for security reasons.
Well it's driven me MAD!
The "Quoted" text is saying that the data should be in plain form UNLESS it is being embedded into a NEW string?
Quote:
http://stackoverflow.com/questions/...a-in-get-by-php
So on the surface it appears that this is fine without "sanitizing it" ???
And it's driving me nuts because this ->
function blah!
Adds a slash
And without this AFTER mysql_real_escape_string ->
One can't get rid of the slashes before the ' or " etc?
Unless one adds stripslahes to every var that contains text like ->
So! Is it better to add it in the "Sanitize" function or add it to each and every $VAR that handles text?
I GIVE UP!
Edit: I thought it may be wise to add the function I'm using.
// Do a general clean up of POST and GET.
// Function for stripping out malicious bits
function cleanInput($input) {
$search = array(
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
'@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@<style[^>]*?>.*?</style>@siU', // Strip style tags properly
'@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments
);
$output = preg_replace($search, '', $input);
return $output;
}
// Sanitization function
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
$output = stripslashes($output);
return $output;
}
// Function for stripping out malicious bits
function cleanInput($input) {
$search = array(
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
'@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@<style[^>]*?>.*?</style>@siU', // Strip style tags properly
'@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments
);
$output = preg_replace($search, '', $input);
return $output;
}
// Sanitization function
function sanitize($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
$output = stripslashes($output);
return $output;
}
