Cleaning web form input....

[trg86]

Okay, I would like your opinion. I am in the process of rewriting my web form processor and I wanted to ask if this line of code is sufficient for making sure the input is clean. ( i.e. cutting any malicious attempt from a user filling out the form ) Please keep in mind that the form data is only sent in an email, no MySQL database involved.

 

This is an example of code of just one of the inputs from the form, so you have a reference of what I programmed and asking about. Thanks!

 

$name =  stripslashes(trim($_POST['name']));

Edited March 27, 2014 by trg86

[ginerjm]

Why are you stripping slashes on an input?  The only reason to have them on input is if your server still has magic_quotes on - which it shouldn't.

[trg86]

It appears as if I am misinformed about the use of stripslashes, thank you for the feedback.

 

What would you reccommend to clean the inputs of any malicious data? I only have it sending in an email, no database or anything.

[ginerjm]

stripslashes does have a purpose, but it is not necessarily for handling user input, unless you have magic quotes on.  One thing that can be used on input is addslashes or one of the *_real_escape_string functions, if you are not use pdo, or many of the functions to strip html tags, and validate input.

 

You'll get an authoritative discourse shortly from one of the wizards on the forum soon I'll bet.

[Andy-H]

Filtering user input requires different implementations depending on what you will be doing with the data, i.e. if you're writing data to a persistence layer, you should use methods appropriate to the persistence layer and abstraction layer that you're using, a few examples:

 

PDO:

// create database handle
$stmt = $dbh->prepare('SELECT * FROM users WHERE username = ? LIMIT 1');
$stmt->execute(array($_POST['username'])); // we don't need to escape here as PDO prepared statements escape parameters for us

 

mysql_* (which is deprecated, and will be moved into an extension, use PDO or MySQLi or something)

// connect to database
$result = mysql_query("SELECT * FROM users WHERE username = '". mysql_real_escape_string($_POST['username']) ."' LIMIT 1");

 

HTML

<?= echo htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8'); ?>
<?= echo htmlentities($_POST['username'], ENT_QUOTES, 'UTF-8'); // replace with your character encoding ?>

FYI: I would recomment htmlentities here as it translates all entities

 

For a plain-text email, you won't need to escape your data, for a HTML email, you would escape it the same as you escape HTML output

Edited March 27, 2014 by Andy-H

[trg86]

I do have it programmed as an HTML email. Would I make the htmlentities the same encoding as the php file itself or the same encoding at the html email that is being created?

 

$name =  htmlentities($_POST['name'], ENT_QUOTES, 'UTF-8');

 

That is now how I have it set, to clean the input data. UTF-8 is the encoding of the document itself.

Edited March 27, 2014 by trg86

[.josh]

If you really have no intention of storing it in a database or flatfile, and really are just going to send an email and forget about it, then you don't really need to filter or otherwise scrub the input for malicious code.

 

However, unless you want the spambots to start using your form as a proxy to send out spam, I highly recommend you scrub the input of spammy type content.

[trg86]

Another quick question. I do eventually plan on having the data sent to a database as well, but also still e-mailing as well. I know I need to clean the data before it is sent to the database and I have it cleaning the data for the email as well. Below is a snippet of code from one of the fields, I wanted to make sure I can do it the way that I am in this line. i.e. 'mysql_real_ecape_string' and 'html_entities' on the same line like this. Let me know if it is incorrect.

 

$name =  mysql_real_escape_string, htmlentities($_POST['name'], ENT_QUOTES, 'UTF-8');

[trg86]

Any insight? Thanks!

[ginerjm]

Not on the philosophy, but on the syntax.  You name one function then followed by a comma and then a (correct) function call.  You might want to re-think your typing there.

[darkfreaks]

might be easier to use a framework for that like PHPmailer

 

make sure you format your headers right to avoid spam filters.

Edited March 28, 2014 by darkfreaks