Code injection with PHP

Question

I'm aware of how to protect against SQL injections & stuff & validating user input... but was wondering if you are taking data from a user input field & the data is a string how safe is this data to use inside your code for stuff like:

if ($i == $_POST['userinput']) {
    ....
}

The above is just an example at trying to get across my question at asking what steps you need to take & in what circumstances.

Obviously it wouldn't work in the above instance, but just trying to prevent people doing something like an include('whatever.php'); etc.

Pekka · Accepted Answer · 2011-03-16 16:44:29Z

4

Making a comparison against a variable, like you show, is not dangerous in itself, so there's nothing to worry about there.

User input becomes potentially dangerous when used, in an include statement, in a database query, in a file name, in an eval() call, in a HTML page, etc. every one of those uses has one correct sanitation method.

answered Mar 16, 2011 at 16:44

Pekka

451k150 gold badges990 silver badges1.1k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

knittl · Accepted Answer · 2011-03-16 16:44:51Z

1

comparing to user provided variables is fine, they are simply handled as string. regarding your include('whatever.php') example, use whitelisting to protect against it:

if(!in_array($userinput, array('libs.php', 'my.php'))) {
  die('sorry pal');
}

answered Mar 16, 2011 at 16:44

knittl

269k59 gold badges339 silver badges405 bronze badges

1 Comment

Brett Over a year ago

Thanks... I thought so, just wanted to make sure :)

Charles · Accepted Answer · 2011-03-16 16:45:22Z

1

Unless you are calling eval or similar functions that create and run actual PHP code from a string like create_function, you generally don't need to worry about actual code injection.

As you've already pointed out, you do need to be careful when performing includes or calling functions based directly on user input. The fact that you knew this means that you're probably already well-prepared in that regard.

answered Mar 16, 2011 at 16:45

Charles

51.5k13 gold badges107 silver badges146 bronze badges

Comments

Matteo Riva · Accepted Answer · 2011-03-16 16:48:07Z

Data coming from users is potentially dangerous, but it doesn't mean it's dangerous always -- it depends on what you do with it.

While filtering/whitelisting/sanitizing data is always good practice, the absolute minimum you must do is avoid using it directly to do things that interact actively with the environment: dealing with the filesystem (includes, fopen, file_(get|put)_contents, etc.), the database, generating HTML output and so on.

Of course, different cases call for different measures: for example, there is no point in using (as I often see) htmlspecialchars() when building database queries -- that function's purpouse is to avoid code injection in browser output, so it should be used for that.

In short there is no magic one-sentence answer, you have to know what's dangerous and when, and act accordingly.

rollin340 · Accepted Answer · 2011-03-16 16:39:25Z

-1

As a string by itself, it is fine.It is still safer to addslashes to ensure that symbols such as ' and " do not clash. It's mainly a danger to SQL Databases.

answered Mar 16, 2011 at 16:39

rollin340

3582 gold badges7 silver badges19 bronze badges

3 Comments

knittl Over a year ago

please don't advise to use addslashes!

Pekka Over a year ago

Addlashes in itself adds no safety whatsoever.

Marc B Over a year ago

addslashes() is the equivalent of using an overcooked spaghetti noodle as a seat belt in your car.

Collectives™ on Stack Overflow

Code injection with PHP

5 Answers 5

Comments

1 Comment

Comments

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

1 Comment

Comments

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related