note 85301 added to security.variables
| From: | ffmandu13 at hotmail dot com | Date: | Sun, 24 Aug 2008 18:29:40 +0000 |
| Subject: | note 85301 added to security.variables | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-143795@lists.php.net to get a copy of this message | ||
Hi,
Just one little class I made to control user's submitted datas, I thought it could help some
people with security.
And if anyone wants to improve it, I'd be glad you do so.
<?php
/**
* This program is under GNU GPL license.
*
* You can contact the author of this program at <ffmandu13@hotmail.com/>.
*/
//Defined regexps (you can add your own ones).
define('REG_DATE' ,
'([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})');
define('REG_DIGIT_SIGNED' , '^[-[:digit:]]+$');
define('REG_DIGIT_UNSIGNED', '^[[:digit:]]+$');
define('REG_PASSWORD' , '^[[:alnum:]]+$');
define('REG_TEXT' , '[[:graph:][:blank:]]+');
define('REG_WORD' , '^[[:alpha:]]+$');
//Controls contents of the $_REQUEST variable.
final class checkVar{
private $tmp; //Secured value of a $_REQUEST key.
//Check if the variable is set.
private function isSet(&$field){
if(!isset($_REQUEST[$field]))
throw new Exception("You forgot to fill the $field field.");
else
return true;
}
//Set $tmp and remove threatening characters.
private function removeCharsThreats(&$field){
$this->tmp = trim($_REQUEST[$field]);
$this->tmp = htmlspecialchars($_REQUEST[$field], ENT_QUOTES, 'UTF-8', false);
}
//Checks if the value is equal to 1.
public function securityBool($field){
if($this->isSet($field) && $_REQUEST[$field] != 1)
throw new Exception("Unallowed value in $field field.");
else
return true;
}
//Checks if the value is in the allowed ones list ($enum).
public function securityEnum($field, $enum){
if($this->isSet($field)){
$this->removeCharsThreats($field);
$tab = explode(',', $enum);
if(!in_array($this->tmp, $tab))
throw new Exception("Unallowed value in $field field.");
else
return (string) $this->tmp;
}
}
//Checks if the value is a numeric one and if it is in the given range.
public function securityRange($field, $range){
if($this->isSet($field)){
$this->removeCharsThreats($field);
$tab = explode('/', $range);
if(!is_numeric($this->tmp))
throw new Exception("Unallowed characters in $field field.");
elseif($this->tmp < $tab[0] || $this->tmp > $tab[1])
throw new Exception('Value must be in range '.$tab[0].'/'.$tab[1]."
in $field field.");
else
return (int) $this->tmp;
}
}
/**
* Checks if the value respects the defined regexp,
* and if its length is not superior than the given maxlength.
*/
public function securityText($field, $maxlength, $regexp){
if($this->isSet($field)){
$this->removeCharsThreats($field);
if(!mb_ereg($regexp, $this->tmp))
throw new Exception("Unallowed characters in $field field.");
elseif(mb_strlen($this->tmp, ENCODING) > $maxlength)
throw new Exception("Too long string length for $field field.");
else
return $this->tmp;
}
}
}
?>
Here are some examples of how to use the public methods.
<?php
$checkVar = new checkVar();
$args = array();
//If $_REQUEST['bbexport'] is not equal to 1, throws a new Exception.
$args['bbexport'] = $checkVar->securityBool('bbexport');
//If $_REQUEST['id'] is not an unsigned integer and/or has more than 4 digits, throws a
new Exception.
$args['id'] = (int) $checkVar->securityText('id', 4,
REG_DIGIT_UNSIGNED);
//If $_REQUEST['orderBy'] is not equal to 'date' or 'id' or
'name', throws a new Exception.
$args['orderBy'] = $checkVar->securityEnum('orderBy',
'date,id,name');
//If $_REQUEST['ratio'] is not a numeric value (integer or float) and is not between 0 and
10, throws a new Exception.
$args['ratio'] = $checkVar->securityRange('ratio', '0/10');
?>
----
Server IP: 69.147.83.197
Probable Submitter: 83.203.117.230
----
Manual Page -- http://www.php.net/manual/en/security.variables.php
Edit -- https://master.php.net/note/edit/85301
Del: integrated -- https://master.php.net/note/delete/85301/integrated
Del: useless -- https://master.php.net/note/delete/85301/useless
Del: bad code -- https://master.php.net/note/delete/85301/bad+code
Del: spam -- https://master.php.net/note/delete/85301/spam
Del: non-english -- https://master.php.net/note/delete/85301/non-english
Del: in docs -- https://master.php.net/note/delete/85301/in+docs
Del: other reasons-- https://master.php.net/note/delete/85301
Reject -- https://master.php.net/note/reject/85301
Search -- https://master.php.net/manage/user-notes.php