Security advise

[Anon]

Hi all
Is it neccesary to use somthing like strip_tags() on all user input to stop amlicious code being entered or is there
a. An easier way
b. A widely used method or set of do's/dont's to follow?

Cheers

Nick

[[deleted]]

One way would be to use htmlspecialchars().
That will convert '<' and '>' to their html entities,
which stops the browser from interpreting it as html tags.
Instead, it just shows up as html source.

[Anon]

Another way you'll probably want is to use the string replace function (forgot it's name, but it's the one that doesn't use regex), or the ereg_replace/preg_replace.

I take user input and stuff it into a database, or query the db for that data, but I know ahead of time that certain fields are numbers only and other fields are text/number only.

So by using:

$string = "13,A340Z{(NOW)34vr";

echo $string . "<br>";

$replace = array ("/,/", "/\D/i");

$string = preg_replace($replace, "", $string);

echo $string . "<br>";

$string becomes "1334034". By playing with a little regex you can do all the data validation you need.

I use it on every piece of user inputted data, along with strlen(), if for no other reason than to ensure a user can be as sloppy or dopey as possible while still allowing the program to work for them.