php过滤所有恶意字符

// 原始代码
$query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "'";

// 改进后的代码
$username = mysqli_real_escape_string($conn, $_POST['username']);
$query = "SELECT * FROM users WHERE username = '$username'";

// 原始代码
echo $_POST['comment'];

// 改进后的代码
$comment = htmlspecialchars($_POST['comment'], ENT_QUOTES, 'UTF-8');
echo $comment;

function sanitize_input($data) {
    if (is_array($data)) {
        foreach ($data as $key => $value) {
            $data[$key] = sanitize_input($value);
        }
    } else {
        // 使用mysqli_real_escape_string防止SQL注入
        $data = mysqli_real_escape_string($conn, $data);
        // 使用htmlspecialchars防止XSS攻击
        $data = htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
        // 使用正则表达式移除潜在的恶意字符
        $data = preg_replace('/[^a-zA-Z0-9\s]/', '', $data);
    }
    return $data;
}

// 使用示例
$_POST['username'] = sanitize_input($_POST['username']);
$_POST['comment'] = sanitize_input($_POST['comment']);