escaping input in php

Question

I wrote a code.. but now I don't know which version is a better one.. Is there any possibility couse of 1st version my code is vulnerable?

Version 1:

$destination = $_POST['var'];
$destination = strip_tags(trim($destination));

Version 2:

$destination = strip_tags(trim($_POST['var']));

On a side note: Personnaly, I'd trim after strip_tags, 'cause you may still end up with whitespace on either side after you removed tags from your already trimmed string (for instance, with <p> <-- see the space after > </p>. — Wrikken
– Wrikken, Commented Oct 4, 2010 at 18:21
good point.. but I gues it will work just fine for me as it is.. thanks! — arturs
– arturs, Commented Oct 4, 2010 at 18:26

Daniel Vandersluis · Accepted Answer · 2010-10-04 18:19:04Z

4

As neither strip_tags nor trim change the input string, there is absolutely no difference between the two versions.

answered Oct 4, 2010 at 18:19

Daniel Vandersluis

94.7k23 gold badges174 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

chigley · Accepted Answer · 2010-10-04 18:19:16Z

0

They're both exactly the same.
What are you escaping the input for? Database? XSS?

answered Oct 4, 2010 at 18:19

chigley

2,61221 silver badges18 bronze badges

Comments

Rafael Vega · Accepted Answer · 2010-10-04 18:19:43Z

0

Both snippets are exactly the same. Some people will say the first one is better for readability and some people will say the second one is better for conciseness.

answered Oct 4, 2010 at 18:19

Rafael Vega

4,6455 gold badges35 silver badges51 bronze badges

Comments

Chetan Sharma · Accepted Answer · 2010-10-04 18:20:58Z

0

Both of the versions mean SAME, you can use any. In my opinion you must use the filter_var, to filter the the input string...

answered Oct 4, 2010 at 18:20

Chetan Sharma

2,5675 gold badges25 silver badges41 bronze badges

Comments

Pizano · Accepted Answer · 2010-10-04 20:14:31Z

0

Both versions are the same in terms of vulnerability. If injection is what you're worried about, you may want to include addslashes().

Which is better? Version 2 will actually benchmark a little faster. Setting a variable to another is just an unnecessary step in the process. I would suggest that version 1, while not technically wrong, is bad practice. Even though the resulting value is the same.

edited Oct 4, 2010 at 20:14

answered Oct 4, 2010 at 19:13

Pizano

4184 silver badges7 bronze badges

Comments

Bassem · Accepted Answer · 2010-10-04 18:28:56Z

-2

Well, strip_tags can still be exploited. A slightly better solution might be the following:

$destination = htmlentities(trim($_POST['var']));

However this is still not enough, extra work should be done if the $_POST['var'] will go into the database.

Make sure that you understand what htmlentities() does exactly before implementing it in your code on a production level.

answered Oct 4, 2010 at 18:28

Bassem

3,1752 gold badges28 silver badges41 bronze badges

6 Comments

arturs Over a year ago

I read once a topic about this one... and someone said that it might corrupt databese if it will be filled with " etc. and I use mysql_real_ecape_string too.

user229044 Over a year ago

It's not going to "corrupt the database", but htmlentities() has absolutely nothing to do with input; it's only useful for escaping output.

Bassem Over a year ago

The reason i suggested htmlentities() is when the input is being output from the database .. strip_tags() will do nothing to prevent an XSS or other vulnerabilities in that case.

user229044 Over a year ago

@Link- That doesn't make sense. Input does not come from the database via $_POST. Escaping HTML entities is important, but not on data going into the database. It should only be done with data coming from the database, immediately before it leaves your app via STDOUT.

Bassem Over a year ago

@meagar: for one, htmlentities() serves as a multiple purpose input filtration. Not only does it help filter XSS but also reduces the risk of sql injection. for two, filtering the output after it leaves the database can still produce code insecurities (Think of log poisoning etc...). Filtering the output as it leaves the app is not practical either! Imagine outputting the data in diverse areas, you have to filter all of them?! That's not a very good practice is it?!

|

Collectives™ on Stack Overflow

escaping input in php

6 Answers 6

Comments

Comments

Comments

Comments

Comments

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

Comments

Comments

Comments

Comments

Comments

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related