Question

I’m writing a PHP script to grab text box data from a submitted form. These are simple text boxes and I don’t want to accept any HTML tags. I think I should at least use strip_tags() and addslashes(). Anything else? I wouldn’t mind restricting the input to alphanumerics, should I use a regular expression to seek out nonstandard characters?

This is a simple form that actually (ugh) gets emailed to the person processing it. (No database, sadly.) And it’s simple data, first and last name sort of things.

Edit: I’d also like to know specifically what I should be looking for. What’s the consensus on reasonable input filtering?

Answer 1

Use the PHP filter functions.

You can use them for sanitizing input and validating input (eg email addresses).

There are two approaches to validation (this also applies to security and lots of other things).

Firstly, you can default to allow anything except for that which is explicitly disallowed. Or you can default ti disallowing everything except that which is specifically allowed.

Generally speaking the latter approach is more secure and should be used except in cases where you have a compelling reason not to (eg it’s simply too hard to know what’s allowed, you’re doing an app for users who aren’t deemed to be a security threat and so on).

You have to be careful using this however. For people’s names characters like ‘ and – are perfectly valid but naive implementations may restrict them. What you want to generally avoid is:

• SQL injection: always use mysql_real_escape_string() on any input;
• XSS (Cross site scripting): generally speaking you should strip out HTML tags from user input. You will of course sometimes have to allow them (eg rich text editor boxes) but even in those cases you will have a list of tags that you allow and you should strip out all others (especially tags); and
• Tpically you should strip out low characters (below ASCII 20? or so); and
• Depending on your internationalization requirements you may want to strip out high characters (above ASCII 127).

A good default value to use is:

$var = filter_var($var, FILTER_SANITIZE_STRING); 

but pick the right filter for the situation.