php 过滤用户输入危险字符串

// 使用 PDO 预处理语句
$pdo = new PDO('mysql:host=localhost;dbname=test', 'username', 'password');
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = :username AND password = :password');
$stmt->bindParam(':username', $username);
$stmt->bindParam(':password', $password);
$stmt->execute();

// 使用 htmlspecialchars 函数
$input = $_POST['input'];
$safe_input = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
echo $safe_input;

// 检查文件类型和大小
if (isset($_FILES['file'])) {
    $file = $_FILES['file'];
    $file_name = $file['name'];
    $file_tmp = $file['tmp_name'];
    $file_size = $file['size'];
    $file_type = $file['type'];

    // 只允许上传特定类型的文件
    $allowed_types = ['image/jpeg', 'image/png'];
    if (in_array($file_type, $allowed_types)) {
        // 移动文件到指定目录
        move_uploaded_file($file_tmp, 'uploads/' . $file_name);
    } else {
        echo "Invalid file type.";
    }
}