Question

I’m new to PHP and I’m following a tutorial here:
Link

It’s pretty scary that a user can write php code in an input and basically screw your site, right?

Well, now I’m a bit paranoid and I’d rather learn security best practices right off the bat than try to cram them in once I have some habits in me.

Since I’m brand new to PHP (literally picked it up two days ago), I can learn pretty much anything easily without getting confused.

What other way can I prevent shenanigans on my site? 😀

Answer 1

There are several things to keep in mind when developing a PHP application, strip_tags() only helps with one of those. Actually strip_tags(), while effective, might even do more than needed: converting possibly dangerous characters with htmlspecialchars() should even be preferrable, depending on the situation.

Generally it all comes down to two simple rules: filter all input, escape all output. Now you need to understand what exactly constitutes input and output.

Output is easy, everything your application sends to the browser is output, so use htmlspecialchars() or any other escaping function every time you output data you didn’t write yourself.

Input is any data not hardcoded in your PHP code: things coming from a form via POST, from a query string via GET, from cookies, all those must be filtered in the most appropriate way depending on your needs. Even data coming from a database should be considered potentially dangerous; especially on shared server you never know if the database was compromised elsewhere in a way that could affect your app too.

There are different ways to filter data: white lists to allow only selected values, validation based on expcted input format and so on. One thing I never suggest is try fixing the data you get from users: have them play by your rules, if you don’t get what you expect, reject the request instead of trying to clean it up.

Special attention, if you deal with a database, must be paid to SQL injections: that kind of attack relies on you not properly constructing query strings you send to the database, so that the attacker can forge them trying to execute malicious instruction. You should always use an escaping function such as mysql_real_escape_string() or, better, use prepared statements with the mysqli extension or using PDO.

There’s more to say on this topic, but these points should get you started.

HTH

EDIT: to clarify, by “filtering input” I mean decide what’s good and what’s bad, not modify input data in any way. As I said I’d never modify user data unless it’s output to the browser.