Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

extract data
Code: <div class="post hentry uncustomized-post-template">

Need help making a script that moves data into acrhive table
Hi,

I'm kinda new to php/mysql

And i wrote a simple script to store sales lead for a b

IMAGE - SERVER SIDE scripting help...
How to receive pixel data of an image and buid a bitmap file on the server using the HTTP POST metho

Backflush
I am looking for a report in SAP that would give me a list of all parts that are populated with a ba

pls clear my confusion
Hi friends,

Pls solve my query .

what is the exact use of Scope Resolution Operator( i

SAP Treasury - Commodities
We are running SAP ECC 6.0 with Treasury Activated.
EA-FIN is also activated (SFW5).

Need help with a mail notify function
I was tasked with setting up a site that's been prewritten. The site is basically a form that captur

Getting a variable to work in function params
I have this fuction which is inside a class:

Code: public static function generateEmbedCode($

xApp Analytics in BI 7.0
Dear all,

I am trying to implement xApp Analytics in BI 7.0. After I installed the analyt

Code clarification
Hi

In the following code what could be the "search_print()" and where it could be

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash