Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

How to ... (FAQs)
... get e-mail notifications As several people asked how to get e-mail notifications when new posti

eregi to preg
Im converting my regex for php 5.3 and I am stuck on the following

Code: [Select]if((eregi(&q

I think i'm using the syntax incorrectly
Hi Everyone!

I'm new to this forum and a newbie with PHP - I'm glad I found this site - I hop

Logic question
im wondering what's the best method to do the above list:

it is for alliance @ MMORPG game

Insert to MySQL inside foreach
Hey.
I am parsing some html, and putting inside an html db.
I need to create a randomized inte

BAPI BBP_INB_DELIVERY_CREATE - material number missing in delivery
Hi Experts,

I was able to successfully create an Inbound delivery with reference to a PO

How to insert random unique values in 2 columns ?
I have table with 2 columns

Create Table code_for_code (
first_code varchar2(10) uni

output_buffering so rewrite
I'm planning to rewrite some of my scripts so they don't have to use output buffering to accomplish

Echo-ing MySQL content and Keep Formatting?
I have data in my MySQL such as:

QuoteBlah blah

Blah blah

etc
but when i ech

calendar dates and hours compare problem
i have a calendar in wordpress, everything works great except that i can make 2 meetings at the same

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash