Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Help With editting and deleting form
Hallo !!

So look at this image :

http://img194.imageshack.us/img194/8272/snapshot5f.pn

SELECT * FROM users WHERE Users are not in Blocked
How do I select all users from users table where there users_id is not stored in the block table

Function module "DPS_CHECK_TABLE_EXISTS" not found (after OSS 1422843 impl)
Dear All,

I implemented Note OSS 1422843.

When i execute the new report RSPO20

Beginner PHP code help
Hi I'm new to php but if someone could please read the question below and help it would be great.

Multi Level Array Problem
hi all,

For example I have array like below:

$temp = array(array('north america', 'us'

help with mysql_error()
Hi,

I am trying to insert data into a table, but I am not able to insert it. I wanted to see

Inserting multiple records from single form
I've found a number of threads that deal with this issue, but I'm new to php and coding language so

SAP Project Module
I have seen in the SAP Project Module,plan cost and budget are not equal and even difference is sign

Format String help
I have a textbox where a person enters an application number. the application number is 10 characte

Save file by click
Hello.
I'm not understand how to save file from page. I'd like make link to file with save abil

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash