Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

need help with this contact form
I made this form and I need it to read the data and write the data to a table and its not working ca

how do i make new line after *
First check this page here. and you see my report. Im pulling form a mysql db. I want to beable to m

Variable uses and placement
I'm new to PL/SQL and am trying to learn about variable valid uses/placement (any pointers to any do

ctype() validation - allowing illegal characters
Hello,
I use ctype() to filter and validate a user form. However, I am trying to allow certain c

DOMDocument
Hello All,

I need to take an XML document, modify some of the nodes in it and then perform a

help finding hacking loopholes
i was attacked by a redirect php injection

my pc is clean of viruses

so i figure that

Reg Ex
Im trying to search for the string: srv_9 (Dead ???)

I thought to use preg_match, however I d

Server side $_SESSION
how does one keep the session completely server side. no cookies to the browser at all. i need this

blank page.... nothing is happening.
I'm new to a lot of this but in the last 24hrs have learned a lot.
Installed latest version of my

Mass activity scheduling
Hi experts,

Im facing some problems to deal with mass activity jobs.
When I run some

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash