Question about user input security

EagleOne

Hey everyone. I'm working on coding a set of forums from scratch, and I've done a lot of reading about various ways to keep user input safe for my database.

My questions is, though... what would you suggest if I wanted to allow certain HTML tags to be used while keeping all of the others disallowed and protecting against malicious MySQL injections?

Right now I'm using a combination of htmlspecialchars("$string", ENT_QUOTES) along with ereg_replace to allow specific tags. Is this generally going to keep me pretty safe from malicious users?

Thanks in advance for your help.

weekender

have a look at [man]strip_tags[/man] - it strips all html tags except the ones you specify

adam

Sayian

I agree , strip_tags is the way to go , and you use this by specifying the tags you want to allow

for example ..

if $post was the varible that contained the actual user post .. you would setup something like this.


$clean_post = strip_tags($post, '<b><center><img><u>'),

That would strip all HTML out of your post except bold , center , img tags , and underline.
$clean_post would be $post , but cleaned , if you will.

Weedpacket

But be warned that if you do allow certain tags like <b> through then there are still security risks, as noted on the manual page.

EagleOne

Thanks for the input. I'll take a look at those functions more closely.

mrhappiness

Originally posted by EagleOne
what would you suggest if I wanted to allow certain HTML tags to be used while keeping all of the others disallowed and protecting against malicious MySQL injections?

why not using the "quasi-standard" bbCode like almost all forums (including this one) do?

do htmlentities
do nl2br
replace [b] and [/b] with <b> and </b>