PHP Security String Functions
htmlspecialchars · strip_tags · addslashes · md5 · sha1

<?php
// User ने यह input दिया (malicious)
$userInput = '<script>alert("Hacked!")</script>';

// ❌ Without htmlspecialchars — DANGEROUS!
echo "Hello, " . $userInput;
// Browser script execute करेगा! XSS attack!

// ✅ With htmlspecialchars — SAFE!
echo "Hello, " . htmlspecialchars($userInput);
// Hello, <script>alert("Hacked!")</script>
// Browser text की तरह display करेगा — safe!
?>

<?php
// 1. Comment display करना — always use!
$comment = $_POST['comment'] ?? '';
echo "<p>" . htmlspecialchars(trim($comment)) . "</p>";

// 2. Form value में — attribute injection से बचाव
$naam = $_POST['naam'] ?? '';
echo '<input value="' . htmlspecialchars($naam, ENT_QUOTES) . '">';

// 3. Helper function बनाना
function h($str) {
  return htmlspecialchars($str, ENT_QUOTES, 'UTF-8');
}
// अब हर जगह h() use करो
echo "<h1>" . h($_GET['title'] ?? '') . "</h1>";
?>

<?php
// htmlspecialchars → encode
$original = '<b>Hello & "World"</b>';
$encoded = htmlspecialchars($original);
echo $encoded;
// &lt;b&gt;Hello &amp; &quot;World&quot;&lt;/b&gt;

// htmlspecialchars_decode → decode back
$decoded = htmlspecialchars_decode($encoded);
echo $decoded;
// <b>Hello & "World"</b> (original back!)

// html_entity_decode — ALL entities decode करता है
echo html_entity_decode("&copy; 2025 &mdash; HindiNotes");
// © 2025 — HindiNotes
?>

<?php
$html = "<h1>Hello</h1> <b>PHP</b> <script>alert('xss')</script> World";

// सब tags हटा दो
echo strip_tags($html);
// Hello PHP World

// Whitelist — कुछ tags रहने दो
echo strip_tags($html, '<b><i><p>');
// Hello <b>PHP</b> World (<h1> और <script> removed)

// PHP 8+ — array whitelist
echo strip_tags($html, ['b', 'i', 'p', 'a']);
?>

<?php
// 1. Blog excerpt — plain text preview
$richText = "<h2>PHP Tutorial</h2><p>PHP is a <b>popular</b> language used for <i>web development</i>.</p>";
$plainText = strip_tags($richText);
$excerpt = substr($plainText, 0, 100) . "...";
echo $excerpt;
// PHP TutorialPHP is a popular language used for web developme...

// 2. Search index बनाना — tags without content
$content = "<p>PHP <b>programming</b> language</p>";
$searchText = strtolower(strip_tags($content));
// "php programming language" — index करो

// 3. Safe rich text — कुछ safe tags रहने दो
$userHtml = $_POST['content'] ?? '';
$safeHtml = strip_tags($userHtml, ['p', 'b', 'i', 'ul', 'li', 'br']);
echo $safeHtml;
?>

<?php
// addslashes — quotes के पहले \ add करता है
$str = "It's a "great" day";
echo addslashes($str);
// It\'s a \"great\" day

// stripslashes — \ हटा देता है (reverse)
echo stripslashes("It\\'s a day");
// It's a day

// JavaScript में string pass करना
$jsStr = "He said 'Hello' and \"Bye\"";
echo "<script>var msg = '" . addslashes($jsStr) . "';</script>";
?>

<?php
// md5 — 32 char hex
echo md5("Hello");
// 8b1a9953c4611296a827abf8c47804d7

// sha1 — 40 char hex
echo sha1("Hello");
// f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0

// Same input = same hash (deterministic)
echo md5("PHP") === md5("PHP") ? "Same" : "Different";
// Same — same input, same output

// Different input = very different hash
echo md5("PHP"); // b52a6c1f9b4e1aaefa38e0e2b99b8e13
echo md5("php"); // 1d78aa5e72a5e2eff15c29ec2a8d4e5a (बिल्कुल अलग!)
?>

<?php
// ✅ CORRECT uses of md5/sha1:

// 1. File integrity check
$fileHash = md5_file("download.zip");
echo "MD5: " . $fileHash; // Verify file is not corrupted

// 2. Cache key बनाना
$cacheKey = md5("user_" . $userId . "_profile");
// Short, unique, consistent key

// 3. Gravatar image URL
$email = "rahul@gmail.com";
$gravatarHash = md5(strtolower(trim($email)));
$gravatarUrl = "https://www.gravatar.com/avatar/" . $gravatarHash;

// ❌ WRONG — password के लिए md5 मत use करो
// $hash = md5($password); // NEVER DO THIS!

// ✅ CORRECT — password hashing
$password = "mySecurePass123";
$hash = password_hash($password, PASSWORD_BCRYPT);
echo $hash; // $2y$10$... (bcrypt hash)

// ✅ CORRECT — password verify
if (password_verify($password, $hash)) {
  echo "✅ Password correct!";
}
?>

<?php
// Raw form input
$rawNaam = $_POST['naam'] ?? '';
$rawEmail = $_POST['email'] ?? '';
$rawPassword = $_POST['password'] ?? '';
$rawBio = $_POST['bio'] ?? '';

// Step 1: trim — spaces हटाओ
$naam = trim($rawNaam);
$email = strtolower(trim($rawEmail));
$password = trim($rawPassword);
$bio = trim($rawBio);

// Step 2: strip_tags — HTML हटाओ bio से
$bio = strip_tags($bio);

// Step 3: Validate
$errors = [];
if (strlen($naam) < 2) $errors[] = "नाम बहुत छोटा है";
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) $errors[] = "Invalid email";
if (strlen($password) < 8) $errors[] = "Password कम से कम 8 chars";

if (empty($errors)) {
  // Step 4: password_hash — secure hashing
  $hashedPass = password_hash($password, PASSWORD_BCRYPT);

  // Step 5: Gravatar hash for profile pic
  $avatarHash = md5($email);

  // Step 6: Database में save (PDO)
  $stmt = $pdo->prepare("INSERT INTO users (naam, email, password, bio) VALUES (?,?,?,?)");
  $stmt->execute([$naam, $email, $hashedPass, $bio]);

  // Step 7: Display — htmlspecialchars
  echo "Welcome, " . htmlspecialchars($naam) . "!";
}
?>