note 53121 deleted from reserved.variables by felipe

Note Submitter: webKami (et) AKDomains.com ---- PHP Secure Class to prevent XSS Attacks Although this is not bullet proof but it would give you an idea on how to filter incoming data. Copyleft : LGPL Idea by: phpsec GROUP @ PHP|arch Coded By: webKami For those who are new to PHP and just heard of XSS attacks, this is the basic rule. "NEVER EVER TRUST EXTERNAL DATA" For this purpose I have coded a class that can be used to filter all external data, from POST, GET, COOKIE and even your own arrays. An example is that if you need only integers from a certain parameter just request for integer e.g. getVarInt("id") You can even tell it to give you a default value if param is not set, so that your page would not FAIL in case of a NULL value e.g. getVarInt("id",1) You can also fetch data from a param array, like a set of colors e.g. getVarInt("colors",0,0) e.g. getVarInt("colors",0,1) Get these variables in a loop limited by the count of that array's elements e.g. getVarCount("colors") The complete code of class and its usage can be found here http://www.webkami.com/programming/php/php-secure-class-to-avoid-xss I am posting the usage below. <? //for url variables $req = new requestGet(); echo "Int:".$req->getVarInt("id")."<br />"; echo "Alpha:".$req->getVarAlpha("name",4)."<br />"; //for form variables $req = new requestPost(); echo "Int:".$req->getVarInt("id")."<br />"; echo "Alpha:".$req->getVarAlpha("name",4)."<br />"; //for cookies $req = new requestCookie(); echo "Int:".$req->getVarInt("id")."<br />"; echo "Alpha:".$req->getVarAlpha("name",4)."<br />"; //for your own variables, set your values to an item in an array and you can modify the array $filter["id"]=4; $filter["name"]="Ali"; $req = new requestFilter($filter); echo "Int:".$req->getVarInt("id")."<br />"; echo "Alpha:".$req->getVarAlpha("name",4)."<br />"; ?>