PHP - Sanitize Input

Folks this one line and any other variations I have tried just nulls my variable

Code: [Select]
function check_input($value)
{
echo '<pre>';
echo "Value before = ";
echo $value;
echo '</pre>';
// Stripslashes
//if (get_magic_quotes_gpc())
//   {
//   $value = stripslashes($value);
//   }
// Quote if not a number
//if (!is_numeric($value))
//   {
   $value = "'" . mysql_real_escape_string($value) . "'";   <-----
//$value = mysql_real_escape_string($value);
//$value = mysql_real_escape_string($value);
echo '<pre>';
echo "Value after = ";
echo $value;
echo '</pre>';
//   }
return $value;
 }

...
// Make a safe SQL
 $iso_code = check_input($iso_code);
 $country_name = check_input($country_name);
      $query = "select * from countries where
            iso_code = '".$iso_code."' or country like '%".$country_name."%'";
      mysql_query($query);
 echo '<pre>';
 echo $iso_code;
 echo $country_name;
 echo $query;
 echo '</pre>';
The result is:-

Code: [Select]
Value before = UK
Value after = ''
Value before = United Kingdom
Value after = ''
''''select * from countries where
            iso_code = '''' or country like '%''%'

with no mysql_real_escape statement the app work fine. I'm now trying to make my code more robust.

Any help would be appreciated.

jamie

Hi everyone

I am trying to secure some of my code using a sanitize function

function sanitize($data)
{
$cdata = strip_tags(addslashes($data));
$cdata = mysql_real_escape_string($cdata);
return $cdata;
}

If I post a form value such as

Code: [Select]
'Apple iPod'
to a SQL INSERT QUERY using

`title` = sanitize($_POST['title']);

then my database value looks like

Code: [Select]
\\\'the ipod\\\'
this is odd because there is 3 slashes

if I then print that value on a PHP page using

print stripslashes($row['title']);

it outputs

Code: [Select]
\'the ipod\'
Why can I not get rid of the slashes and why would it be outputting 3 slashes?

I have tried all the magic quote ideas and suggestions, but still cannot sort this out.

Thanks

John

Hey all,

While the filter itself is functioning properly, the flag doesn't seem to be.

Here's how I have it set up:

Code: [Select]

$UserInput = filter_var($UserInput , FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW); // Test Format 1

$UserInput  = filter_input(INPUT_POST, 'UserInput', FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);  // Test Format 2

As you can see, I have set up to test methods however, each one fails regarding the flag..or so it's seeming to me.

FILTER_FLAG_STRIP_LOW is supposed to strip out anything > 32 in ascii, but it isn't. '&' (38) is greater than 32 but it still displays in the browser.

Am I missing something here?

This topic has been moved to Third Party PHP Scripts.

http://www.phpfreaks.com/forums/index.php?topic=346794.0

I have never looked into sanitizing before, Is using htmlentities() good enough to protect against sql injection ?

Thanks.

Hey Guys!
I would really like some feedback on the following:

I have a site in Portuguese. Php retrieves a lot of POST's with Special Characters and Portuguese Accents (which are expected).
With my sanatize function I am having some real problems with the 'htmlentities' for XSS Injection Prevention.
htmlentities is changing the accents to strange characters and messes up my database.

sanitize( &$_GET );
sanitize( &$_POST );
sanitize( &$_COOKIE );

function sanitize( &$some) 
{
$some = array_map('htmlentities', $some); //XSS Prevention

foreach( $some as $key => $value ) 
{
$value = str_replace( '--', '', $value );
$value = str_replace( '/*', '', $value );
$value = str_replace( '"', '', $value );
$value = str_replace( "'", '', $value );
$value = ereg_replace( '[\( ]+0x', '', $value );
if ($value != $some[$key]) 
{
$some[$key] = $value;
}
}
}

The only solution I can think of is to take out the 'htmlentities' function, but I would really like to have this as a prevention against XSS, is there any way around this to have both things working?

Any ideas, suggestions?

Thanks in advance!

I hope I can explain what is happening.  I have created two forms in PHP.  The first 'almost' works, i.e. it shows the data.  But I have two problems - 1) the second pulldown menu is always empty and 2) $value from the first pulldown menu ALWAYS equals the last entry thus the last 'if' in the function subdomains ($domains) is always called (but still empty).  The code may explain this better than me:

<!DOCTYPE html>
<html>
<body>
   <!-- processDomains.php is this file - it calls itself (for testing purposes so I can see what is happening) -->
   <form action="processDomains.php" method="post">
   <?php
       // create the domains array (there are actually several entries in the array but I cut it down for testing)
       $domains = array (1 => 'Decommission', 'Migration');
    
       echo "Select Domain:";
       echo "<br>";
    
       // Make the domain pull-down menu - this displays correctly
       echo '<select name="domain">';
       foreach ($domains as $key => $value) {
          echo "<option value=\"$key\">$value</option>\n";
       }
       echo '</select>';

       // input doesn't matter what is 'submitted', always goes to last $value
       echo '<input type="submit" name="submit" value="Submit">';

       // call function subdomains
       subdomains ($value);
    
       function subdomains ($domains) {
           // define values for each array - each array contains available choices for the subdomain pulldown menu
           $migration = array (1 => 'Application Migration', 'Application Patch', 'Application Upgrade');
           $decommission = array (1 => 'Applications', 'Servers', 'Storage');
    
           if ($domains === 'Migration') {
              echo "Select subdomain:";
              echo "<br>";
              // Make the Migration pull-down menu
              echo '<select name="migration">';
              foreach ($migration as $key => $value) {
                  echo "<option value=\"$key\">$value</option>\n";
              }
              echo '</select>';
           } else if ($domains === 'Decommission') {

              /* ===
               * since 'Decommission' is the last entry in the 'Domains' pulldown list, $value ALWAYS equals
               * 'Decommission' and $domains equals $value. So this menu SHOULD work but is always
               * empty.  Thus, two problems - the pulldown menu is always empty and $value isn't based
               * upon user input.
              */
              echo "Select subdomain:";  // this prints so I know I'm in 'Decommission (I eliminated the echo "$domain" to show I'm always coming here)'
              echo "<br>";
              // Make the 'Decommission' pull-down menu
              echo '<select name="decommission">';
              foreach ($decommission as $key => $value) {
                  echo "<option value=\"$key\">$value</option>\n";
              }
              echo '</select>';
              echo '<input type="submit" name="submit" value="Submit">'
           ) // end of 'if-else'
    } // end of function 'subdomain'
     
?>
</form>
</body>
</html>

Let me say thank you in advance and I appreciate the help!  I know I'm doing something (or more than one thing) wrong and I hope someone can tell me what it is.    Best Regards!
Edited by mac_gyver, 19 January 2015 - 09:37 PM.
code tags around posted code please

I am writing a script that will parse my PHP classes and check for things like coupling, visualize my objects and connections, dependencies, check for convention usage, etc.   So, I have a simple file upload.  I'm never saving the files, just get contents and dump the file and work with the string version.   I'm writing it for me, but I figure I might want to open it for others to use in the future, so I may as well write it that way to begin with -- so I need to validate user input.  Problem is, the user input is supposed to be valid PHP code.  I'm thinking that, as long as I'm careful, I shouldn't be executing any code contained in strings, but I'm no security expert and I want a warm fuzzy that my thought on this is correct.  What kinds of things do I need to look out for?  Is it possible to inject when working with strings?   My initial thought is to regex the entire file and replace key portions with known replacements.  So ( and ) would become !* and !^ or $ would become @~ (combinations that -- I think -- don't make sense to php?)  But that may be completely unnecessary processing time if I'm not in any danger, here.  Thanks ahead of time for any help.   PS - as a side question -- what's the best way to verify a file is a php file?  I know of getimagesize for images, but should I just check for <? to verify it's php?  That seems like it would be too easy to fool -- then again, it might not matter much.   -Adam

I have a calendar select date function for my form that returns the date in the calendar format for USA: 02/16/2012.  I need to have this appear as is for the form and in the db for the 'record_date' column, but I need to format this date in mysql DATE format (2012-02-16) and submit it at the same time with another column name 'new_date' in the database in a hidden input field.  Is there a way to do this possibly with a temporary table or something?

Any ideas would be welcome.

Doug

Hi people, I really hope you guys can help me out today. I'm just a newbe at php and i'm having real trouble.

Bassically all I want to do is have a user type in a company name in a html form.

If what the user types in the form matches the company name in my php script i want the user to be sent to another page on my site.

If what the user types in the form doesnt match the company name in my php script i want the user to be sent to a differnt page like an error page for example.

this is my html form:

Code: [Select]
<form id="form1" name="form1" method="post" action="form_test.php">
  <p>company name:
    <input type="text" name="company_name" id="company_name" />
  </p>
  <p>
    <input type="submit" name="button" id="button" value="Submit" />
  </p>
</form>
And this is the php code I'm trying to process the information on:

Code: [Select]
<?php

$comp_name = abc;

if(isset ($_POST["company_name"])){
 if($_POST["company_name"] == $comp_name){

     header("Location: http://www.hotmail.com");
exit();
 }

else{
   header("Location: http://www.yahoo.com");
exit();   
 }
}
?>
The thing is i'm getting this error when i test it:
Warning: Cannot modify header information - headers already sent by (output started at D:\Sites\killerphp.com\form_test.php:10) in D:\Sites\killerphp.com\form_test.php on line 17

Please can some one help me out, i'm sure this is just basic stuff but i just cant get it to work 

Cheers.

i'm not sure how to ask this question on google, so i'm going to ask for your help.

here's the code that i have the question about

<form action='findMovie.php' method='post'>
<table>
<?php
$result = mysql_query ("SELECT genre FROM genres ORDER BY genre");
while ($row = mysql_fetch_array($result)) {
$genre = $row['genre'];
echo "<tr><td>" .$genre ."</td><td><input type='hidden' name='" .$genre ."' value='" .$genre ."'><input type='submit' name='listMovies'></td></tr>";
}
?>
</table>
</form> 

so i have this form that creates a list of submits from a table that i have created.  the form works perfectly fine (i realize the design is not that great... i'm just going for functionality now)

what i need is to turn the value of the hidden field (which is dynamically created by a variable) into a variable in the handler so that I can search my movie table and get the movies by genre. 

does this make sense?  and any help is greatly appreciated.  i'm not a great programmer, but i do it in my spare time as a hobby.  so go easy on my coding, it works and that's the most i'm concerned with at the moment. 

thanks ahead of time

Whit my code it only appear a list of  1 or 0 and the id but I don't know how to get to show only the id
Like so:


submit
0
60/
0
59/
0
58/
0
57/
0
56/
0
45/
0
38/
1
37/


on my first page:
Code: [Select]
<table border="2">
     <tr>
     
     <th>Id</th>
     <th>User</th>
     <th>Comment</th>
     <th>Yes</th>
     <th>No</th>
     </tr>
     <form method="post" action="admincommentdelete.php" id="formc">
      <?php
  
  $vv = array();
  $st = Comment::test($result['article']->id,0,999);
  $vv['comment'] = $st['comment'];
  $i = 0;
 foreach($vv['comment'] as $p)
 {
 $i++;
 echo "<tr>";
 echo "<td>".$p->id."</td>";
 echo "<td>".$p->usern."</td>";
 echo "<td>".$p->com."</td>";
 echo "<td><input name=$i type=radio value='1'/></td>";
 echo "<td><input name=$i type=radio value='0'/></td>";
         echo "<input type=hidden name=h".$i." value=$p->id/>";
 echo "</tr>";
 
 }
  
  ?>
      <input type="submit" value="submit" name="submit">
      </form>
     
      </table>

second:
Code: [Select]
<?php
  
$id = array();
if(isset($_POST['submit']))
{

$data = array();
$data = $_POST;
foreach($data as $key)
{

echo $key."</br>";
}
}



?>

So basically I have a site, and on that site, I have a page that submits a form and updates a database. I have it set up so that someone can enter in Multiple values into a textarea, one on each line, and it will submit each of those values as a new row in the database, but for the life of me, I cannot figure out how to check those values against the actual users.

