Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Help: calling function
Hi,
Is it possible to call a php function on page close?
If yes, could you explain how and whe

Need help with an email blocker for a guessbook
I am new with php and here is a simple guessbook page but I am being hit with spam from a group of t

how do i display data on a page from mysql
1 - do i use this code at the top of each of my page i wish to only alow access if there as been a s

Embedding flash object in Else statement
This is my first major project in PHP and I'm having some trouble embedding a flash object in an Els

Changing color in GD via variable?
Hey guys, I'm new here. x)

I'm very much a noob when it comes to PHP, but I'm trying to learn

rand() function
just a general question guys a girls, is the rand() function 100% random or is it based on time?

blank page.... nothing is happening.
I'm new to a lot of this but in the last 24hrs have learned a lot.
Installed latest version of my

Login script (probably a simple error)
dbConfig.php
Code: <?
// Replace the variable values below
// with your specific dat

IP Logger for Voting Script
Can anybody help me place an IP logger into my voting script?
I know that maybe it is not as secu

Help with php code
Hello, can anyone tell me why this php word trap fails to work,
and the trigger words get blow r

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash