php 过滤危险字符

// 使用 PDO 预处理语句
$pdo = new PDO('mysql:host=localhost;dbname=test', $user, $pass);
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// 使用 htmlspecialchars 函数
$input = $_GET['input'];
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');

// 检查文件类型和大小
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $fileType = $file['type'];
    $fileSize = $file['size'];

    if ($fileType !== 'image/jpeg' || $fileSize > 1048576) {
        die('Invalid file');
    }

    // 移动文件到安全目录
    move_uploaded_file($file['tmp_name'], 'uploads/' . basename($file['name']));
}