Sufficient protection from bad input?


Posted on 16th Feb 2014 07:03 pm by admin

I am writing a simple script to let people upload 'pages' of their own content, be it simply a few bits of HTML, pictures and whatnot, and recieve their own url.. I've without testing, wrote this part of the script to clean the input, are there major security risks?

function cleanInput($input) {
$search = array(
Did you know?Explore Trending and Topic pages for more stories like this.
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
//Define date for entry
$date = date("Y-m-d");

//clean input
$_title = sanitize(cleaninput($_POST['title']));
$_uid = sanitize(cleaninput($_POST['uid']));
$_desc = sanitize(cleaninput($_POST['desc']));
$_content = sanitize(cleaninput($_POST['content']));

// Insert a row of information into the table with function
function insert($title, $uid, $desc, $date, $content) {
mysql_query("INSERT INTO pageit
(title, userid, `desc`, dateadded, content) VALUES('"._$title."','".$_uid."','".$_desc."','".$date."','".$_content."') ")
or die(mysql_error());
}
// Do the insert with the cleaned data!
insert($_title, $_uid, $_desc, $date, $_content);
//Done script stuff for now..

No comments posted yet

Your Answer:

Login to answer
130 Like 37 Dislike
Previous forums Next forums
Other forums

Problem with the Update command used with a sqldataadapter
I'm connected to a database on an SQL Server and I'm using a sqldataadapter, sqlconnection, sqldatas

PHP and MySQL Question/Help
I have a MySQL db with all my servers and all their details like server name, IP, OS, RAM etc etc 26

Inserting a variable in a link
I have this code that I want to insert for my own variable but I have no idea how. This is what I wa

Procedural to OOP
John Kleijn said that to avoid writing "crappy code", we should learn OOP and common OO pr

SAP Treasury - Commodities
We are running SAP ECC 6.0 with Treasury Activated.
EA-FIN is also activated (SFW5).

Help with ORDER BY
Hello. I would like to order by ascending States, then Cities, then Gyms in the following code, but

To change the name of label on SAP screen XK02.
Hi All,

Can one suggest me how to change the label of an input field of a sap standard s

I need desperate help with this php code integrated with flash please
Can someone please help me with this php code which I have been stuck on for weeks . I am trying to

newbie question about multiple queries
hi everyone,
I'm sorry to ask such a basic question, but I'm young and trying to learn php on my

Deleting Partners on the Customer Master.
Does SAP handle removing the Partner from Open Sales Orders when a Partner is deleted in the Custome

Sign up to write
Sign up now if you have flare of writing..
Login   |   Register
Follow Us
Indyaspeak @ Facebook Indyaspeak @ Twitter Indyaspeak @ Pinterest RSS



Play Free Quiz and Win Cash