Sanitizing Input String from Form

[Tom]

I'm trying to find a good, solid function that sanitizes string values
for form validation. The user notes on php.net offer the following:

http://www.php.net/manual/en/function.strip-tags.php#36574

And a slight revision of this:

http://www.php.net/manual/en/function.strip-tags.php#37562

These seem to do different things with tag attributes. So I've
reworked them slightly. This is what I came up with (apologies for any
indenting weirdness):

/* String Sanitizing Routine
*************** ***************/

/* global settings */

// allowed tags
$G_allowed_tags ='<a><blockquot e><br><br
/><b><div><em><h 1><h2><h3><h4>< h5><h6><i>'.
'<img><li><ol>< p><pre><span><s trong><table><t r><td><th><u><u l>';

// prohibitted tag attributes
$G_strip_tag_at ts =
'javascript|onc lick|ondblclick |onmousedown|on mouseup|onmouse over|'.
'onmousemove|on mouseout|onkeyp ress|onkeydown| onkeyup|class|s tyle|target';

// attribute replacement (x_attribute_na me)
$G_replace_att = 'xxx_\\1';


/* Fx sanitize_string () */
function sanitize_string ($string, $allowed_tags=F ALSE) {

// global allowed tags setting
global $G_allowed_tags ;

// default allowed tags
if ( !$allowed_tags) {
$allowed_tags = $G_allowed_tags ;
}

// clean string
$string = strip_tags($str ing, $G_allowed_tags );
$clean_string = preg_replace('/<(.*?)>/ie',
"'<'.strip_attr ibutes('\\1').' >'", $string);

// return
return $clean_string;

} // end Fx


/* Fx strip_attribute s() */
function strip_attribute s($string) {

// global settings
global $G_strip_tag_at ts;
global $G_replace_att;

// strip forbidden values
$stripped_strin g = stripslashes($s tring);
$stripped_strin g = preg_replace("/($G_strip_tag_a tts)/ie",
$G_replace_att, $stripped_strin g);

// return
return $stripped_strin g;

} // end Fx

/*************** **************/

This would take an input string like this:

<p><a href="javascrip t:alert('you clicked');" target="_blank"
onMouseOver = "alert('you moused')">test</a></p>

And render it like this:

<p><a href="xxx_javas cript:alert('yo u clicked');" xxx_target="_bl ank"
xxx_onMouseOver = "alert('you moused')">test</a></p>

Then, before inserting in a MySQL database, I would run the string
through:

mysql_real_esca pe_string()

Anything I've missed? Anything to add?

Thanks,

Tom

[craig]

Re: Sanitizing Input String from Form

Tom wrote:[color=blue]
> I'm trying to find a good, solid function that sanitizes string values
> for form validation.[/color]

This one is pretty good and highly configureable..

http://cyberai.com/inputfilter/

Your's looks decent as well.
Craig

[juglesh]

Re: Sanitizing Input String from Form

look for
class: InputFilter (PHP4 & PHP5, with comments)
* @project: PHP Input Filter
* @date: 30-03-2005
* @version: 1.2.0_php4/5
* @author: Daniel Morris

on phpclasses.org