Security function for scanning web input parameters.

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • John Murtari
    #1

    Security function for scanning web input parameters.

    Folks,

    Been playing around with developing a 'catch all'
    convenience function that could be used to properly screen
    form input via a browser to a script. We are
    ASSuming register globals is OFF and magic quote are OFF. The
    function below would be used like:

    $user_email = script_param("u ser_email_addr" );

    I was working on this a while back and recently
    came back to it (some of the logic looks a little suspect
    even to me now!). I'd welcome any thoughts or other functions
    people are using to screen input!

    Thanks!
    John

    =============== ============
    // This function takes a parameter name and checks both GET
    // and POST arrays to find the parameter value.
    function script_param ($name) {

    global $HTTP_GET_VARS, $HTTP_POST_VARS ;

    unset ($val);

    if (isset ($_GET[$name])) {
    $val = $_GET[$name];
    $val = stripcslashes($ val);

    } else if (isset ($_POST[$name])) {
    $val = $_POST[$name];

    if (is_string($val )) {
    $val = mysql_real_esca pe_string($val) ;
    }

    } else if (isset ($HTTP_GET_VARS[$name])) {
    $val = $HTTP_GET_VARS[$name];
    $val = stripcslashes($ val);

    } else if (isset ($HTTP_POST_VAR S[$name])) {
    $val = $HTTP_POST_VARS[$name];

    if (is_string($val )) {
    $val = mysql_real_esca pe_string($val) ;
    }

    }

    // clean the data
    if (@is_array($val )) {

    // scan each value
    foreach ($val as $index =$value) {
    $value = @trim($value);
    $value = htmlspecialchar s($value);
    $val[$index] = $value;
    }
    return($val);
    }

    $value = @trim($val);
    $value = htmlspecialchar s($value);

    // return @$val rather than $val to prevent "undefined value"
    // messages in case $val is unset and warnings are enabled
    return (@$value);
    }
    =============== =============== =====

    --
    John
    _______________ _______________ _______________ _______________ _______
    John Murtari Software Workshop Inc.
    jmurtari@follow ing domain 315.635-1968(x-211) "TheBook.Co m" (TM)
    http://thebook.com/
    Tags: None
    • Curtis
      #2
      Re: Security function for scanning web input parameters.

      John Murtari wrote:
      Folks,
      >
      Been playing around with developing a 'catch all'
      convenience function that could be used to properly screen
      form input via a browser to a script. We are
      ASSuming register globals is OFF and magic quote are OFF. The
      function below would be used like:
      >
      $user_email = script_param("u ser_email_addr" );
      >
      I was working on this a while back and recently
      came back to it (some of the logic looks a little suspect
      even to me now!). I'd welcome any thoughts or other functions
      people are using to screen input!
      >
      Thanks!
      John
      >
      =============== ============
      // This function takes a parameter name and checks both GET
      // and POST arrays to find the parameter value.
      function script_param ($name) {
      >
      global $HTTP_GET_VARS, $HTTP_POST_VARS ;
      Deprecated. Don't use these unless you have to.
      >
      unset ($val);
      This hasn't even been initialized, no need to unset.
      >
      if (isset ($_GET[$name])) {
      $val = $_GET[$name];
      $val = stripcslashes($ val);
      >
      } else if (isset ($_POST[$name])) {
      $val = $_POST[$name];
      >
      if (is_string($val )) {
      $val = mysql_real_esca pe_string($val) ;
      }
      >
      } else if (isset ($HTTP_GET_VARS[$name])) {
      $val = $HTTP_GET_VARS[$name];
      $val = stripcslashes($ val);
      >
      } else if (isset ($HTTP_POST_VAR S[$name])) {
      $val = $HTTP_POST_VARS[$name];
      >
      if (is_string($val )) {
      $val = mysql_real_esca pe_string($val) ;
      }
      >
      }
      You don't sanitize the GET data for some reason, unless you're usage
      of this function is for a very specific project.
      >
      // clean the data
      if (@is_array($val )) {
      >
      // scan each value
      foreach ($val as $index =$value) {
      $value = @trim($value);
      $value = htmlspecialchar s($value);
      $val[$index] = $value;
      }
      return($val);
      }
      >
      $value = @trim($val);
      $value = htmlspecialchar s($value);
      >
      // return @$val rather than $val to prevent "undefined value"
      // messages in case $val is unset and warnings are enabled
      return (@$value);
      }
      =============== =============== =====
      >
      So, do you have a question? Your code is outdated and relies on
      AT-error suppression to get around coding mistakes. You might want to
      start over from scratch.

      Your code operates inconsistently, and it appears to be abusing data
      types.

      PHP manual would be a good place to go.

      --
      Curtis

        Comment

        • John Murtari
          #3
          Re: Security function for scanning web input parameters.

          Curtis <zer0dyer@veriz on.netwrites:
          John Murtari wrote:
          >Folks,
          > Been playing around with developing a 'catch all'
          >convenience function that could be used to properly screen
          >form input via a browser to a script. We are ASSuming register
          >globals is OFF and magic quote are OFF. The
          >function below would be used like:
          >$user_email = script_param("u ser_email_addr" );
          > I was working on this a while back and recently came back to
          >it (some of the logic looks a little suspect
          >even to me now!). I'd welcome any thoughts or other functions
          >people are using to screen input!
          > Thanks! John
          >============== =============
          >// This function takes a parameter name and checks both GET
          >// and POST arrays to find the parameter value.
          >function script_param ($name) {
          > global $HTTP_GET_VARS, $HTTP_POST_VARS ;
          >
          Deprecated. Don't use these unless you have to.
          >
          > unset ($val);
          >
          This hasn't even been initialized, no need to unset.
          >
          > if (isset ($_GET[$name])) {
          > $val = $_GET[$name];
          > $val = stripcslashes($ val);
          > } else if (isset ($_POST[$name])) {
          > $val = $_POST[$name];
          > if (is_string($val )) {
          > $val = mysql_real_esca pe_string($val) ;
          > }
          > } else if (isset ($HTTP_GET_VARS[$name])) {
          > $val = $HTTP_GET_VARS[$name];
          > $val = stripcslashes($ val);
          > } else if (isset ($HTTP_POST_VAR S[$name])) {
          > $val = $HTTP_POST_VARS[$name];
          > if (is_string($val )) {
          > $val = mysql_real_esca pe_string($val) ;
          > }
          > }
          >
          You don't sanitize the GET data for some reason, unless you're usage
          of this function is for a very specific project.
          >
          > // clean the data
          > if (@is_array($val )) {
          > // scan each value
          > foreach ($val as $index =$value) {
          > $value = @trim($value);
          > $value = htmlspecialchar s($value);
          > $val[$index] = $value;
          > }
          > return($val);
          > }
          > $value = @trim($val);
          > $value = htmlspecialchar s($value);
          > // return @$val rather than $val to prevent "undefined value"
          > // messages in case $val is unset and warnings are enabled
          > return (@$value);
          >}
          >============== =============== ======
          >>
          >
          So, do you have a question? Your code is outdated and relies on
          AT-error suppression to get around coding mistakes. You might want to
          start over from scratch.
          >
          Your code operates inconsistently, and it appears to be abusing data
          types.
          >
          PHP manual would be a good place to go.
          Thanks for the comments. Do you or anyone have similiar
          convenience functions you can share which scan user input before
          processing?

          --
          John
          _______________ _______________ _______________ _______________ _______
          John Murtari Software Workshop Inc.
          jmurtari@follow ing domain 315.635-1968(x-211) "TheBook.Co m" (TM)
          http://thebook.com/

            Comment

            Previous template Next
            Working...