It is basically a point system, where the staff can award points users of the site. But at the moment, a Staff member could enter in Jibberish, and it would insert that into the database, but I want it to check my users table to make sure the user exists before it inserts it into the database.

here is my code:
<?php
include 'global.php';

echo $headersidebar;


if ($_COOKIE['access'] == $accessstaff)
{





if(count($_POST))
{



$array = preg_split('/(\r?\n)+/', $_POST['studentname']);
foreach($array as $students)
   {
   
   $statusmsg = '<center><span style="background: #A6FF9E;">You have successfully submitted points to the database.</span></center>';
   
   mysql_query("INSERT INTO points (giver, receiver, points, category, reason, date, status) VALUES ('{$_COOKIE['username']}', '{$students}', '{$_POST['pointamt']}', '{$_POST['pointcat']}', '{$_POST['pointreason']}', '{$date}', 'Validating')");
   }
}


$addpointspage = $statusmsg . '

<form action="submit_points.php" method="post">

<table class="table" >

<tr>

<td colspan="10">

<h1><strong><center>Submit Points</center></strong></h1>

</td>

</tr>

<tr>

<td colspan="10" rowspan="100">

<center>Please remember to follow the house point limits when submitting house points.</center>

</td>

</tr>

</table>

<table class="table">

<tr>

<td style="width: 15%;" valign="top">

Student Name:<br> <span style="font-size: 60%;">(List as many as you want; One per Line)</span>

</td>

<td colspan="10">

<center><textarea name="studentname" cols="60" rows="10"></textarea></center>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Amount of Points:

</td>

<td>

<input style="position: relative; left: 16px;" type="text" size="15" name="pointamt" />

</td>

<td>

Do not put anything that is not a number into this box.

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Point Category:

</td>

<td colspan="10">

<select name="pointcat" style="position: relative; left: 16px;">

<option SELECTED value="">-------</option>

<option>Class Work</option>

<option>Class Exam</option>

<option>Extra Work</option>

<option>Contests</option>

<option>Teacher\'s Assistant</option>

<option>Negative Points</option>

</select>

</td>

</tr>

<tr>

<td style="width: 15%;" valign="top">

Reason:

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" name="pointreason" type="text" size="80" />

</td>

</tr>

<tr>

<td>

</td>

<td colspan="10">

<input style="position: relative; left: 16px;" type="submit" value="Submit Points" />

</td>

</tr>

</table

</form>



';

}

elseif (1==1)
{
$addpointspage = $accessdenied;
}



echo

'

<!-- start content -->

<div id="content">

<div class="post">

<div class="entry">

<p><strong>' . $addpointspage . '</p>

<p class="links">' . $addpointslink . '</p>

</div>

</div>

</div>

<!-- end content -->

<div style="clear: both;">&nbsp;</div>

</div>

<!-- end page -->
</div>';








echo $footer;





?>


I am fairly new to PHP, so I would appreciate any help someone could give me; I am not too good with arrays and such, so this one has got me stumped.

I need to allow a user to input a CSV file and to display what
they've got, possibly for corrections.  I'm thinking of limitations
for filesize, what happens if the columns overlap the page, and
realtime.

What seems to be a good way of providing this functionality?

Any suggestions?

Thanks!

Mark

I thought I'd done this a hundred times before... but I am lost. Even after running mysql_real_escape_string, strip_tags and addslashes etc, I can still enter SQL into my input and it screws with the query. I can't simply use regex to check for valid characters since it's an input that lets the user format a post with BBcode and characters they want. What's the proper way to 'clean' the input, then? Thanks in advance