8 PHP functions I won’t ever miss |
I’m always at most careful and concerned about security and especially idiot-proofing whenever I’m into developing some usual stuffs. PHP specifically, does not only provide it’s "FREEness", but also the handiest functions I always do not miss to consider. Here are my Top 8.
1-2. addslashes() and mysql_real_escape_string()
These two functions are a bit related, in a sense that these provide security especially in handling things with your database queries. As their name suggest, the first function adds slashes (escapes) to these characters in a string: ‘, ", \, while mysql_real_escape_string() escapes \x00, \n, \r, \, ‘, " and \x1a. In a more complicated security issue, most programmers prefer mysql_real_escape_string() since it prevents certain loop holes like escaping quotes (characters) which later lead to SQL injection.
3. stripslashes()
If slashes may be added to strings, then at some point, you would also need to strip them out. This is when stripslashes() comes in. Though I don’t really often use this function, but it becomes handy when you need to print an HTML code through a JavaScript code all from a PHP source. Just don’t forget this function, surely you will have to remember it as soon as you would need its purpose.
4-5. urlencode() and urldecode()
Printing anchors, source urls, url outputs, form validation using GET or POST method, urlencode() musn’t be missed out for use. Usually, the absence of this function especially when handling anchors result to broken links (which of course would be pretty inconvenient for your visitors). There are certain characters like %, &, ?, spaces, and other more special characters which are read differently on URLs which should be encoded first before passing it. While of course, urldecode() does the opposite. It decodes encoded URLs and reads them back on how they should be read.
6. trim()
Though this one’s not as important as the other mentioned functions, but this would definitely help in idiot-proofing. You know, some users may be too idiot to follow certain instructions that leading and tailing spaces are not accepted but still they submit their inputs with these. It would rather lead to flaws and unexpected results, so better trim out those spaces first before validating strings.
7. strip_tags()
Most web programmers just take this function for granted, but by the time their website layouts would act strange and get mixed up, they’ll start investigating and end up never knowing HOW. It’s because without strip_tags() just means your website will definitely become very very prone to hacks. A simple example would be the insertion of a <strong style="font-size:100px;"> string.
8. htmlentities()
My favorite of ‘em all. Nearly most of my PHP echoes come along with this (unless especially not needed). This encodes special characters into HTML readable characters like < (less than) to > and " (quote) to " This is very important when printing values for HTML tag attributes, since you would no longer need to bother for misprinting strings.
These are just pieces of advises and functions I recommend you mustn’t miss to consider. Mark them "strictly for security purposes", and everything will run as smoothly as a web should be. 
