使用htmlspecialchars（）函数防止数据注入

Question

Many documents recommend to use htmlspecialchars() to get rid of data injection during form submitting. form-validation .

With html5 (i guess) not using action attribute of form, makes the similar effect with using $_SERVER["PHP_SELF"] . Does actionless forms create the same security leak as well?

Answer 1

不会。如果您制作不采取行动的表格，则不要使用$ _SERVER [“ PHP_SELF”] ，因此它是安全的。