PHP 5.2引入了filter_var函数。

它支持大量的SANITIZE, VALIDATE过滤器。

用PHP清除用户输入的方法:

Use Modern Versions of MySQL and PHP. Set charset explicitly: $mysqli->set_charset("utf8");manual $pdo = new PDO('mysql:host=localhost;dbname=testdb;charset=UTF8', $user, $password);manual $pdo->exec("set names utf8");manual $pdo = new PDO( "mysql:host=$host;dbname=$db", $user, $pass, array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8" ) );manual mysql_set_charset('utf8') [deprecated in PHP 5.5.0, removed in PHP 7.0.0]. Use secure charsets: Select utf8, latin1, ascii.., dont use vulnerable charsets big5, cp932, gb2312, gbk, sjis. Use spatialized function: MySQLi prepared statements: $stmt = $mysqli->prepare('SELECT * FROM test WHERE name = ? LIMIT 1'); $param = "' OR 1=1 /*";$stmt->bind_param('s', $param);$stmt->execute(); PDO::quote() - places quotes around the input string (if required) and escapes special characters within the input string, using a quoting style appropriate to the underlying driver:$pdo = new PDO('mysql:host=localhost;dbname=testdb;charset=UTF8', $user, $password);explicit set the character set$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);disable emulating prepared statements to prevent fallback to emulating statements that MySQL can't prepare natively (to prevent injection)$var = $pdo->quote("' OR 1=1 /*");not only escapes the literal, but also quotes it (in single-quote ' characters) $stmt = $pdo->query("SELECT * FROM test WHERE name = $var LIMIT 1"); PDO Prepared Statements: vs MySQLi prepared statements supports more database drivers and named parameters: $pdo = new PDO('mysql:host=localhost;dbname=testdb;charset=UTF8', $user, $password);explicit set the character set$pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);disable emulating prepared statements to prevent fallback to emulating statements that MySQL can't prepare natively (to prevent injection) $stmt = $pdo->prepare('SELECT * FROM test WHERE name = ? LIMIT 1'); $stmt->execute(["' OR 1=1 /*"]); mysql_real_escape_string [deprecated in PHP 5.5.0, removed in PHP 7.0.0]. mysqli_real_escape_string Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection. But recommended to use Prepared Statements because they are not simply escaped strings, a statement comes up with a complete query execution plan, including which tables and indexes it would use, it is a optimized way. Use single quotes (' ') around your variables inside your query. Check the variable contains what you are expecting for: If you are expecting an integer, use: ctype_digit — Check for numeric character(s);$value = (int) $value;$value = intval($value);$var = filter_var('0755', FILTER_VALIDATE_INT, $options); For Strings use: is_string() — Find whether the type of a variable is stringUse Filter Function filter_var() — filters a variable with a specified filter:$email = filter_var($email, FILTER_SANITIZE_EMAIL);$newstr = filter_var($str, FILTER_SANITIZE_STRING);more predefined filters filter_input() — Gets a specific external variable by name and optionally filters it:$search_html = filter_input(INPUT_GET, 'search', FILTER_SANITIZE_SPECIAL_CHARS); preg_match() — Perform a regular expression match; Write Your own validation function.

认为用户输入可以过滤是一种常见的误解。PHP甚至有一个(现在已弃用)“特征”，被称为魔术引号，建立在这个想法上。这是无稽之谈。忘记过滤(或清洗，或人们所说的任何东西)。

What you should do, to avoid problems, is quite simple: whenever you embed a a piece of data within a foreign code, you must treat it according to the formatting rules of that code. But you must understand that such rules could be too complicated to try to follow them all manually. For example, in SQL, rules for strings, numbers and identifiers are all different. For your convenience, in most cases there is a dedicated tool for such an embedding. For example, when you need to use a PHP variable in the SQL query, you have to use a prepared statement, that will take care of all the proper formatting/treatment.

另一个例子是HTML:如果你在HTML标记中嵌入字符串，你必须使用htmlspecialchars来转义它。这意味着每个echo或print语句都应该使用htmlspecialchars。

第三个例子可能是shell命令:如果您打算将字符串(如参数)嵌入到外部命令中，并使用exec调用它们，那么您必须使用escapeshellcmd和escapeshellarg。

还有一个非常引人注目的例子是JSON。规则是如此之多和复杂，你永远无法手动遵循它们。这就是为什么你永远不应该手动创建JSON字符串，而总是使用一个专门的函数，json_encode()，它将正确地格式化每一位数据。

诸如此类……

您需要主动过滤数据的唯一情况是，如果您接受预格式化的输入。例如，如果您让用户发布您计划在站点上显示的HTML标记。但是，您应该明智地不惜一切代价避免这种情况，因为无论您如何过滤它，它始终是一个潜在的安全漏洞。

有一个技巧可以帮助您在特定情况下使用/mypage?id=53，在WHERE子句中使用id是为了确保id确实是一个整数，如下所示:

if (isset($_GET['id'])) {
  $id = $_GET['id'];
  settype($id, 'integer');
  $result = mysql_query("SELECT * FROM mytable WHERE id = '$id'");
  # now use the result
}

但当然，这只排除了一个特定的攻击，所以阅读所有其他的答案。(是的，我知道上面的代码不是很好，但它显示了具体的防御。)

如果你使用的是PostgreSQL, PHP的输入可以用pg_escape_literal()进行转义

$username = pg_escape_literal($_POST['username']);

从文档中可以看到:

pg_escape_literal()转义用于查询PostgreSQL数据库的字面值。它返回PostgreSQL格式的转义文本。

PHP 5.2引入了filter_var函数。

它支持大量的SANITIZE, VALIDATE过滤器。