بررسی امنیت سایت در برنامه نویسی

دوستان اگه بهتر می تونن. ادامه بدن

یه تابع کاملتر برای چک کردن ورودی ها نوشتم که میتونید از این استفاده کنید . این کاملتره به نظرم:
[PHP]
function filter_html($what){


///.. BASIC ASCII Entities with new Entity Names
$what = str_replace( "&#" , "(^)-(^)" , $what );
$what = str_replace( "&" , "&" , $what );
$what = str_replace( ">" , ">" , $what );
$what = str_replace( "<" , "&lt;" , $what );
$what = ereg_replace( "\"" , "&quot;" , $what );
$what = str_replace( "!" , "!" , $what );
$what = str_replace( "'" , "'" , $what );
$what = str_replace( "(^)-(^)" , "&#" , $what );
$what = str_replace("`" ,"" , $what );
$what = ereg_replace("\n" , "<br>" , $what );
$what = ereg_replace("\r" , "" , $what );

///.. ISO 8859-1 Symbol Entities
$what = str_replace("¡" , "&iexcl;" , $what );
$what = str_replace("¤" , "&curren;" , $what );
$what = str_replace("¢" , "&cent;" , $what );
$what = str_replace("£" , "&pound;" , $what );
$what = str_replace("€" , "&euro;" , $what );
$what = str_replace("¥" , "&yen;" , $what );
$what = str_replace("¦" , "&brvbar;" , $what );
$what = str_replace("§" , "&sect;" , $what );
$what = str_replace("©" , "&copy;" , $what );
$what = str_replace("¿" , "&iquest;" , $what );
$what = str_replace("¶" , "&para;" , $what );

///.. ISO 8859-1 Character Entities
$what = str_replace("À" , "&Agrave;" , $what );
$what = str_replace("Á" , "&Aacute;" , $what );
$what = str_replace("Â" , "&Acirc;" , $what );
$what = str_replace("Ä" , "&Auml;" , $what );
$what = str_replace("Å" , "&Aring;" , $what );
$what = str_replace("Æ" , "&AElig;" , $what );
$what = str_replace("Ç" , "&Ccedil;" , $what );
$what = str_replace("È" , "&Egrave;" , $what );
$what = str_replace("É" , "&Eacute;" , $what );
$what = str_replace("Ê" , "&Ecirc;" , $what );
$what = str_replace("Ë" , "&Euml;" , $what );
$what = str_replace("Ì" , "&Igrave;" , $what );
$what = str_replace("Î" , "&Icirc;" , $what );
$what = str_replace("Ï" , "&Iuml;" , $what );
$what = str_replace("Ð" , "&ETH;" , $what );
$what = str_replace("Ñ" , "&Ntilde;" , $what );
$what = str_replace("Ò" , "&Ograve;" , $what );
$what = str_replace("Ó" , "&Oacute;" , $what );
$what = str_replace("Ô" , "&Ocirc;" , $what );
$what = str_replace("Õ" , "&Otilde;" , $what );
$what = str_replace("Ö" , "&Ouml;" , $what );
$what = str_replace("Ø" , "&Oslash;" , $what );
$what = str_replace("Ù" , "&Ugrave;" , $what );
$what = str_replace("Ú" , "&Uacute;" , $what );
$what = str_replace("Û" , "&Ucirc;" , $what );
$what = str_replace("Ü" , "&Uuml;" , $what );
$what = str_replace("Ý" , "&Yacute;" , $what );
$what = str_replace("Þ" , "&THORN;" , $what );
$what = str_replace("ß" , "&szlig;" , $what );
$what = str_replace("à" , "&agrave;" , $what );
$what = str_replace("á" , "&aacute;" , $what );
$what = str_replace("â" , "&acirc;" , $what );
$what = str_replace("à" , "&aacute;" , $what );
$what = str_replace("ä" , "&auml;" , $what );
$what = str_replace("å" , "&aring;" , $what );
$what = str_replace("æ" , "&aelig;" , $what );
$what = str_replace("ç" , "&ccedil;" , $what );
$what = str_replace("è" , "&egrave;" , $what );
$what = str_replace("é" , "&eacute;" , $what );
$what = str_replace("ê" , "&ecirc;" , $what );
$what = str_replace("ë" , "&euml;" , $what );
$what = str_replace("ì" , "&igrave;" , $what );
$what = str_replace("í" , "&iacute;" , $what );
$what = str_replace("î" , "&icirc;" , $what );
$what = str_replace("ï" , "&iuml;" , $what );
$what = str_replace("ð" , "&eth;" , $what );
$what = str_replace("ñ" , "&ntilde;" , $what );
$what = str_replace("ò" , "&ograve;" , $what );
$what = str_replace("ó" , "&oacute;" , $what );
$what = str_replace("ô" , "&ocirc;" , $what );
$what = str_replace("õ" , "&otilde;" , $what );
$what = str_replace("ö" , "&ouml;" , $what );
$what = str_replace("ø" , "&oslash;" , $what );
$what = str_replace("ù" , "&ugrave;" , $what );
$what = str_replace("ú" , "&uacute;" , $what );
$what = str_replace("û" , "&ucirc;" , $what );
$what = str_replace("ü" , "&uuml;" , $what );
$what = str_replace("ý" , "&yacute;" , $what );
$what = str_replace("þ" , "&thorn;" , $what );
$what = str_replace("ÿ" , "&yuml;" , $what );

