Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

php file erros / need help please
Hello

Someone decoded a zend file for me.. after uploaded it on ftp i get some errors, i trye

Problems with adding a link to one position in a 'foreach' loop, please help
Hello!

Iam pretty new to programming and I wanna create a table with users from an array. It

System copy error in RUN ABAP REPORT PHASE
Hi,
I am performing system copy on my test server. I have previously taken export of JAVA + A

PHP onsubmit in the form not going to the fuction.
I have a form through ‘onsubmit’ calling a function validation(). But not going to the

Find only certain URLs from page ... regex (semi-complete script)
Hi guys,

What I need to do is take a page & extract all the URLs from the page &a

[newb] Image hosting help.
Hey there, I'm new to php, I know some basics and i can code PWN, I'm only 14 but I'm interested in

Access website from only 1 computer...?
One of my customers wants his website to only be accessed by people in which they bought the website

File upload issues
Hi Guys,

Can anyone see any issues with this code:
Code: $setImage= 'productimages/' . dat

Display Database
I need to create a shopping cart. I found this code online: http://conceptlogic.com/jcart/
Unfort

insert quotes
Hi,

I have an output like this:
Code: john,18,Cancer
How can I change this to
Code:

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash