Strings.
COMMON OPERATIONS
Joining Splitting Searching Replacing Trimming Changing case Formatting numbers into text
WHAT TO BE CAREFUL WITH
Functions that are not aware of multi-byte characters.
WHY THAT MATTERS
Names and content containing accented or non-Latin characters are handled incorrectly by the basic functions.
WHAT TO USE INSTEAD
The multi-byte variants, for anything involving user content.
WHAT TO ALWAYS TRIM
Input from forms and files.
Trailing spaces cause a large class of comparison failures.
WHAT TO BE CAREFUL WITH IN COMPARISONS
Case differences Whitespace Different but visually similar characters
WHAT TO USE FOR BUILDING OUTPUT
Formatting functions, rather than extensive concatenation.
WHAT TO NEVER DO
Build markup or queries by joining strings containing user input.
THAT POINT
The root of the two most common vulnerabilities in PHP applications.
WHAT TO USE INSTEAD
Escaping for output, and parameterised queries for the database.
