Comments on: How to filter user submitted data easily in PHP?

By: Jacob Poore

Jacob Poore — Sun, 28 Feb 2010 17:15:42 +0000

learn something new everyday. very cool

By: sell music beats

sell music beats — Wed, 16 Dec 2009 00:35:38 +0000

This is good to know, i’m always scared of people using certain characters in textfields to hack into my database, will be sure to filter everything carefully.

By: mello

mello — Sat, 10 Oct 2009 16:15:47 +0000

I have a php site http://www.phloentertainment.com i might try this cool

By: beats

beats — Sat, 07 Feb 2009 03:10:53 +0000

Learned something new with that array_map() function. I googled it and found other great examples. Thanks for the post, just what I was looking for.

By: [??] Aug 23th 2008 - My Habari

[??] Aug 23th 2008 - My Habari — Thu, 29 Jan 2009 04:29:33 +0000

[...] need for set/get methods in PythonjQuery JSON with PHP json_encode and json_decodeHow to filter user submitted data easily in PHP?twittex.com Launches!???? twittex.com ??? 6 ?????, ??? symfony, PHP, [...]

By: jay

jay — Tue, 02 Dec 2008 05:15:13 +0000

In your example you have written a general function so that when a variable is required to be validated. you just call that function.

function filter_data($val)
{
return htmlentities($val,ENT_QUOTES);
}

What if you want to replace that htmlentities with filter_input ( ) can the input type parameter for this be POST?

By: [??] Aug 23th 2008 « Oceanic | ????

[??] Aug 23th 2008 « Oceanic | ???? — Sat, 23 Aug 2008 09:42:26 +0000

[...] How to filter user submitted data easily in PHP? [...]

By: How to filter user submitted data easily in PHP? | coderchris.com

How to filter user submitted data easily in PHP? | coderchris.com — Mon, 18 Aug 2008 06:29:21 +0000

[...] How to filter user submitted data easily in PHP? [...]

By: Roshan

Roshan — Sun, 17 Aug 2008 05:16:29 +0000

@john – Thanks for your explanation
@Pierre – I can see still in some of of the web hosting company are using PHP4 and PHP 5.1.x , I’m just worried for them only otherwise I’m not against PHP’s filter extension, I also recomment this if you’re using PHP 5>5.2.0.

By: Pierre

Pierre — Sat, 16 Aug 2008 21:59:57 +0000

PHP4 is dead, php 5.1.x has critical security issues, what is the reason to do not use php 5.2.x?

By: John J.

John J. — Fri, 15 Aug 2008 21:05:57 +0000

I couldn’t echo Mojah’s comment more strongly. The best practice when it comes to user input is to validate input (make sure it is the type/size you expect) and filter/encode/etc. output. You do the later ONLY when it is being output because you never know what the data will be used for between when it is input and when the script ends.

As for the filter extension, I recommend this as well. It is available as a pecl extension for those of you still stuck on PHP 5 < 5.2 (if you are using PHP 4.x, WHY?!). You can use it to force a base level of security on all inputs and to get any user data you need to use the filter_input function.

By: Roshan

Roshan — Fri, 15 Aug 2008 16:50:43 +0000

@gerard – Thanks for the link of inspekt it seems to be a nice tool..will check it later in free time
@Pierre – Thanks but you must have PHP greater than 5.2.0 and not useful for people who are using lower version of PHP.

By: Pierre

Pierre — Fri, 15 Aug 2008 15:43:23 +0000

Ever heard of http://www.php.net/filter ?

By: gerard

gerard — Fri, 15 Aug 2008 15:40:50 +0000

Have you checked out Inspekt (http://inspekt.org)? It wraps a “cage” around your input data and can make input filtering transparently easy.

By: Ian

Ian — Thu, 14 Aug 2008 18:01:18 +0000

@Roshan

Noooo! Don’t encourage people to use extract() on $_POST or any other user input superglobal for that matter! That’s precisely the problem with register_globals.

If you extract() all of the variables in an input array, you open up the very real possibility that an internal variable that you didn’t intend for users to interact with can now be initialized with anything the user wants.

They could for example, post a variable called content and fill it with javascript. If you happen to use a variable $called content in your code and don’t initialize it with an empty string before concatenating to it, that javascript may be passed back out to the page when you echo $content.