Nói chung, tốt hơn để sử dụng danh sách trắng, nếu có thể, bởi vì nó an toàn hơn so với danh sách đen. Với danh sách đen, nó dễ dàng để quên bao gồm một nhân vật đặc biệt độc hại trong danh sách đen, do đó tạo ra một lỗ hổng bảo mật tiềm năng. | Chapter 20 Writing High-Quality Code Generally speaking it s better to use whitelisting if possible because it s safer than blacklisting. With blacklisting it s easy to forget to include a particular malicious character in the blacklist thereby creating a potential security hole. However sometimes it s simply not possible or practical to use a whitelist in which case a blacklist is the best approach. Although regular expressions give you a lot of flexibility with checking input you can use other techniques to make life easier. For example HTML QuickForm covered in Chapter 15 lets you create and use rules to validate input sent from a Web form. You can also use libraries such as the PEAR Validate package see http package Validate to validate input such as dates email addresses URLs and so on. An alternative to validating input is filtering. With this approach rather than checking that user input doesn t contain malicious data and rejecting it if it does you simply remove any malicious data from the input and proceed as normal php searchQuery _GET search searchQuery preg_replace Aa-zA-Z0-9 searchQuery echo You searched for . searchQuery display search results here In this example any characters that aren t letters or digits are removed from the query string before it is used. When the previous malicious query string is supplied the script produces the following output You searched for scriptdocumentlocationhrefhttpwwwexamplecomstolencookiesdocumentcookiescript A variation on filtering is to use casting to ensure that the input is of the required type pageStart int _GET pageStart Filtering is often nicer from a user s perspective because they don t have to deal with error messages or reentering data. However because data is silently removed by the application it can also lead to confusion for the user. Encoding Output As well as validating or filtering all input to your script it s a good idea to encode the script s output. This can help to prevent .
