6

First of all I should remind you that I have read this post and few other posts about my question but most of all are almost old and they are for about 3 years ago.

Now I'm using CodeIgniter 3 and I want to know what's the best sanitize filter for my data which I'm retrieving them from users before insert into database.

This is for my website to register and and I don't know what kind of user is registering and I can't trust them. And it is possible that it will be dangerous I want to sanitize all input before inserting it into database I don't know input class enough for sanitizing it ?
Please tell me the codeigniter sanitizing functions !

I have read security classs in codeigniter document, but I want to be sure.

Community
  • 1
  • 1
SoheilYou
  • 907
  • 5
  • 23
  • 43

2 Answers2

10

According to the Docs, the input class, does the following:

  • Filters the GET/POST/COOKIE array keys, permitting only alpha-numeric (and a few other) characters.
  • Provides XSS (Cross-site Scripting Hacks) filtering. This can be enabled globally, or upon request.
  • and some other processing, but for security, this is enough.

So, this solves the issue of SQL injection and XSS. For most usages, this is enough.

To enable XSS protection, use:

$val = $this->input->post('some_data', TRUE); // last param enables XSS protection.

Also, you may want to look into CSRF protection. But that's a bit tricky to enable if you're doing ajax calls.

Alex Tartan
  • 6,736
  • 10
  • 34
  • 45
  • I am using ajax , I want to upload file ajax .is it incurrect ? – SoheilYou Oct 29 '15 at 16:29
  • Of course it's not. But if you would have enabled `CSRF`, you would have had a lot of issues getting it to work. Personally, on all of my CI projects, I used `$this->input->post` without regret (so far). And haven't ran into any security breaches – Alex Tartan Oct 29 '15 at 16:35
  • It is not very difficult to get AJAX to work with CSRF enabled. The minor steps required are easy to implement and well worth the piece of mind. – DFriend Oct 30 '15 at 03:01
  • 1
    You better check again. CI3 manual says GLOBAL_XSS_FILTERING is deprecated and xss_filtering should be use to output, not input. – Marcelo Agimóvel May 26 '17 at 14:25
  • 2
    Comments like "try to start new projects in a real framework, such as Zend, Laravel, etc" are completely inappropriate on StackOverflow. Please familiarize yourself with the community guidelines. – tpartee Oct 18 '19 at 20:53
  • The Docs Link is Broken; Please reference [link](https://codeigniter.com/userguide3/general/security.html#best-practices) instead. – Elte156 Apr 19 '20 at 17:39
2

Before accepting any data into your application, whether it be POST data from a form submission,URI data,you must follow these step:

  1. Filter the data.
  2. Validate the data to ensure it conforms to the correct type, length, size, etc. (sometimes this step can replace step one)
  3. Escape the data before submitting it into your database. CodeIgniter provides the following functions to assist in this process:

XSS Filtering

This filter looks for commonly used techniques to embed malicious JavaScript into your data

To filter data through the XSS filter use the xss_clean() method: Read More

Validate the data

CodeIgniter has a Form Validation Library that assists you in validating, filtering, and prepping your data

$this->form_validation->set_rules('username', 'Username','trim|required|min_length[5]|max_length[12]');

trimming the fields, checking for length where necessary and making sure that both password fields match. Read more

Escape all data before database insertion

Never insert information into your database without escaping it.

Refer query builder class for more info https://www.codeigniter.com/userguide3/database/query_builder.html

More info

Codeigniter does not make your application secyre see this https://security.stackexchange.com/questions/97845/how-secure-is-codeigniter-3-x

Everything really depends on the developer.frameworks will only provide a structure to build your applications.You will be more secure if you write core php.

Further Links:

How do you use bcrypt for hashing passwords in PHP?

Are PDO prepared statements sufficient to prevent SQL injection?

Community
  • 1
  • 1
Linus
  • 899
  • 3
  • 19
  • 33
  • 2
    Comments like "You will be more secure if you write core php." are opinions and not really welcome in answers. Further, you have broken links in your answer, might want to fix those. – tpartee Oct 18 '19 at 20:55