Securing user-data - for use in method calls, SQL and file calls

Question

I am using $_GET, $_POST and $_COOKIE variables in method calls, SQL queries and file calls - and it is necessary to escape / rewrite this user-data for better security (avoid injection attacks and the like). How would you recommend this is done?

Some ideas from built-in escape function ... to get the juices flowing:

Add backslashes to: \x00, \n, \r, \, ', " and \x1a to make the string safe for SQL queries - as in mysql_real_escape_string().
Limit the number of accepted characters to [a-zA-Z0-9 _-\.] (where "\." is an escaped "."-dot).

Your inputs are appreciated. Thanks.

Pascal MARTIN · Accepted Answer · 2009-09-25 04:58:08Z

1

As escaping depends on the system you are sending the data too, my suggestion would be to use the functions provided by PHP, specifically created for each system.

For instance :

for MySQL queries, use mysql_real_escape_string, or mysqli_real_escape_string, or PDO::quote
- Or use prepared statements (mysqli, PDO)
- Don't add backslashes yourself : why do that when proper and well-working (and well-tested !) escaping functions already exist ?
for HTML output, use htmlspecialchars or htmlentities.

Either way : don't re-invent the wheel !

There are escaping functions/methods that already exists for many kind of output : use those !

answered Sep 25, 2009 at 4:58

Pascal MARTIN

402k82 gold badges665 silver badges666 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

sharat87 Over a year ago

make sure you connect to mysql before usint the mysql_* functions above, if you are using mysql that is..

Gumbo Over a year ago

Don’t put a space before colons, question marks and exclamation marks. That looks awful!

Pascal MARTIN Over a year ago

@Gumbo: sorry about that; I usually type in french, and, in french, we put a space before those... And I don't have the reflex to remove those spaces when typing in english...

alex · Accepted Answer · 2009-09-25 05:56:00Z

Also note that somethings you must escape (if user entered) are image locations etc

If someone hot linked to an image (for example an avatar) with this

http://yoursite.com/admin/user/delete/1

and then the code in your view is

<img class="avatar" alt="<?php echo $userName; ?>" src="<?php $avatarUrl; ?>" />

Then you might be accidentally deleting a user if you are logged in as admin. Of course, hopefully that sort of deletion is done with a post, but it can still be circumvented.

In this case, htmlspecialchars() won't help.

You can make it harder for an attacker by enforcing all data changing methods to be with a post, and you can make it almost impossible by generating a token for every delete action, and verifying it before deleting.

FDisk · Accepted Answer · 2009-09-25 08:17:45Z

0

I'm using like this:

function escape($sql) {
    // Stripslashes
    if (get_magic_quotes_gpc()) {
        $sql = stripslashes($sql);
    }
    //if this is the intedger
    if (!is_int($sql) || $sql == '0') {
        $sql = "'" . mysql_real_escape_string($sql) . "'";
    }
    return $sql;
}

And in MySQL query

mysql_query("SELECT SQL_CACHE * FROM `page` WHERE `id` = ".escape($_GET['id'])." LIMIT 1");

answered Sep 25, 2009 at 8:17

FDisk

9,6732 gold badges54 silver badges56 bronze badges

1 Comment

Kristoffer Bohmann Over a year ago

This function will only work for SQL queries - not for method and file calls - also, it is MySQL-specific. It must be possible to make a more generic Escape function.

Collectives™ on Stack Overflow

Securing user-data - for use in method calls, SQL and file calls

3 Answers 3

3 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related