Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

getAlexaRank($url) function not working
I have made a function to get alexa rank
the site is here: http://mytestsite.rack111.com/1

help with image text
Hi ...

see i need the text of the name and number to start in the center and always be in the

Mail functionality from localhost to server
Hi

I am facing problem of mail functionality.

When i tested mail functionality in my

Passing vars to the DB
I have 3 small testing tables:

ID TYPE
1 pepperoni
2 C. bacon
3 taco

ID TY

Need help with cin setw
I made a program here is my code:

#include
#include
#i

Limiting uploaded file type
I am working on a simple upload script, and I need it to limit the allowed file type that is uploade

Change log of Cost centre change in Plant maintenance order
Hi,
How to view Change log of Cost centre in Plant maintenance order. Not visible thru 'Docume

trouble printing an array....
I'm having some trouble printing out an array forwards. I'm figuring out the high and low of an arra

Simple Variable Question
Hi everyone.... again,

I am really getting into php still. Learning more every day. I love it

Creating a custom API
I'm creating a site, and I need to create a basic API. Unfortunately I have no idea where to start.

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash