Question

I wish to let certain users enter some fields, which will in turn populate a (new) php file. The (new) file will be a language file containing simple array values:

$lang['example'] = 'text for example';

Basicly I will just populate the file with each row and everything seems grand. However, I need to know how to filter the inputs so that ', " and similiar stuff won’t break the string and open up space for potential injections.

Since php allows a lot of ways to style your code, I’m not sure a addslashes() would be enough for this matter.

How do I filter input so that it can be in strings in a php file?

I couldn’t find any other question regarding this matter, just database filtering.

Extra information:
I don’t want any html in these boxes. It should be able to handle ' and ", and the real question is can you do something like this:

$lang['example'] = 'hackkyyyyy
>>>
// do evil stuff
<<<
';

By that, I mean can you in an other way then ' or " break a string in php?

Answer 1

Usual I use var_export, just an exaple:

file_put_contents("temp.php",'<?php'. var_export($_POST,true));

when I need the array:

$a = include "temp.php";