Fwd: [PEAR] Re: Exploits in PEAR? - best way to sanitize user input?

--- Alan Knowles <alan@akbkhome.com> wrote: > Date: Thu, 28 Oct 2004 17:43:44 +0800 > From: Alan Knowles <alan@akbkhome.com> > To: Nola Stowe <NStowe@TheTTGroup.com> > CC: pear-general@lists.php.net > Subject: [PEAR] Re: Exploits in PEAR? > > Nola Stowe wrote: > > My *network admin* guy is suddenly against PEAR for reasons he > does not feel > > inclined to share with me. I guess reinventing the wheel is more > fun (hey, > > at least its job security, huh?) > > I do code auditing for a very large UK organisation - who use PEAR > extensively partly because it is audited, in the usual open source > way :) > > The only thing to audit for DataObjects is code using the query() > and > whereAdd() methods, look for variables used in as arguments that > have > not been sanitized - Generally, though these tools seriously reduce > the > scope of auditing necessary on a usual PHP application. > > If they are that way inclined, ask him who audit's his network > scripts > (and see if they can audit the work you provide :) > > Regards > Alan > > What is the best way to sanitize user input? Many thanks! __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail