不要相信外部源
- $_GET
- $_POST
- $_REQUEST
- $_COOKIE
- $argv
- php://stdin
- php://input
- file_get_contents()
- 远程数据库
- 远程api
- 来自客户端的数据
htmlentities
<?php$input = ‘<p><script>alert("You won the Nigerian lottery!");</script></p>‘;echo htmlentities($input, ENT_QUOTES, ‘UTF-8‘);// <p><script>alert("You won the Nigerian lottery!");</script></p>
htmlpurifier
php安全 过滤、验证、转义
原文地址：https://www.cnblogs.com/mingzhanghui/p/9326322.html