防止基本的XSS攻擊 濾掉HTML標簽

/**
*    防止基本的XSS攻擊 濾掉HTML標簽
*    將HTML的特殊字符轉換為了HTML實體    htmlentities
*    將#和%轉換為他們對應的實體符號
*    加上了$length參數來限制提交的數據的最大長度
*/
function transform_HTML($string, $length = null) {
　　// Helps prevent XSS attacks

　　// Remove dead space.
　　$string = trim($string);

　　// Prevent potential Unicode codec problems.
　　$string = utf8_decode($string);

　　// HTMLize HTML-specific characters.
　　$string = htmlentities($string, ENT_NOQUOTES);
　　$string = str_replace("#", "#", $string);
　　$string = str_replace("%", "%", $string);
　　$length = intval($length);
　　if ($length > 0) {
　　　　$string = substr($string, 0, $length);
　　}
　　return $string;
}
/* 
// eg:
$string = " &gt;< > <a>&lt; \n /n \. \\ \ %22%3e %3c%53%43%52%49%5 0%54%3e%44%6f%73%6f%6d%65%74%68%6 9%6e%67%6d%61%6c%69%63%69%6 f%75%73%3c%2f%53%43%52%49%50%54%3e";
echo $string;
echo '<br>';
echo transform_HTML($string);

*/

/*

輸出 $string：

>< > < /n \. \ \ %22%3e %3c%53%43%52%49%5 0%54%3e%44%6f%73%6f%6d%65##%74%68%6 9%6e%67%6d%61%6c%69%63%69%6 f%75%73%3c%2f%53%43%52%49%50%54%3e

輸出 transform_HTML($string)：

&gt;< > <a>&lt; /n \. \ \ %22%3e %3c%53%43%52%49%5 0%54%3e%44%6f%73%6f%6d%65##%74%68%6 9%6e%67%6d%61%6c%69%63%69%6 f%75%73%3c%2f%53%43%52%49%50%54%3e

*/