Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Is this Safe or Unsafe?
Hi i made a few pages with lots of peoples help now i just want to know if they are safe or not can

Display error above the login forum help!
Hi guys. just so you know im not asking for someone to do this for me I just need to be pointed in t

Strange php code found on my website
I got hacked and the following code was placed within my files:

Code: [Select]<?
/*

Deleted Delivery but material wont return
We deleted a delivery but the material its still pending.

We made a reverse goods movemen

Why does my php page download images over and over
Can anybody please explain to me why my php page keeps downloading the images and other items every

upload only text files
hi guys i want to upload only text like like (pdf,note pad and ofiice files) so can any one please t

how to get IP address?
hey guys,

i have this code which is supposed to get me the IP address of my site visitors:

do while...woes
I'm sure this is childsplay but it is stumping me, everytime i try what I think would make this work

Packet Design
Hi All,
Im new about network programming and I want to design a protocol but I have some question

Need help Updating SQL Server Express DB from c# :(
Please can anyone help with:-
1 How to sructure the strSelect statement.
2 How to instruct

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash