Re: Fwd: [PEAR] Re: Exploits in PEAR? - best way to sanitize user input?

* Stowe Spivey <spiveyspivey@yahoo.com>: > --- Alan Knowles <alan@akbkhome.com> wrote: > > Date: Thu, 28 Oct 2004 17:43:44 +0800 > > From: Alan Knowles <alan@akbkhome.com> > > To: Nola Stowe <NStowe@TheTTGroup.com> > > CC: pear-general@lists.php.net > > Subject: [PEAR] Re: Exploits in PEAR? > > > > Nola Stowe wrote: > > > My *network admin* guy is suddenly against PEAR for reasons he > > > does not feel inclined to share with me. I guess reinventing the > > > wheel is more fun (hey, at least its job security, huh?) > > > > I do code auditing for a very large UK organisation - who use PEAR > > extensively partly because it is audited, in the usual open source > > way :) > > > > The only thing to audit for DataObjects is code using the query() > > and whereAdd() methods, look for variables used in as arguments that > > have not been sanitized - Generally, though these tools seriously > > reduce the scope of auditing necessary on a usual PHP application. <snip> > What is the best way to sanitize user input? Assume all user input is tainted, and only accept it if it passes necessary criteria. The Perl Way to do this is to filter through a regular expression -- which can be easily done in PHP as well. Basically, only accept what's absolutely needed. -- Matthew Weier O'Phinney | mailto:matthew@garden.org Webmaster and IT Specialist | http://www.garden.org National Gardening Association | http://www.kidsgardening.com 802-863-5251 x156 | http://nationalgardenmonth.org