Question

Currently I use this strategy:

After submitting a HTML form or data sent using jQuery’s $.get() or $.post() I need to know what is come and then apply logic on the basis of that.

suppose, I’ve got $_POST['username'], $_POST['password'] and $_POST['login_submit_button'].
In my processing script file, I do like this:

if(isset($_POST['login_submit_button']) && isset($_POST['username']) && $_POST['username'] != "" && isset($_POST['password']) && $_POST['password'] != "") {
  // calling a common function safe_vars() which does
  // mysql_real_escape_string(stripslashes(trim($any_variable_need_to_become_safe)))
  // and now using the above variables for different purposes like
  // calculation, insertion/updating old values in database etc.
}

I know all this logic is wrong or having serious issues, so I want a much-secure and perfect solution instead of this. I welcome to find out vulnerabilities and severe security-bleaches in my strategy. This question can help others too, if answers came more explanatory, this can be informative community wiki.

Answer 1

There is no way to make a generic super “make things safe” function.

mysql_real_escape_string

You shouldn’t use this at all. It uses the old mysql API, and assumes you are going to be manually smashing strings together to make SQL. Don’t do that. Use PDO or mysqli and a function that deals in prepared queries and bound arguments.

stripslashes

This is an antidote to magic quotes. If magic quotes are not on it will destroy data. Don’t use it. Turn magic quotes off instead.

trim

This destroys data. Don’t use it unless you really want to remove white space at the start and end of the string.

---

Escape data for the target language immediately before inserting data into that language.

For SQL, use bound arguments and prepared queries.

For HTML, use htmlspecialchars or a template language that does escaping for you, such as mustache.

Alternatively, (if you want to allow HTML) parse it, generate a DOM, filter it using a whitelist, then serialise it back to HTML.

For JSON, use encode_json

etc.