php input security

Question

Possible Duplicate:
PHP: the ultimate clean/secure function

I have got this code when I insert a user:

  function RegisterUser($userName, $pass, $email, $reputation, $role, $ban, $date, $ip, $numberAttempts, avatar)//'anonym', 'false',  $myDate,$ip, 0, ''
  {
     $userName= SanitizeString($userName);
     $pass= SanitizeString($pass);
     $email= SanitizeString($email);

      $userName=mysql_real_escape_string($userName);
      $pass=mysql_real_escape_string($pass);
      $email=mysql_real_escape_string($email);

The sanitize function is the following:

   function SanitizeString($var)
   {
       //$var=stripslashes($var);
       $var=htmlentities($var, ENT_QUOTES, 'UTF-8');
       $var=strip_tags($var);
       return $var;
   }

Am I doint the right way to protect myself against a malicious attack (Xss attack, javascript attack, sql injection)..

although unrelated, functions in php conventionally begin with a lowercase letter, e.g. `sanitizeString` — Pranav Hosangadi, Nov 06 '11 at 08:11
htmlentities() and strip_tags() are redundant, strip_tags() will never have a tag to strip. Passwords shouldn't be sanitized, a hash function is much a stronger from of input validation than an escape function. — rook, Nov 06 '11 at 08:13
@Rook bingo!! In any case, if you just HAVE to use striptags, you'll need to do it before htmlentities otherwise there will never be a tag to strip (like you said) — Pranav Hosangadi, Nov 06 '11 at 08:16

score 0 · Accepted Answer · edited May 23 '17 at 10:24

Am I doint the right way to protect myself against a malicious attack

Definitely NO.

Protection is not something like using one magic method to make all attacks disappear in a puff of smoke.
You need different scenarios for different attacks. A condoms commonly used for safety. Would you secure your money with a condom? I suppose - no.
Same here.

Also, mindless mixing protection techniques will spoil your data.
For example, if your admin has the ability to post HTML from some onlain editor, this SanitizeString will make it impossible.

In fact, your function is trying to protect only from XSS and obviously wrong way.
For the other attacks you need other things. SQL injection protection I described in this answer.

well, I do that security check for email and user name only – WithFlyingColors Nov 06 '11 at 08:31 — WithFlyingColors, Nov 06 '11 at 08:31

php input security

1 Answers1