Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Save file by click
Hello.
I'm not understand how to save file from page. I'd like make link to file with save abil

constructor ?
i have written this program and made 3 constructors in the class and i want to call them in the main

Different payment methods with different cross company requirements in F110
We are implementing SAP in a company in the shipping industry. They have the following requirement:<

background color imagefill
Hello

I would like to ask you why I see this square in red color just in my local xampp insta

Uploading/Downloading files stored in MySQL database
Hey all,

This problem just came up in my website and I'm having a hard time figuring out what

Simple program to copy files between two computers over the web
I use logmein free and often need to move files between my two computers. Generally, I move the file

I need an iframe that calls up a different page according to the date
hi

I don't know any php (only html) and I urgently need to do the following:

I need a

Multi-user card game
I'm writing a batch of games and such. Lottery is finished, Poker,blackjack,etc are next. They will

problem with php server update from mid 2009
Hi,

I have this navigation menu on 2 websites which used to work just fine. After a recent up

How to display objects in a row
I have 7 codes that i want to display in a row one next to another.
The first is {$ads->ad

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash