Secure user submitted queries?

Sled · 10-29-2007, 11:42 AM

Hello,

I'd like to know what needs to be done to secure user submitted queries.
Is using mysql_real_escape_string for each $_POST and $_GET var enough?
Or should I do more?

Thanks!

CMellor · 10-29-2007, 07:21 PM

PHP Code:


			
function clean($str) {
return htmlspecialchars(mysql_real_escape_string(stripslashes($str)));
}

Execute:

PHP Code:


			
clean($_POST['var']);

Sled · 10-29-2007, 11:58 PM

Ok, thanks, and once I want to get it from the database, any functions I need to use so it shows up properly?

Thanks!

Dorza · 10-30-2007, 12:16 AM

This is what I use my self...

PHP Code:


			

//I send pretty much everything through the following when entering data into the database:
function safeAll($string) 
{
  $string = trim($string);
  $string = mysql_real_escape_string($string);
  $string = htmlentities($string, ENT_QUOTES);
  return $string;
}

//Coming out of the database I run appropriate data through this:

function convertHtml($string) 
{
   return html_entity_decode($string, ENT_QUOTES);
}


//Clean input:
safeAll($_POST/GET['text_to_db']);

//Convert output:
convertHtml($output['output_txt_from_db_query']);

If there is anything wrong with this or if there can be any additions to the functions then please let me/others know about it.:)

Also if your expecting a number to be submitted either via POST or GET then I personally do the following:

PHP Code:


			
if(!ctype_digit($_GET[id]))  
{
  //Above: if you did:  if(!(int)$_GET[id]) then something such as 5k55  or 5.5 would get through
  //ctype_digit will ONLY accept whole numbers.
  echo "A nice error message";
}
else
{
   carry on doing what it is you want to do.
}

For me securing and validating user input is what takes most of the time when scripting with PHP. It can be quite involved, but if done correctly (hope mine are ok) you should have pretty secure scripts/systems.

Sled · 10-30-2007, 01:02 AM

I've been using is_numeric for the second job.
Both functions suggested look simular, I guess they'll be secure :)