Should I check imput for bad chars in this case?
| From: | mirrys.net | Date: | Thu, 26 Apr 2012 12:15:39 +0000 |
| Subject: | Should I check imput for bad chars in this case? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-317694@lists.php.net to get a copy of this message | ||
Hi all,
this is more question than real problem (I hope :)). I include this
script into my pages to log IPs of visitors (they are saved info txt
file and send to e-mail later):
function getIPadress()
{
if (isset($_SERVER["HTTP_CLIENT_IP"]))
{
return $_SERVER["HTTP_CLIENT_IP"];
}
elseif (isset($_SERVER["HTTP_X_FORWARDED_FOR"]))
{
return $_SERVER["HTTP_X_FORWARDED_FOR"];
}
elseif (isset($_SERVER["HTTP_X_FORWARDED"]))
{
return $_SERVER["HTTP_X_FORWARDED"];
}
elseif (isset($_SERVER["HTTP_FORWARDED_FOR"]))
{
return $_SERVER["HTTP_FORWARDED_FOR"];
}
elseif (isset($_SERVER["HTTP_FORWARDED"]))
{
return $_SERVER["HTTP_FORWARDED"];
}
else
{
return $_SERVER["REMOTE_ADDR"];
}
}
// save log to txt
$fh = fopen($fileWithLog, 'a+') or die("Oups " . $fileWithLog ." !");
$IPAdress = getIPadress();
fwrite($fh, date('j.n.Y G:i:s') . $IPAdress . " (" .
gethostbyaddr($IPAdress) . ")\n");
fclose($fh);
...can this be some possible security risk (XSS or so..), becose I
does not check chars in IP adress and host name mainly. It is probably
crazy, but on the other side I think it isn't imposibble to use some
bad strings in host name.
Would you recommend use "$IPAdress = htmlspecialchars(getIPadress());"
or something like? Or is it nonsense?
Thx and excuse me, if this question is too stupid :(. Br, Mir R.