Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

OPINIONS WANTED
This is my login page code, and I want your opinion on it please!

Code: // Login ~ CHECKS

'grab_files', multiple extension?
hey guys,

can anyone suggest a way to make to following line of code look for files with more

[newb] Image hosting help.
Hey there, I'm new to php, I know some basics and i can code PWN, I'm only 14 but I'm interested in

PL/SQL: ORA-00947: not enough values error message
Hi all i am getting Error(25,63): PL/SQL: ORA-00947: not enough values error message when executing

Production of mango in processing industry
Hi,

We have one scenario ,company is in process industry,they are manufacturing MANGO pul

Using Microsoft Exchange Server with PHP
Hi,

I wanted to know if its possible to fetch email attachments from the exchange server usin

mysq_num_rows
Hi,

I want to use:

Code: if(mysql_num_rows($ergebnis2)==2)
how can the value 2, be

PHP doesn't send my mail
Hi all, I found this and used it to send mail. Simple contact form with some required fields. The va

Legal Issues for SAP ERP o ERP in general
Hi experts,

Can someone please help me finding some documentation about legal issues tha

Beginners syntax and loop questions - help please!
Hi everyone,

I have some problems with php code. I'm currently in the middle of learning php,

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash