{"id":1285,"date":"2021-02-26T18:53:02","date_gmt":"2021-02-26T18:53:02","guid":{"rendered":"https:\/\/dft.wiki\/?p=1285"},"modified":"2026-06-09T09:39:02","modified_gmt":"2026-06-09T13:39:02","slug":"php-sql-injection-prevention","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1285","title":{"rendered":"PHP \/ SQL Injection Prevention"},"content":{"rendered":"<p>Basic usage of the main PHP native functions for sanitizing input.<\/p>\n<p>See the PHP documentation for more details, examples, and version compatibility.<\/p>\n<p><strong>strip_tags<\/strong> [<a href=\"https:\/\/www.php.net\/manual\/en\/function.strip-tags.php\">Link<\/a>]<\/p>\n<pre>$string = strip_tags($input);\r\n$string = strip_tags($input, '&lt;br&gt;');\r\n$string = strip_tags($input, '&lt;p&gt;&lt;a&gt;');\r\n$string = strip_tags($input, ['p', 'a']);<\/pre>\n<p><strong>htmlspecialchars<\/strong> [<a href=\"https:\/\/www.php.net\/manual\/en\/function.htmlspecialchars.php\">Link<\/a>]<\/p>\n<pre>$string = htmlspecialchars($input);\r\n$string = htmlspecialchars($input, ENT_QUOTES);<\/pre>\n<p><strong>filter_var<\/strong> [<a href=\"https:\/\/www.php.net\/manual\/en\/function.filter-var.php\">Link<\/a>]<\/p>\n<pre>$string = filter_var($input, FILTER_SANITIZE_STRIPPED);\r\n$string = filter_var($input, FILTER_VALIDATE_EMAIL);\r\n$string = filter_var($input, FILTER_VALIDATE_URL, FILTER_FLAG_PATH_REQUIRED);\r\n$string = filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);<\/pre>\n<p>See also Sanitize Filters [<a href=\"https:\/\/www.php.net\/manual\/en\/filter.filters.sanitize.php\">Link<\/a>] and Validate Filters [<a href=\"https:\/\/www.php.net\/manual\/en\/filter.filters.validate.php\">Link<\/a>].<\/p>\n<p><strong>mysqli_real_escape_string<\/strong> [<a href=\"https:\/\/www.php.net\/manual\/en\/mysqli.real-escape-string.php\">Link<\/a>]<\/p>\n<pre>$string = mysqli_real_escape_string($link, $input);<\/pre>\n<p><strong>Other ways to filter string content:<\/strong><\/p>\n<pre>$string = str_replace(array('\"', \"'\", '`', '\u00b4', '\u00a8'), '', $input);\r\n$string = preg_replace('#[^A-Za-z\u00e0-\u017a\u00c0-\u01790-9 ]#', '', $input);\r\n$string = trim($input, \" \\n\\r\\t\\v\\0\");<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Basic usage of the main PHP native functions for sanitizing input. See the PHP documentation [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,7],"tags":[],"class_list":["post-1285","post","type-post","status-publish","format-standard","hentry","category-hacking","category-web"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1285"}],"version-history":[{"count":2,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1285\/revisions"}],"predecessor-version":[{"id":5778,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/1285\/revisions\/5778"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}