Jump to content

Beta test my script!

adamlacombe

By adamlacombe
in Beta Test Your Stuff!

 Share

Recommended Posts

  • Replies 75
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

ok but im still getting the warnings.

The function looks like this:

define("PARANOID", 1);
define("SQL", 2);
define("SYSTEM", 4);
define("HTML", ;
define("INT", 16);
define("FLOAT", 32);
define("LDAP", 64);
define("UTF8", 128);

// internal function for utf8 decoding
// thanks to Jamie Pratt for noticing that PHP's function is a little 
// screwy
function my_utf8_decode($string)
{
return strtr($string, 
  "???????¥µÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýÿ", 
  "SOZsozYYuAAAAAAACEEEEIIIIDNOOOOOOUUUUYsaaaaaaaceeeeiiiionoooooouuuuyy");
}

// paranoid sanitization -- only let the alphanumeric set through
function sanitize_paranoid_string($string, $min='', $max='')
{
  $string = preg_replace("/[^a-zA-Z0-9]/", "", $string);
  $len = strlen($string);
  if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
    return FALSE;
  return $string;
}

// sanitize a string in prep for passing a single argument to system() (or similar)
function sanitize_system_string($string, $min='', $max='')
{
  $pattern = '/(;|\||`|>|<|&|^|"|'."\n|\r|'".'|{|}|[|]|\)|\()/i'; // no piping, passing possible environment variables ($),
                           // seperate commands, nested execution, file redirection, 
                           // background processing, special commands (backspace, etc.), quotes
                           // newlines, or some other special characters
  $string = preg_replace($pattern, '', $string);
  $string = '"'.preg_replace('/\$/', '\\\$', $string).'"'; //make sure this is only interpretted as ONE argument
  $len = strlen($string);
  if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
    return FALSE;
  return $string;
}

// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_sql_string($string, $min='', $max='')
{
  $pattern[0] = '/(\\\\)/';
  $pattern[1] = "/\"/";
  $pattern[2] = "/'/";
  $replacement[0] = '\\\\\\';
  $replacement[1] = '\"';
  $replacement[2] = "\\'";
  $len = strlen($string);
  if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
    return FALSE;
  return preg_replace($pattern, $replacement, $string);
}

// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_ldap_string($string, $min='', $max='')
{
  $pattern = '/(\)|\(|\||&)/';
  $len = strlen($string);
  if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
    return FALSE;
  return preg_replace($pattern, '', $string);
}


// sanitize a string for HTML (make sure nothing gets interpretted!)
function sanitize_html_string($string)
{
  $pattern[0] = '/\&/';
  $pattern[1] = '/</';
  $pattern[2] = "/>/";
  $pattern[3] = '/\n/';
  $pattern[4] = '/"/';
  $pattern[5] = "/'/";
  $pattern[6] = "/%/";
  $pattern[7] = '/\(/';
  $pattern[8] = '/\)/';
  $pattern[9] = '/\+/';
  $pattern[10] = '/-/';
  $replacement[0] = '&';
  $replacement[1] = '<';
  $replacement[2] = '>';
  $replacement[3] = '<br>';
  $replacement[4] = '"';
  $replacement[5] = '&#39;';
  $replacement[6] = '&#37;';
  $replacement[7] = '&#40;';
  $replacement[8] = '&#41;';
  $replacement[9] = '&#43;';
  $replacement[10] = '&#45;';
  return preg_replace($pattern, $replacement, $string);
}

// make int int!
function sanitize_int($integer, $min='', $max='')
{
  $int = intval($integer);
  if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
    return FALSE;
  return $int;
}

// make float float!
function sanitize_float($float, $min='', $max='')
{
  $float = floatval($float);
  if((($min != '') && ($float < $min)) || (($max != '') && ($float > $max)))
    return FALSE;
  return $float;
}

// glue together all the other functions
function sanitize($input, $flags, $min='', $max='')
{
  if($flags & UTF8) $input = my_utf8_decode($input);
  if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
  if($flags & INT) $input = sanitize_int($input, $min, $max);
  if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
  if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
  if($flags & SQL) $input = sanitize_sql_string($input, $min, $max);
  if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
  if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max);
  return $input;
}

line 146 is:

function sanitize($input, $flags, $min='', $max='')

and the warnings are:

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 24 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 25 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 26 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 27 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 28 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 29 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 30 and defined in /home/media/test/includes/db.php on line 146

Warning: Missing argument 2 for sanitize(), called in /home/media/test/pages/user/profilecp.php on line 31 and defined in /home/media/test/includes/db.php on line 146

 

does it have to do with the $min='', $max='' ?

if so what do I put for min= and max=?

 

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

ok so I have this:

<?
if($_POST[update]){

	$first_name=clean_up($_POST['first']);
	$last_name=clean_up($_POST['last']);
	$about=clean_up($_POST['about']);
	$email=clean_up($_POST['email']);
	$myspace=clean_up($_POST['myspace']);
	$aim=clean_up($_POST['aim']);
	$yim=clean_up($_POST['yim']);
	$location=clean_up($_POST['location']);

	$sql3 ="UPDATE `users` SET `myspace`='$myspace',`aim`='$aim',`yim`='$yim',`first`='$first_name',`last`='$last_name',`email`='$email',`about`='$about', `location`='$location' WHERE `id`='".$_SESSION['id']."'";
	$res3 = mysql_query($sql3) or die(mysql_error());


echo "<div class='done'>Your profile has been successfully updated!</div><br />";
}


$sql="SELECT * from `users` WHERE `id`='".$_SESSION['id']."'";
$res=mysql_query($sql);
$row=mysql_fetch_assoc($res);
	$first=$row[first];
	$last=$row[last];
	$email=$row[email];
	$location=$row[location];
	$aim=$row[aim];
	$yim=$row[yim];
	$myspace=$row[myspace];
	$about=$row[about];

echo '
<form action="user.php?action=profilecp" method="post">
<div class="header">Profile Control Panel</div><br />
<div class="content">

First Name:<br />
<input class="tarea" id="first" type="text" name="first" maxlength="32" value="'.sanitize($first).'">
<br />

Last Name:<br />
<input class="tarea" id="last" type="text" name="last" maxlength="32" value="'.sanitize($last).'">
<br />

Email:<br />
<input class="tarea" id="email" type="text" name="email" maxlength="255" value="'.sanitize($email).'">
<br />

Location:<br />
<input class="tarea" id="location" type="text" name="location" maxlength="255" value="'.sanitize($location).'">
<br />

Aim:<br />
<input class="tarea" id="aim" type="text" name="aim" maxlength="255" value="'.sanitize($aim).'">
<br />

Yim:<br />
<input class="tarea" id="yim" type="text" name="yim" maxlength="255" value="'.sanitize($yim).'">
<br />

Myspace:<br />
<input class="tarea" id="myspace" type="text" name="myspace" maxlength="255" value="'.sanitize($myspace).'">
<br />

About:<br />
<textarea class="tarea" id="about" cols="40" rows="6" name="about">'.sanitize($about).'</textarea>
<br />

<input type="submit" name="update" value="Update">
</form>
</div>';
?>

 

but I still got the warnings....  :wtf:

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

oh ok.

omfg I hate A.D.D. but bc I have it let me just make sure I got all this right lol,

Only use the clean_up function and I should use it when im echoing stuff and also when ever im inserting/updating, correct?

 

And that should secure everything?

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

also this is a very low threat i found CSRF wise but when you send your variables in your urls like foo=foobar  might wanna encode them :shy:

 

check into urlencode()

I'm not all there as you must have already noticed lol but you're saying I need to put urlencode() around $_GET's that are being inserted into the database?

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

but does that mean just the $_GET's? or is there more, like say you have this:

<?php
$sql=mysql_query("SELECT * FROM atable");
while($row=mysql_fetch_array($sql)){
$id=clean_up($row[id]);
echo "$id";
}
?>

then should you have it:

<?php
$sql=mysql_query("SELECT * FROM atable");
while($row=mysql_fetch_array($sql)){
$id=clean_up(urlencode($row[id]));
echo "$id";
}
?>

?

 

God I hate being such a newb  :facewall:

adamlacombe Member

adamlacombe

Posted
  • Author
Posted

Got a question though, you seem to be a great PHP expert and im sort of just learning most of the built in functions so, if I have something along the lines of this:

<?php
$id=clean_up($_GET['id']);
$id = abs((int) ($id));
?>

 

Do I need to use a numeric_only()

 

<?php
$id=clean_up(numeric_only($_GET['id']));
$id = abs((int) ($id));
?>

 

 

numeric_only() only being this function:

<?php
function numeric_only($string){
$string=preg_replace("/[^0-9]/","",$string);
return $string;
}
?>

 

Thanks!

 Share
Go to topic listing
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.