prevent double escaping
if (get_magic_quotes_gpc()) {
function stripslashes_deep($value){
$value = is_array($value) ?
array_map('stripslashes_deep', $value) :
stripslashes($value);
return $value;
}
$_POST = array_map('stripslashes_deep', $_POST);
$_GET = array_map('stripslashes_deep', $_GET);
$_COOKIE = array_map('stripslashes_deep', $_COOKIE);
}

Note: If the server has escaping enabled, then after escaping again through thinkphp, a double escaping bug will occur in the program

After the modification, there is no problem with the background input of my website program. It seems that if you encounter using Thinkphp in the future, please note that if the server turns on the filtering of single quotes or double quotes, it may conflict with ThinkPHP. Yes, so adding a layer of judgment can solve this problem very well.

I hope this article will be helpful to everyone’s ThinkPHP framework programming.