PHP/MySQL: Filtering POST & GET Data

Question

Possible Duplicate:
What are the best PHP input sanitizing functions?

A while back I found this, what I thought to be great, snippet in someones code to filter POST and GET data from injections.

function filter($data) { //Filters data against security risks.
    $data = trim(htmlentities(strip_tags($data)));
    if(get_magic_quotes_gpc()) $data = stripslashes($data);
    $data = mysql_real_escape_string($data);
    return $data;
}
foreach($_GET as $key => $value) $filterGet[$key] = filter($value);
foreach($_POST as $key => $value) $filterPost[$key] = filter($value);

And I've been using it ever since. But today, while sending an array through ajax I got tons of errors. Most of them say strip_tags() expects parameter 1 to be string, array given in...

What the best way to filter data? All this data is going to a database. But what about cases where it isn't going to a database?

What is not clear in the error message? – itachi Dec 12 '12 at 07:36 — itachi, Dec 12 '12 at 07:36

score 3 · Accepted Answer · answered Dec 12 '12 at 07:51

3

Here is the function you need:

function filter($data) { //Filters data against security risks.
    if (is_array($data)) {
        foreach ($data as $key => $element) {
            $data[$key] = filter($element);
        }
    } else {
        $data = trim(htmlentities(strip_tags($data)));
        if(get_magic_quotes_gpc()) $data = stripslashes($data);
        $data = mysql_real_escape_string($data);
    }
    return $data;
}

answered Dec 12 '12 at 07:51

Carlos

4,949
2
20
37

Also a great way to solve it. – Tyler Hughes Dec 12 '12 at 07:55
You're right, you're will also filter and multidimensional array. I'll have to change correct answer to you. This is better. – Tyler Hughes Dec 12 '12 at 08:09

score 1 · Answer 2 · answered Dec 12 '12 at 07:41

1

As clear by the error message, this is happening for cases where an array is passed via GET/POST. You can parse each value of the array for such cases.

foreach($_GET as $key => $value){
   if(is_array($value)){
       foreach($value as $val){
           $filterGet[$key][] = filter($val);
       }
   }
   else{
         $filterGet[$key] = filter($value);
   }
}

answered Dec 12 '12 at 07:41

Karan Punamiya

8,603
1
26
26

What if multidimensional array? It will throw the same error! – Carlos Dec 12 '12 at 07:58
@jackflash The code Karan provided supports multidimensional arrays. – Andrew Dec 12 '12 at 08:19
@AndrewSpear Nope. That code is not recursive at all, so it can't handle multiple nested arrays. – Carlos Dec 12 '12 at 09:49
@jackflash My misread "foreach" and "filter" as "function"! You want all of that wrapped in a function and call it recursively instead of doing the second foreach(). – Andrew Dec 14 '12 at 01:59
@jackflash Which is pretty much what your solution does, well done! – Andrew Dec 14 '12 at 02:05

score 0 · Answer 3 · answered Dec 12 '12 at 07:43

What you should do is first check to see if $data is the correct format that you need it to be in. What you describe is that an array was passed into the $data parameter of your function, and PHP needs you to break it down into a string. Some extra logic is needed such as:

function filter($data) {
    if(is_array($data)) {
        foreach($data as $key => $value) {
            // Do stuff...
        }
    } else {
        // Do stuff...
    }
}

score 0 · Answer 4 · answered Dec 12 '12 at 07:47

0

You should check if the input is array. If so, loop it and strip tags for every array member, if not, then just strip tags for the input.

answered Dec 12 '12 at 07:47

Glorious Kale

1,273
15
25

score 0 · Answer 5 · answered Dec 12 '12 at 07:54

you can use array_walk

<?php
function wsafe(&$value,$key)
{
    return safe($value);
}
function safe($value)
{
    if(is_array($value))
    {
        foreach($value as $key=>$val)
        {
            $value[safe($key)] = safe($val);
        }
    }
    else
    {
        $value = trim(htmlentities(strip_tags($value)));
        if(get_magic_quotes_gpc()) $value = stripslashes($value);
        $value = mysql_real_escape_string($value);
    }
}
array_walk($_POST,'wsafe');
array_walk($_GET,'wsafe');

PHP/MySQL: Filtering POST & GET Data

5 Answers5