Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Error in query: Resource id #4??
hey guys, having a minor (i think) problem here that i havent been able to figure out. long story sh

Custom list order
Hi there,

I have checked this tutorial and it's great till the point where I want to display

How to use Substr
I want to check for the word CATEGORY: inside a string which can be CATEGORY: ITEM
and remove the

Calander layout
Hi i know this sounds like a simple question but i cant find the answer to it anywhere i have added

Table Control
Hi Guru's,

I've created a Module pool program, which contains the Table Control.

Object Interfaces
EDIT: Never mind, I just updated to php 5.

Hey all,

I'm currently experimenting with p

Inserting Data into a MS Access DB using PHP.
As part of my uni course I am doing a placement at a company whom want me to create a client zone fo

Shuffle between users ??
I have multiple $users in table. I need to send them $message.

I need to send the next messag

Working with Global Variables
hi, I'm not really sure why the following code is returning a "Call to a member function getBan

Fatal error: Call to a member function fetchrow() on a non-object in C:xamppht
okay i have this query and everytime i add `item_id`=? to it... it gives me the error in the title..

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash