Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Securing a user input - need some confirmation
Hello All,

I am in the process of recoding a large proportion of an e-commerce site, one of t

Production Order Enterprise Service to Manufacturing Exctn Sys (MES) ???
Hello Experts,

In our current landscape SAP ECC 5.0 is integrated to MES system via PI 7.

Internal class functions don't seem to get executed.
Hi. Can someone please put me out of my misery on this. I don't write much PHP and this has me baffl

Last Weeks sDate and eDate.
sDate - Start Date
eDate - End Date

I need to pull two dates for "Last Week" whi

C++ Http request?
Code: string Response = "LOGIN_UNSUCCESSFUL"; System.Net.WebRequest request = Sy

modifying query string with no page refresh
Hi everybody,
I've tried to get info about my problem all over the internet but i didn't find out

writing my own sobel filter convolution - something is wrong
I am trying to keep it very simple, I cant see anything wrong with my logic, could anybody help poin

My XSRF Prevention code isn't working
First of all, thanks for the generous help you guys have given me in the past on this forum.
Seco

retrieving policy name inside the function called by this particular policy
Hi there,

I've playing around with dbms_rls package, trying to set up some security repo

Google Wave
So... has anyone used it yet? Is it any good?

http://wave.google.com/help/wave/about.html#vid

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash