0

I just wanted to ask if this is a secure way to let a user choose his username(user can use every digit):

if($_POST['username'] != "") {
    $username = trim($_POST['username']);
    $username = filter_var($username, FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW);
}

After this snippet I use PDO (prepared statement) to insert data in database.

You think this is secure enough or did I forget some important points?

Brian Tompsett - 汤莱恩
  • 5,753
  • 72
  • 57
  • 129
user3297073
  • 129
  • 1
  • 12

2 Answers2

1

According to PHP Documentation - Filter flags:

FILTER_FLAG_STRIP_LOW Strips characters that has a numerical value <32

This option is good for username validation, however, for preventing SQL injection attack, you should use parametrized prepared statement (using placeholders) for more information please refer to this tutorial: https://stackoverflow.com/tags/pdo/info and How can I prevent SQL injection in PHP?

Because without using placeholders, even if you use prepared statement, userinput data will not be escaped by server.

Community
  • 1
  • 1
Jason OOO
  • 3,567
  • 2
  • 25
  • 31
0
$username = addslashes($_POST['username']);

Maybe an idea to search for some info about SQL injections.

Companjo
  • 1,789
  • 18
  • 24
  • Yes it is safe enough. – Companjo Apr 06 '14 at 21:46
  • In many cases, calling `mysqli_escape_string` after sanitizing a variable is more than enough. Also, try and use a prepared statement or PDO instead of passing a variable directly into a query string. – Basit Apr 06 '14 at 21:47
  • is there any possibitity to put sanitize function in public_function, so the returned value can be 1 or 0 ? – user3297073 Apr 06 '14 at 21:54