Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

How to display value in drop down list after form has been reloaded
Please bear with me as I am very new to php and html.

I have a form with several drop down me

Sending CC Info by email
I am a little bit less knowledgable in the security area as most developers and I know I have a lot

Multipe Dynamic Controls & AutoPostback Issue
I currently have a need to create many dynamic controls (Example Textboxes) that need to do a PostBa

Ignore html and bbcode?
I've created a function to limit the amount of text according to the amount of words.

However

Attempt to assign property of non-object in...
I'm having issues with the following function in PHP 5...

function getTreeWithChildre

Alternate messaging
I have 4 strings in MySQL db1

$string1 : Hello
$string2 : Hi
$string3 : Great
$strin

insert mysql embeded videos as blobs?
Using TinyMCE my client will be able to embed images and flash videos into large columns of text whi

To change the name of label on SAP screen XK02.
Hi All,

Can one suggest me how to change the label of an input field of a sap standard s

DATEDIFF Question
First time post, and of course it is a help question.

I am using a WP plug-in to display prev

Making multiple rows with one query
I have a table called efed_handler_characters with two fields handler_id and bio_id. What query 2 is

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash