note 104252 added to security.database.sql-injection
| From: | shahroq at osu1 dot php dot net | Date: | Fri, 03 Jun 2011 15:42:37 +0000 |
| Subject: | note 104252 added to security.database.sql-injection | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-180223@lists.php.net to get a copy of this message | ||
this one is bendikt secure class with array support (in case you want to secure grouped check box)
<?php
class SecureInputs{
function secureSuperGlobalGET(&$value, $key)
{
if(is_array($_GET[$key])){
foreach ($_GET[$key] as $key2 => $value2){
$_GET[$key][$key2] = htmlspecialchars(stripslashes($_GET[$key][$key2]));
$_GET[$key][$key2] = str_ireplace("script", "blocked",
$_GET[$key][$key2]);
$_GET[$key][$key2] = mysql_escape_string($_GET[$key][$key2]);
}
}else{
$_GET[$key] = htmlspecialchars(stripslashes($_GET[$key]));
$_GET[$key] = str_ireplace("script", "blocked", $_GET[$key]);
$_GET[$key] = mysql_escape_string($_GET[$key]);
}
return $_GET[$key];
}
function secureSuperGlobalPOST(&$value, $key)
{
if(is_array($_POST[$key])){
foreach ($_POST[$key] as $key2 => $value2){
$_POST[$key][$key2] = htmlspecialchars(stripslashes($_POST[$key][$key2]));
$_POST[$key][$key2] = str_ireplace("script", "blocked",
$_POST[$key][$key2]);
$_POST[$key][$key2] = mysql_escape_string($_POST[$key][$key2]);
}
}else{
$_POST[$key] = htmlspecialchars(stripslashes($_POST[$key]));
$_POST[$key] = str_ireplace("script", "blocked", $_POST[$key]);
$_POST[$key] = mysql_escape_string($_POST[$key]);
}
return $_POST[$key];
}
function secureGlobals($echo_vars = false)
{
array_walk($_GET, array($this, 'secureSuperGlobalGET'));
array_walk($_POST, array($this, 'secureSuperGlobalPOST'));
}
}
?>
----
Server IP: 69.147.83.197
Probable Submitter: 94.182.117.117
----
Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php
Edit -- https://master.php.net/note/edit/104252
Del: integrated -- https://master.php.net/note/delete/104252/integrated
Del: useless -- https://master.php.net/note/delete/104252/useless
Del: bad code -- https://master.php.net/note/delete/104252/bad+code
Del: spam -- https://master.php.net/note/delete/104252/spam
Del: non-english -- https://master.php.net/note/delete/104252/non-english
Del: in docs -- https://master.php.net/note/delete/104252/in+docs
Del: other reasons-- https://master.php.net/note/delete/104252
Reject -- https://master.php.net/note/reject/104252
Search -- https://master.php.net/manage/user-notes.php