你可以试试
$_POST = array_map(function ($var) {
return stripslashes(htmlentities(strip_tags($var)));
}, $_POST);
foreach ( $_POST as $key => $value ) {
echo "$key = $value <br>";
}
或 Better Sill 使用filter_var
$_POST = array_map(function ($var) {
return filter_var($var, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW);
}, $_POST);
不同之处
$var = "index.php?name=guest<script>alert('attacked')</script>";
var_dump(stripslashes(htmlentities(strip_tags($var))));
var_dump(filter_var($var, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_LOW));
输出
string 'index.php?name=guestalert('attacked')' (length=37)
string 'index.php?name=guestalert('attacked')' (length=45)