Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Revoking alter any table from a schema
Hi All,

i am working in Oracle 10g.
my requirement is to revoke all kind of DDL oper

'grab_files', multiple extension?
hey guys,

can anyone suggest a way to make to following line of code look for files with more

How to insert random unique values in 2 columns ?
I have table with 2 columns

Create Table code_for_code (
first_code varchar2(10) uni

Am i doing this wrong?
Im pulling from an Oracle database some info... one of which is a field count_pnums which is a NUMBE

Prevention Help
How can I use PHP or any other language (feel free to move this thread) to prevent users doing scree

Executing an exe
Hi. I have some bizarre problem with exec (other any other method) to launch exe's. I am making a ga

Automatic Webpage ??
I have a page www.mysite.com/test.php with a
<form>
<textarea name=&q

IP Based Cron Jobs
I run cronjobs on my website. After one of my visitors got curious and tinkered around he realized h

Is it possible to put an entire 500-page book in a database with PHP?
I am working on an intranet and I was wondering if its possible to code php with mysql to enter a fu

Mysql error message
help me find out what this error message means:

"Duplicate entry '0' for key 'PRIMARY'&q

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash