PHP function to escape string for writing into executable PHP file

Question

I need to handle untrusted input that will be written into a file that is executed by the server, config.php, like this:

$config['key'] = "Value";

I want to make it so that the user can submit a form which will write config.php. It obviously makes more sense to store this value in a database, but I cannot do that because this is a legacy system.

I found the functions addslashes and serialize, but I'm not sure if they are safe for this use case. I also could use hex2bin/bin2hex I suppose.

Another hack I thought of was using HEREDOCs:

$x = <<<PASSWORD

untrusted input here" echo "BOOM!";

PASSWORD;

What is the best way to proceed in this situation if you cannot change how configuration variables are stored?

php.net/manual/en/function.filter-var.php & php.net/manual/en/filter.filters.sanitize.php — skrilled
– skrilled, Commented Oct 24, 2013 at 23:37
It's a bad idea to store run-time writable config in a PHP file. Even if your PHP-syntax-output is completely correct, you still have to give the web user run-time write access to executable files, which means any file-upload vulnerability will escalate to an execute-arbitrary-code vulnerability. If you can't store to a database, at least store to a flat non-executable file (eg text or JSON) which can be read from PHP. — bobince
– bobince, Commented Oct 25, 2013 at 10:48

Yarek T · Accepted Answer · 2013-10-24 23:54:03Z

1

Base64 the content. Anything base64'ed can't possibly be valid PHP code

answered Oct 24, 2013 at 23:54

Yarek T

9,9652 gold badges30 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

PHP function to escape string for writing into executable PHP file

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related