Re: Using DB: do I need to quoteSmart() AND strip_tags() all user input?

On Mon, 14 Mar 2005 16:07:26 -0800 (PST), l Burnerheimerton <lburnerheimerton@yahoo.com> wrote: > What I'm thinking of doing with strip_tags() makes > sense, right? Ive read about a vulnerability for > VIEWERS of what is posted rather than the database > itself. This is where the user posts some bad script > in the field and when it is displayed, it causes > something harmful to the person's browser who is > viewing it at that time. > > strip_tags() can delete all html tags before it goes > to database since it strips HTML and PHP tags. > > Ideas? Thoughts? Best practices? I already told you, the best practice is to run htmlentities on any output which was from the user. This way, all HTML / script / etc. will be shown exactly as it was entered instead of interpreted by the browser as extra markup or javascript. htmlentities makes all output perfectly safe for viewing in a browser. If you want to explicitly deny users the posting of any HTML or PHP code, by all means use strip_tags, but it's much more useful when you want people to be able to use a subset of HTML in their postings and want to pull out the bad bits. Here's an example. If I enter <grin> in your form, strip_tags will remove it even though I meant it as an emote, not HTML. In addition, using strip_tags makes it *impossible* to post HTML or PHP code. What if a someone wants to post HTML code for viewing? > --- Justin Patrin <papercrane@gmail.com> wrote: > > On Mon, 14 Mar 2005 13:07:05 -0800 (PST), l > > Burnerheimerton > > <lburnerheimerton@yahoo.com> wrote: > > > I am using DB, php 4.28, and MySQL 3.23. > > > > > > I want to ensure nothing gets into database that > > could > > > be harmful. > > > > > > quoteSmart() will correctly quote input and > > > strip_tags() will strip input of anything that > > might > > > be harmful to person who views database in dynamic > > > page. > > > > > > Do you guys use both to snatize user input? > > > > > > Best practices? > > > > > > > Best practice is to uoe quoteSmart on any DB values > > when putting them in SQL. > > > > For HTML, you can decide on your own, but if you > > don't want to allow > > HTML, but want people to be able to post HTML code > > (for viewing) use > > htmlentities() when *outputting* the content. > > -- Justin Patrin