Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Mouseover to edit (Ajax)
hi friends, can anyone help with the code behind to get this application working, please in VB (new

Uploading files/images via forms
Hey all, I am building a database for work that will contain some minor data on plant species along

pageination not working right... coping images over 4 pages
Code: <?php //This code will obtain the required page number from the $_GET array. Note that

imap: how to save a copy of sent emails to sent elements
Hello my friends,

I am writing an online emailing application with inbox outbox/sent elements

Embedding flash object in Else statement
This is my first major project in PHP and I'm having some trouble embedding a flash object in an Els

How to change Time Zone
HI
I want to change the time zone of the server to another country.How can do that?

Thanks

Contents of variable not echoing
Hey guys, hopefully this is an easy one...

In this line, the variables are not echoing out. T

TimeStamp Column Problem...
I'm mad at my self and thinking I'm a little retarded. It just be some one mistake I'm missing here.

Replacing a string on click of a button
Hi! Is there a way to replace a string on a click of a text link?

This is what I've come up w

list files from folder, only one for each date
I have many files in a folder and wish to only list one of each date

these are the file names

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash