Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

convert PHP array to Javascript array
I have a page that gets a request sent from AJAX, and I am trying to convert a PHP array to a javasc

PHP Game
hy i was wondering what's the best method in order to make some automatic updates in a php game
<

Creating an invoice
Using fpdf I am trying to create an invoice to send to clients. The products are sold in pricing tie

What's wrong with my code
sobbing for many days, still don't know why please Help. Why my page isn't posted correctly. In a

Help If user voted, block them
On my Prayer request site, i let users Click a button to Pray for somone that has posted a pray, i g

BI in Upstream Production operations
Appreciate if you can assist in the following areas:
1) Examples of life before and after BI i

[function.file]: failed to open stream: No such file or directory
Okay I wrote this little script to upload a csv file that is located on my webhosts server to a mysq

help need on ob_start()
Hi

I am a newbie in php, I have a code
Line number On/Off | Expand/Contract <?phpo

Is it possible to stop reservation creation in PM Order?
Hi All,

Is it possible to stop reservation creation in PM Order?

Thanks in adv

Entering Data Problem
Code: $result = mysql_query("SELECT * FROM flights");
while ($row = mysql_fetch_array($

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash