Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Change snippet to use CURDATE
I am using time() in the snippet below, I would like to use CURDATE() and have the database setup fo

Code working in IE but not FireFox
I created a dynamic navigation list for my website based off of a table in my database. The code is

newbie question about multiple queries
hi everyone,
I'm sorry to ask such a basic question, but I'm young and trying to learn php on my

simple ping code
been searchin the site/web and found code thats simple but doesnt work.

I have a personal we

Php WordPress help
I am writing the following code for making a plugin

<?php
header("Content-Type

mod_rewrite.c on windows ??
why it's not working on windows while it's working on other hosts???

this is the code i got

Include ("Absolute Path") of a file?
I'm not sure what I'm doing wrong. I am writing my php code in the same directory of the file that

Add trigger to UpdatePanel programmatically
Hi,I'm working on a website which uses AJAX and Masterpages. What I have is an AJAX UpdatePanel whi

Email to a friend script problems
I have this send-to-a-friend script with 2 issues:


1) When you open the form popup on a p

Multiple websites question.
Hi, does php have any functionality that enables a programmer to extract information from a website

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash