Programming Help

Web Development



What's Here?

  • Members: 136,280
  • Replies: 478,658
  • Topics: 74,563
  • Snippets: 2,566
  • Tutorials: 675
  • Total Online: 2,327
  • Members: 101
  • Guests: 2,226

Welcome to Dream.In.Code
Getting PHP Help is Easy!

Join 136,280 PHP Programmers for FREE! Get instant access to thousands of PHP experts, tutorials, code snippets, and more! There are 2,327 people online right now. Registration is fast and FREE... Join Now!




Securing against XSS / SQL injection

 
 Reply to this topicStart new topic

Securing against XSS / SQL injection
spearfish
11 Oct, 2008 - 12:55 PM
Post #1

Monkey in Training
Group Icon

Joined: 10 Mar, 2008
Posts: 746



Thanked: 2 times
Dream Kudos: 225
My Contributions
Hi all,

I have a question on web application security with PHP. My goal is for my app to be vulnerable to neither XSS nor SQL injection. Pretty standard goal I'd say tongue.gif

I've whipped up this function to sanitize data:

CODE

function escape($input) {
$clean = htmlentities(mysql_real_escape_string($input));
return $clean;
}


Will that work, and is it multipurpose like I'm hoping is? Essentially, before any data is put into the HTML stream or the database it goes through something like $data = escape($_GET['data']). By the time this function is called, a valid MySQL connection will have been made, or a fatal error would have been triggered by the application.

Thanks,
-Spear
User is offlineProfile CardPM
+Quote Post

Moonbat
RE: Securing Against XSS / SQL Injection
11 Oct, 2008 - 01:29 PM
Post #2

D.I.C Regular
Group Icon

Joined: 30 Jun, 2008
Posts: 391



Thanked: 22 times
Dream Kudos: 600
My Contributions
Do you plan on the user entering any HTML? If not, then you can add strip_tags() to your function as well.

Otherwise, that looks fine smile.gif

This post has been edited by Moonbat: 11 Oct, 2008 - 01:29 PM
User is offlineProfile CardPM
+Quote Post

Fast ReplyReply to this topicStart new topic
Time is now: 12/2/08 05:25AM
Invision Power Board v2.1.7 © 2008  IPS, Inc.
Licensed to: MediaGroup1

Live PHP Help!

PHP Tutorials

Reference Sheets

PHP Snippets

DIC Chatroom

Bye Bye Ads

Monthly Drawing

Thumb Drive

Top Contributors

Top 10 Kudos This Month