将字符串编码转换为UTF-8

Question

I am building my own PHP framework, and I want on each request to convert each get and post variable to utf8 (I don't use other encodings anywhere in my current project) to prevent my projects from "Invalid Encoding Attack" or binary atack. I found utf8_encode in php.net, but it says that converts ISO-8859-1 to UTF8 only. I want to know is it a big deal to cast everything to utf8, or this cannot do anything in common with security (I want to decrease the security holes as much as possible).

Answer 1

@nikolay, mb_convert_encoding() is your friend. Have a look here .

Additionally, if you set the encoding of all web-pages to UTF-8, there's no need to convert manually. Add this to each page's head section:

<meta charset="utf-8" />

Answer 2

If your goal is to protect yourself from invalid encoding attacks, then you should use

mb_check_encoding()

on your GET/POST values before using them.

But you don't need to convert anything - eg using mb_convert_encoding(): if you use the appropriate Content-Type and <meta> tag, specifying your page is in UTF-8, you are guaranteed that normal users will send you only UTF-8.

Answer 3

iconv > http://php.net/manual/en/book.iconv.php