Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

login from external site
Hi my new experience begins, Now what i am trying to do is i make three pages, login.php logout.php

User information
Hi All,
By using t-code SUIM we get all the user details,if suppose we donot have permission t

ORA-00932: inconsistent datatypes: expected - got CLOB
SO : windows xp
database : XE

there is a table (transito) with two fields of clob

simplexml_load_file and rss problem
Hi,

I have a problem parsing an rss feed using simplexml_load_file - this is strange as i hav

Cursor statement failed with errors
Following statement failed with the errors.

cursor proj_cursor1 is (select projectID from

PHP mail() with images
I'm trying to get images to send along with my HTML e-mail sent through PHP mail(). I only tried vie

Help on code output
My CODE:

Code: [Select] echo "<phone>".$line["phone"].&qu

Warning: session_start() [function.session-start]: Cann.....
hi, can someone help me with this? I keep getting this error....

Warning: session_start() [fu

While Problem
i am having a problem with a while statement here is the code
Code: [Select]<?php
sess

help connecting a form to php and then emailing the form
Ok. So, I made a form, and I need help to where when submitted, I get an email with the submitted de

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash