Question

I am passing a textarea input boxs’ contents via POST to my php file from html (no javascript allowed).

I then use simplexml to get the feed at the url the user entered.

Unfortunately, the user can enter anything into the textarea. Which I am told is dangerous.

What is the recommended way to clean and secure the POST contents using PHP to get them ready and safe for the simplexml procedure?

(basically, to be sure they are not malicious and check they are a valid url)

Answer 1

Content inside a $_POST array are strings, so there’s nothing ineherently unsafe there.

1. User enters php code? It surely won’t be executed, so no problem here (this, among many others, is a reason not to use such things as eval()). So whatever php function or command he writes it will be read as a simple string, and string are no harmful whatever they contain.
2. User enters malicious javascript? Still no problem, as javascript inside php, or inside a database for what that matters, is pretty useless since it needs a browser to execute.

This leads to the real issue: user supplied contents needs to be “sanitized” only right before passing it to the target medium. If you’re going to feed a database , use the escaping tools provided by your engine. If you’re going to output it on the webpage, that’s when you need to sanitize from malicious XSS attacks.

Sanitizing a POST array per se , before actually doing anything with its content, is wrong as you never know for sure when and where that content needs to be used; so don’t even think to use strip_tags() or analogue functions that comes to your mind right after you get the POST value, but pass it as is and add the necessary escaping/sanitizing just when needed.

What you actually need to do, then, you only know, so act accordingly