///.. ISO 8859-1 Other Entities
$what = str_replace("Œ" , "&OElig;" , $what );
$what = str_replace("œ" , "&oelig;" , $what );
$what = str_replace("Š" , "&Scaron;" , $what );
$what = str_replace("š" , "&scaron;" , $what );
$what = str_replace("˜" , "&tilde;" , $what );
$what = str_replace("‘" , "&lsquo;" , $what );
$what = str_replace("’" , "&rsquo;" , $what );
$what = str_replace("‚" , "&sbquo;" , $what );

// for some really strange reason this is replacing all characters:
$what = str_replace("Ã" , "&Atilde;" , $what );
$what = str_replace("ã" , "&atilde;" , $what );

return $what;
}

[/PHP]

و در ضمن تابع زیر رو زمانی میشه بکار برد که به ورودی اجازه کدهای html رو میدیم ولی اجازه ورود تگ های حساس رو منع می کنیم:
[PHP]
function filter_html_dangerous_tags($what){
$what = str_replace( "<script>" , "&lt;script&gt;" , $what );
$what = str_replace( "</script>" , "&lt;/script&gt;" , $what );
$what = str_replace( "<object>" , "&lt;object&gt;" , $what );
$what = str_replace( "</object>" , "&lt;/object&gt;" , $what );
$what = str_replace( "<iframe>" , "&lt;iframe&gt;" , $what );
$what = str_replace( "</iframe>" , "&lt;/iframe&gt;" , $what );
$what = str_replace( "<frameset>" , "&lt;frameset&gt;" , $what );
$what = str_replace( "<frameset>" , "&lt;frameset&gt;" , $what );
$what = str_replace( "<frame>" , "&lt;frame&gt;" , $what );
$what = str_replace( "</frame>" , "&lt;/frame&gt;" , $what );
$what = str_replace( "<link>" , "&lt;link&gt;" , $what );
$what = str_replace( "</link>" , "&lt;/link&gt;" , $what );
return $what;
}

[/PHP]

سلام
چطوری میشه از این کدا استفاده کرد و در چه مواقعی
البته ببخشید اگه خیلی مبتدی هست سوالم

اگر میشه نحوه استفاده از این کدها رو هم توضیح بدید. الان من نمی دونم این کدهارو کجا کپی کنم تا سایتم اینهارو استفاده کنه...
ممنون