/    Sign up×
Community /Pin to ProfileBookmark

Best way to secure $_GET & $_POST

Copy linkTweet thisAlerts:
May 25.2012

Me again.

What is the most effective way to secure such data?

I made this, it seems to work, but i dont feel its secure.

[code=php]
function Secure($str){
$arr = str_split($str,1);
$sec = ”;
foreach ($arr as $a){
if ($a >= ‘a’ && $a <= ‘z’ ) $sec = $sec . $a;
elseif ($a >= ‘A’ && $a <= ‘Z’ ) $sec = $sec . $a; }
return $sec; }
[/code]

Any data i receive should only ever contain letters.

Is this secure?
Could it be better?

Thanks.

to post a comment
PHP

4 Comments(s) ↴

Copy linkTweet thisAlerts:
@Jeff_MottMay 25.2012 — Well... first, the function's name -- "Secure" -- is much too ambiguous. There are various kinds of security. When you use a value in HTML, you secure it with htmlspecialchars. When you use a value in SQL, you secure it with prepared statements or mysql_real_escape_string. What you're trying to do looks to me like [b]form validation[/b], and if part of that validation requires that a value contain only alphabetic characters, then you can use the [url=http://php.net/manual/en/function.ctype-alpha.php]ctype_alpha[/url] function.
Copy linkTweet thisAlerts:
@kbduvallMay 27.2012 — When it comes to security, it's rarely a good idea to "re-invent the wheel". PHP has some pretty good filtering functions. I would definitely check them out as they will be more secure than your custom functions.
Copy linkTweet thisAlerts:
@NogDogMay 27.2012 — If your aim in this case is to remove all non-alpha characters:
[code=php]
return preg_replace('/[^a-zA-Z]/', '', $str);
[/code]

However, in most cases it's better to simply validate that the field contains the correct type of data and if not return an error to the user, rather than assume you know what they meant to type in and silently change it without the user being given a chance to correct it (see the aforementioned ctype_alpha() in this case).
Copy linkTweet thisAlerts:
@VBAssassinMay 28.2012 — Ok, you "shouldn't" do this, since you shouldn't ever change the original raw data and you "should" store the raw data in the database as well.

That asside... i would rather use a "whitelist" instead of a "blacklist".

If you escape the data when you need to, you can often forget! However, if you have to unescape the data instead when you need to (rarely), the errors of not doing so when you forget are usually much much less! This is why i tend to:

  • 1. Iterate over the $_POST, $_GET, $_REQUEST, $_COOKIE, etc super globals (remember some may be multi dimention arrays if the forms name='dsdsa[]')

  • 2. Run htmlentities(..., ENT_QUOTES) followed by mysql_real_escape_string(). Make sure mysql escaping is AFTER htmlentities else you will suffer from double slashes!

  • 3. The data can now be safely shown on site OR used in the database! No need to remember to escape anything, instead, you just need to unescape it (reverse the order) on the few occassions that you need to (such as using variables in URLs). Also, data can instantly be shown from the database without needing to escape it first (because htmlentities was already run on it) to prevent attacks such as XSS.


    • Hope that helps.

    Kind regards,

    Scott

    P.S. If showing the data in URL's onsite you will need to unescape it, then use rawurlencode() instead.
    ×

    Success!

    Help @PlecPicker spread the word by sharing this article on Twitter...

    Tweet This
    Sign in
    Forgot password?
    Sign in with TwitchSign in with GithubCreate Account
    about: ({
    version: 0.1.9 — BETA 5.5,
    whats_new: community page,
    up_next: more Davinci•003 tasks,
    coming_soon: events calendar,
    social: @webDeveloperHQ
    });

    legal: ({
    terms: of use,
    privacy: policy
    });
    changelog: (
    version: 0.1.9,
    notes: added community page

    version: 0.1.8,
    notes: added Davinci•003

    version: 0.1.7,
    notes: upvote answers to bounties

    version: 0.1.6,
    notes: article editor refresh
    )...
    recent_tips: (
    tipper: @Yussuf4331,
    tipped: article
    amount: 1000 SATS,

    tipper: @darkwebsites540,
    tipped: article
    amount: 10 SATS,

    tipper: @Samric24,
    tipped: article
    amount: 1000 SATS,
    )...