如前所述,似乎想到的第一件事是传递信息的非标准方式。 如果你贬低价值,就会带来一些困难。 虽然对我来说,主要问题不是核对/核对/清理/清理GET的数据。 也许这过于明显,因为几乎所有答案都是由那些似乎知道他们做了些什么的人回答的,因此,我有理由认为,他们只是不提及这一点。
但记得,如果你不检查,你很容易受到攻击,手稿不灵。 损害的程度取决于你自己的应用,因此无法预测。
无论如何,这是我所做的事,包括html。
<?php
// initialize variables
$variable_1 = false; // assume this is the page you want to load
$variable_2 = false;
$default = index.php ; // the idea is to load something controlled by you. index, error, 404, etc.
// process $_GET, check, clean and assign values
if ( isset( $_GET ) !== false ) {
foreach ( $_GET as $keys => $values ) {
// check both, $keys and $values for; character set, length, validity against a white list, content
// using an if to match the $keys garantees that regardless of the order, you will get what you want
if ( $keys === field_1 ) {
// do what you have to do with this, for instance ...
$variable_1 = $values;
}
if ( $keys === field_2 ) {
// do what you have to do with this, for instance ...
$variable_2 = $values;
}
unset( $_GET[$keys] );
}
unset ( $keys, $values );
}
// check there are no surprises on $_GET. Load and study anything here
if ( empty( $_GET ) === false ) {
// it should be empty, so log what is in here and prepare your code for that
unset( $_GET );
} else {
unset( $_GET );
}
// process the variables according to what you want to do
// if there are just a few options, and they are not going to change often
// use a switch, otherwise, use a method to check if a file/content exists
// for the request and load it. If it doesn t exist, inform the user
// with out giving away internals and suggest a new destination
// process other variables, here or before this part, wherever makes sense
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>testing get</title>
</head>
<body>
<form method="get" action="test_get_00.php" accept-charset="utf-8">
<p><label for="field_1">write something<input type="text" id="field_1" name="field_1" /></label></p>
<p><label for="field_2">write something<input type="text" id="field_2" name="field_2" /></label></p>
<p><button type="submit">send</button></p>
</form>
</body>
</html>
Of course you can do a few more things, but if you prepare your form properly, including the character set, you have less worries, or at least a few more known elements. It s not failproof, but it helps.
此外,我前面提到的机械师们在一份白色名单的思想集上工作,即画家的思想,以检查你在伐木后会得到的东西和抛弃其他东西。