Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

ALV sum various columns problem
Hi all,
I'm doing a report on ABAP for a timesheet of the current month. The output i want is s

Change of partner analyse in sales orders
Hello,

I changed the partner analyse for sales orders and added a new mandatory partnerro

mysql select with $_get ?
Hi, i have this code:
Code: // If char id is 0 and character dont exist do:
if ($_GET["id

problem with php server update from mid 2009
Hi,

I have this navigation menu on 2 websites which used to work just fine. After a recent up

Count of reciepients in php mailer
How can i sent a mail to large no of reciepients say 10,00,00 Using PHP MAILER

Output Buffering question
Hi all,

I've been trying to wrap my head around output buffering. So far I've found tons of

Nested (echoed) php running wrong script
Got a problem with a php website I'm creating.

In a nutshell, the first page is entirely html

Save User Inputs while javascript reloading!
hi..
i have written a PHP code in which i reload the page when user selects a value in dropdown..

Checkbox info wont include in Mailto
Hey, im new to php.
Basically I have made a form to request which type of job(s) are needed, whic

PHP Code / Script To check weather the given email exists in a domain
Hi,

I want to implement the following in my web page

in sign up we will ask to enter u

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash