Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

phpMailer will not connect using SMTP
I am trying to use phpMailer with smtp:

Code: [Select]$mailer = new PHPMailer();
$mailer-&

user validation always displaying invalid ? please help
Hello,

I have 2 accounts and there is a field in mysql called validated it can be either &quo

PHP Game
hy i was wondering what's the best method in order to make some automatic updates in a php game
<

simplexml and xpath - Need some help
Hello,

I am trying to parse an xml which comes back from Amazon and I am trying to know how m

Remove values in array2 from array1
I have two arrays.

Array 1 is where the array key holds various different numbers. For exampl

How to set pass login name from htaccess to php
When the user logs into my members page via htaccess, I'd like to retain the username so that I can

Error Messaging not working
I changed the way my form tells the user of an error. But I can't seem to get it to work properly.

Something like an INI editor or a DelimitedText-Editor
Hi all,

Am very, very, very new to PHP and not sure if I should be posting this to a Javascri

Google Map
I have done Google Map Integration for one my project. But for that we need the "latitude and l

Data Function is Its Not working IN IE8
This is my first time to use formums. I hope i can get solution for this problem. view plaincopy to

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash