Fwd: Re: Fwd: [PEAR] Re: Exploits in PEAR? - best way to sanitize user input?

--- Matthew Weier O'Phinney <matthew@garden.org> wrote: > Date: 28 Oct 2004 12:04:06 -0000 > To: pear-general@lists.php.net > From: "Matthew Weier O'Phinney" <matthew@garden.org> > Subject: Re: Fwd: [PEAR] Re: Exploits in PEAR? - best way to > sanitize user input? > > * Stowe Spivey <spiveyspivey@yahoo.com>: > > --- Alan Knowles <alan@akbkhome.com> wrote: > > > Date: Thu, 28 Oct 2004 17:43:44 +0800 > > > From: Alan Knowles <alan@akbkhome.com> > > > To: Nola Stowe <NStowe@TheTTGroup.com> > > > CC: pear-general@lists.php.net > > > Subject: [PEAR] Re: Exploits in PEAR? > > > > > > Nola Stowe wrote: > > > > My *network admin* guy is suddenly against PEAR for reasons > he > > > > does not feel inclined to share with me. I guess reinventing > the > > > > wheel is more fun (hey, at least its job security, huh?) > > > > > > I do code auditing for a very large UK organisation - who use > PEAR > > > extensively partly because it is audited, in the usual open > source > > > way :) > > > > > > The only thing to audit for DataObjects is code using the > query() > > > and whereAdd() methods, look for variables used in as arguments > that > > > have not been sanitized - Generally, though these tools > seriously > > > reduce the scope of auditing necessary on a usual PHP > application. > > <snip> > > > What is the best way to sanitize user input? > > Assume all user input is tainted, and only accept it if it passes > necessary criteria. The Perl Way to do this is to filter through a > regular expression -- which can be easily done in PHP as well. > Basically, only accept what's absolutely needed. > > -- > Matthew Weier O'Phinney | > mailto:matthew@garden.org > Webmaster and IT Specialist | http://www.garden.org > National Gardening Association | > http://www.kidsgardening.com > 802-863-5251 x156 | > http://nationalgardenmonth.org > Matthew - thank you. I was also hoping for some actual examples like when to use escapeshellcommand, addslashes,... Thanks again. __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail