PHP Input Validation - Things to be aware of?

Question

I am creating a function that validates text input by a user. As I have various uses for the input text I would like the function to cover as many areas as possible in regards to the security concerns of letting a user input text on any part of a website. I currently make use of various peices of code that validate the various inputs as required and am trying to consolidate the security part of this into one function and the regex (email, tel, password validation) into another that can be used throughout the website.

I have a question relating to this.

I use this bit of filtering in order to clean user input when checking the input against info in the database:

$find = strtoupper($find); 
$find = strip_tags($find); 
$find = trim ($find);
$_SESSION['find'] = $find;
$keywords_array = explode(' ', $find);

If I use strip_tags does it make sense to validate the input like this prior to the filtering applied above:

if (preg_match("#\bscript\b#",$_POST['search']))
        {
            // Get user ip
            // Log client details to DB
            $GLOBALS['errorFocus'] = "autofocus class='thisInputIsError'";
            $GLOBALS['searchError'] = '<p>Your IP has been logged!</p>';
        }

If so, what other tags should i be watching out for?

Also what other things should I be watching out for in general in regards to the function I am trying to put together?

Any links to some GOOD tutorials that cover this would be great too :)

Thank you!

I think you're gonna have some problems finding all the possible script tag variations since there are a heap of methods to try and execute js. ha.ckers.org/xss.html gives you some good examples of what you can try to attack a site with. — lfxgroove
– lfxgroove, Commented Apr 12, 2012 at 10:00
In general, I wouldn't put 'your IP has been logged' messages in a web application. A person who inserts a script tag into page variables may not be a hacker (e.g. they may be following a malicious link). Record their IP by all means, but just throw a nice 404 or redirect to your homepage. — halfer
– halfer, Commented Apr 12, 2012 at 10:01

Artjom Kurapov · Accepted Answer · 2012-04-12 10:00:11Z

3

php does have filtering and validation built-in, read http://php.net/manual/en/book.filter.php you might also consider HTMLpurifier or tidy if you want custom-filter HTML content

answered Apr 12, 2012 at 10:00

Artjom Kurapov

6,1554 gold badges34 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Craig van Tonder Over a year ago

Thank you I was not aware of those two options, I will look at them.

Collectives™ on Stack Overflow

PHP Input Validation - Things to be aware of?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related