Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

what is a good method to sanitize the whole $_POST array in php?

I have a form with a lot of variables which is then sending an email, rather than sanitizing each $_POST value with filter_var($_POST['var'], FILTER_SANITIZE_STRING); I was after a more simple piece of code. I came up with the below, which seems to work as I believe the default action is FILTER_SANITIZE_STRING, but I was just wondering what peoples opinions are, and if this is not good practice, perhaps you could tell me why? The $_POST values are then individually embedded into new variables, so I would only be using array_map just at the start to sanitize everything...

$_POST = array_map('filter_var', $_POST); 

Thank you for your replies, to give you a little more information, basically:

I have 20-30 input fields in a form which are being captured, the data is then displayed to the user to check their input, variables are then sanitized, the user is then sent an email and then finally the details are entered into a db.

currently I am sanitizing using the above array_map function, as well as FILTER_SANITIZE_EMAIL on the email address before sending an email and then escaping the input using mysql_real_escape_string() before the insert into the db. Without getting into prepared statements etc.. do you think I should be doing anything additionally? thanks again!

like image 494
SirG Avatar asked Sep 05 '10 05:09

SirG


People also ask

What is sanitizing data in PHP?

Sanitizing data means removing any illegal character from the data. Sanitizing user input is one of the most common tasks in a web application. To make this task easier PHP provides native filter extension that you can use to sanitize the data such as e-mail addresses, URLs, IP addresses, etc.

What is Filter_sanitize_email?

The FILTER_SANITIZE_EMAIL filter removes all illegal characters from an email address.


2 Answers

If the type of each of your input variables is a string and you want to sanitize them all at once, you can use:

// prevent XSS $_GET   = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING); $_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING); 

This will sanitize your $_GET and $_POST arrays.

Seen here: PHP -Sanitize values of a array

like image 62
johnny.rodgers Avatar answered Sep 23 '22 11:09

johnny.rodgers


Depends what its being used for.

If you are inserting it into the database then mysql_real_escape_string() for quoted strings and type casting for numbers would be the way to go - well ideally prepared statements, but thats an entirely different matter.

If you plan on outputting the data onto the webpage then I would recommend something like htmlspecialchars()

If you plan on using the user input as a shell argument, then you would use escapeshellarg()

Moving onto your question about sending emails. Well, the following should suffice:

filter_var($_POST['message'], FILTER_SANITIZE_STRING); 

All this does is basically strip tags and encode special characters.

like image 25
Russell Dias Avatar answered Sep 26 '22 11:09

Russell Dias