Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

PayPal Redirect Issue
When I have my paypal button set so that is redirects to http://empiremarketing.ca/order.php,it work

check how many commas the variable containing the query has between [i]select[/i
Hi...

iv made an sql table that contains id number - name of sql query and an sql query.
T

turning an array into a string then poping it into a db
Hi im just wondering how you get a requested array into a single string then pop it into the db so f

Scrolling news bar and MySQL
I am not sure if this is the correct forum to post this on. If not, I apologize. I am still pretty

mail with attachment problems
Hi. I have the following code:
Code: else if(file_exists("site".$timp.".zip")

max() problem
I have a while loop to get image names.
Code: $imagequery = mysql_query("SELECT * FROM ad_i

Querying info from one table based on info in another
Hi, I am currently trying to make a part for my user driven website where one user can subscribe to

finding key position of specified value in multi-dimensional array
Code: $openedfile = fopen($tfc_file4, "r");
$rc = 1;
while(!feof($openedfile))
{<

Table control is disappearing from Screen
Hi Experts,

I have a screen with multiple table control(TC). Each table control has two c

How do I know when getBounds Method is ready to be called.
I have an application that changes out stylesheets client side. Once I change stylesheet the browse

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash