Re: Search Sanitization
| From: | Greg Donald | Date: | Wed, 16 Jun 2004 16:06:28 +0000 |
| Subject: | Re: Search Sanitization | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-188406@lists.php.net to get a copy of this message | ||
On Wed, 16 Jun 2004 10:34:21 -0400, Gabe <ydnahg-news4432@mailblocks.com> wrote:
>
> I'm writing a *very* simple search form for my db and was interested in
> hearing some recommendations on what to check for with the user's input
> for the search.
>
> However, I guess more specifically my question is if anyone had any
> advice as to other things I should check since it's a search form.
> Obviously there's a lot more valid entries that a user can make than a
> normal form where you might know more specifically what they should
> enter and thus your validation can be more stringent.
Well, for starters you should definately check and prevent SQL
injection. I use this in all my scripts:
set_magic_quotes_runtime(0);
if(get_magic_quotes_gpc() == 0){
$_GET = isset($_GET) ? array_map("slashes", $_GET) : array();
$_POST = isset($_POST) ? array_map("slashes", $_POST) : array();
$_COOKIE = isset($_COOKIE) ? array_map("slashes", $_COOKIE) : array();
}
function slashes($var){
if(is_array($var))
return array_map("slashes", $var);
else
return addslashes($var);
}
--
Greg Donald
http://destiney.com/