20hrs

將特殊字元轉成HTML碼 $text =htmlspecialchars(" < a href= ' test '> Test < /a > " , ENT_QUOTES); &lt ; a href= &#039 ; test &#039 ; &gt ; Test &lt ; /a &gt ; 將空白與換行轉成HTML碼 $text = "Good morning! \n "; $text = str_replace(' ', ' &nbsp ; &nbsp ; ', nl2br($text) ); echo $text; // Good &nbsp ; &nbsp ; morning! <br / > 避免SQL Injection安全隱憂 mysql_real_escape_string($password) //$password = "' OR ''='"; $password -> \' OR \'\'=\' SQL Injection attacks will not work. magic_quotes_gpc 表單中文字包含 ' " \ magic_quotes_gpc自動加上\ -> \' \" \\ 最好視為預設關閉 function myStripslashes($text) { if (get_magic_quotes_gpc()) $text = stripslashes($text); return $text; } $text = myStripslahes($_POST['text']); 手動加上 addslashes(String) 手動去掉 stripslashes(String) Conclude: 接收表單資料後使用4回覆原始資料 而後使用3寫入MySQL(加上反斜線) 從MySQL拿出資料先stripslash