Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Required to login help
I'm trying to set up my site so users have to be logged into the forum to access the site.I've been

Output Full URL of Current Page
Let's say I am currently viewing a dynamic page:

http://www.mydomain.com/directory/index.php

How to disable direct access to a file
Suppose I've 2 Files. 1.php & 2.php

I don't want anybody to access 2.php directly fr

Read from forum
Haven't written anything forever and I would like to get back.
What I'm trying to do is getting t

Need a Timecode Class...
Not a Time Stamp, Time Code. Format is a bit different. HH:MM:SS:FF where FF is Frames. I dont re

Problem with umlauts and UTF-8
Hello every1,

I'm creating my own little CMS at the moment and got some problems with the cha

if statements problems
Hi. I'm trying to make a web form, but I kind of hit a dead end trying to figure out why it doesn't

PHP5/Zend 2.0 - Resources
PHP5 Snapshots
http://snaps.php.net/

ZEND 2.0 Feature Overview and Design (PDF File

please help me in this update statment
hi every one

if I have table and this data in it

id name
10

PHP SUBMIT
Code: <input name="doLogin" type="image" src="images/loginsubmit.jpg

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash