Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Need help Updating SQL Server Express DB from c# :(
Please can anyone help with:-
1 How to sructure the strSelect statement.
2 How to instruct

getting rid of quotes in strings
sick of trying to deal with them in multiple ways (entering in and taking from database, echoing, ec

PHP hyperlinks generator
Hi

I need some help to get this done using php:


1 - I have few hyperlinks say 500

Is this Safe or Unsafe?
Hi i made a few pages with lots of peoples help now i just want to know if they are safe or not can

Help =( !! Upload Pics [PHP script]
Hello
I need help with a php script [MULTIPLE UPLOAD IMAGES] , where I want to add a feature (wat

convert pps to wsf with php'how?
hi
i want to convert with php
PowerPoint file to swf file(flash)
how please?
thank!!!

check if string contain only a-z/A-Z
Is where any way to check if string contains only a-z/A-Z, without writing an array with all possibl

Unexpected T_Variable ?
Hi all,
I dont really know what I am doing!! I know I'm doing something wrong, and I know its on

storing results of a function - previous result overwritten with new result
I have created a function to validate input.

function validate_dimension($value,$name) {
<

PHP4 to PHP5 Conversion
Hi Everyone,

I am working on a site that is built up on PHP4 and each page is being started f

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash