sql注入过滤 $user=mysql_real_escape_string($_POST['user']); xss过滤 htmlentities($srt); 转载于:https://www.cnblogs.com/gaohuag/archive/2012/07/06/2579260.html