What are some common methods in PHP for escaping special characters to prevent syntax errors or injection attacks?

To prevent syntax errors or injection attacks in PHP, it is important to escape special characters before using user input in SQL queries, HTML output, or other contexts where special characters could be interpreted as code. Common methods for escaping special characters in PHP include using functions like mysqli_real_escape_string() for database queries, htmlentities() for HTML output, and addslashes() for general string escaping. 

// Example of escaping special characters in a SQL query using mysqli_real_escape_string
$mysqli = new mysqli("localhost", "username", "password", "database");
$user_input = $_POST['user_input'];
$escaped_input = $mysqli->real_escape_string($user_input);

$query = "SELECT * FROM users WHERE username='$escaped_input'";
$result = $mysqli->query($query);

// Example of escaping special characters for HTML output using htmlentities
$user_input = $_POST['user_input'];
$escaped_input = htmlentities($user_input);

echo "<p>User input: $escaped_input</p>";

// Example of general string escaping using addslashes
$user_input = $_POST['user_input'];
$escaped_input = addslashes($user_input);

echo "Escaped input: $escaped_input";

Keywords

PHP escaping special characters syntax errors injection attacks

Related Questions