FUDforum: comp.lang.php » Sanitising input

Home » Imported messages » comp.lang.php » Sanitising input

Show: Today's Messages :: Polls :: Message Navigator

Re: Sanitising input [message #172127 is a reply to message #172112]

Mon, 31 January 2011 12:05

Denis McMahon
Messages: 634
Registered: September 2010

Karma:

Senior Member

On 31/01/11 01:17, Norman Peelman wrote:
> Denis McMahon wrote:
>> On 30/01/11 14:09, Mad Hatter wrote:

>>> I'm writing a simple script which will take a users input, save it to a
>>> mysql database and then display it. I'm going to use htmlentities() to
>>> clean things up which I hope will stop basic attacks but how else
>>> should I
>>> sanitise my input?

>> Note that you can absolutely never assume that the data you receive will
>> bear any connection with your web page. It is trivial for an attacker to
>> view your form html, and to generate his own form that calls your form
>> handler with whatever data he desires to send in every form element.
>>
>> The fact that your select element for year has values from "2001" to
>> "2020" doesn't stop an attacker sending:
>>
>> "';;drop *;;"

> To the best of my knowledge, the PHP/MySQL library doesn't allow more
> than one sql statement in the same query.

Regardless of what eventually gets passed to the database, my points
here are that (a) you can not rely on anything to control the format of
data that your form handler receives; and (b) people will send malicious
data to try and break your website.

Rgds

Denis McMahon

Report message to a moderator

[Message index]

		Sanitising input By: Mad Hatter on Sun, 30 January 2011 14:09
		Re: Sanitising input By: Michael Fesser on Sun, 30 January 2011 15:00
		Re: Sanitising input By: Denis McMahon on Sun, 30 January 2011 16:35
		Re: Sanitising input By: Norman Peelman on Mon, 31 January 2011 01:17
		Re: Sanitising input By: Captain Paralytic on Mon, 31 January 2011 11:51
		Re: Sanitising input By: Norman Peelman on Mon, 31 January 2011 23:39
		Re: Sanitising input By: Denis McMahon on Tue, 01 February 2011 00:53
		Re: Sanitising input By: Norman Peelman on Tue, 01 February 2011 11:26
		Re: Sanitising input By: Denis McMahon on Mon, 31 January 2011 12:05
		Re: Sanitising input By: P E Schoen on Sun, 30 January 2011 19:47
		Re: Sanitising input By: Felix Saphir on Sun, 30 January 2011 19:55
		Re: Sanitising input By: Ross McKay on Sun, 30 January 2011 21:39
		Re: Sanitising input By: Jerry Stuckle on Sun, 30 January 2011 21:50
		Re: Sanitising input By: Ross McKay on Mon, 31 January 2011 03:43
		Re: Sanitising input By: Jerry Stuckle on Mon, 31 January 2011 04:12
		Re: Sanitising input By: Ross McKay on Mon, 31 January 2011 05:01
		Re: Sanitising input By: Jerry Stuckle on Mon, 31 January 2011 05:10
		Re: Sanitising input By: Ross McKay on Mon, 31 January 2011 05:38
		Re: Sanitising input By: Jerry Stuckle on Mon, 31 January 2011 12:51
		Re: Sanitising input By: Sherm Pendley on Sun, 30 January 2011 22:18
		Re: Sanitising input By: Ross McKay on Mon, 31 January 2011 03:52
		Re: Sanitising input By: Sherm Pendley on Mon, 31 January 2011 05:23

Previous Topic:	Only SPAM!!!
Next Topic:	What tasks are hard for PHP?

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Fri Sep 20 13:33:25 GMT 2024

Total time taken to generate the page: 0.04168 seconds