41

I have a form with a lot of variables which is then sending an email, rather than sanitizing each $_POST value with filter_var($_POST['var'], FILTER_SANITIZE_STRING); I was after a more simple piece of code. I came up with the below, which seems to work as I believe the default action is FILTER_SANITIZE_STRING, but I was just wondering what peoples opinions are, and if this is not good practice, perhaps you could tell me why? The $_POST values are then individually embedded into new variables, so I would only be using array_map just at the start to sanitize everything...

$_POST = array_map('filter_var', $_POST);

Thank you for your replies, to give you a little more information, basically:

I have 20-30 input fields in a form which are being captured, the data is then displayed to the user to check their input, variables are then sanitized, the user is then sent an email and then finally the details are entered into a db.

currently I am sanitizing using the above array_map function, as well as FILTER_SANITIZE_EMAIL on the email address before sending an email and then escaping the input using mysql_real_escape_string() before the insert into the db. Without getting into prepared statements etc.. do you think I should be doing anything additionally? thanks again!

SirG
  • 411
  • 1
  • 4
  • 4
  • To sanitize string, here is an useful function - http://stackoverflow.com/questions/3126072/what-are-the-best-php-input-sanitizing-functions/20403438#20403438 – T.Todua Sep 23 '14 at 13:14
  • possible duplicate of [PHP -Sanitize values of a array](http://stackoverflow.com/questions/4861053/php-sanitize-values-of-a-array) – feeela Oct 23 '14 at 10:17
  • @feela This question is specific to POST and GET - not arrays in general – Oscar Chambers May 01 '21 at 22:17

5 Answers5

88

If the type of each of your input variables is a string and you want to sanitize them all at once, you can use:

// prevent XSS
$_GET   = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);
$_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

This will sanitize your $_GET and $_POST arrays.

Seen here: PHP -Sanitize values of a array

Community
  • 1
  • 1
johnny.rodgers
  • 1,259
  • 1
  • 11
  • 12
21

Depends what its being used for.

If you are inserting it into the database then mysql_real_escape_string() for quoted strings and type casting for numbers would be the way to go - well ideally prepared statements, but thats an entirely different matter.

If you plan on outputting the data onto the webpage then I would recommend something like htmlspecialchars()

If you plan on using the user input as a shell argument, then you would use escapeshellarg()

Moving onto your question about sending emails. Well, the following should suffice:

filter_var($_POST['message'], FILTER_SANITIZE_STRING);

All this does is basically strip tags and encode special characters.

Your Common Sense
  • 152,517
  • 33
  • 193
  • 313
Russell Dias
  • 63,102
  • 5
  • 46
  • 71
  • 1
    Good answer. I'll just add that if you're going to allow user-input to your webpage, consider using strip_tags() to prevent people from throwing in – Andrioid Sep 05 '10 at 05:50
  • 1
    If you are using PHP 7 or higher, the `mysql_real_escape_string()` function has been removed. Use PDO instead. (Posting this for new visitors to the question.) – Kenny Johnson Jun 30 '16 at 03:05
5

There is no correct way to do blanket sanitation. What sanitation method you need depends on what is done to the data.

Sanitize the data directly before it is used.

Pekka
  • 418,526
  • 129
  • 929
  • 1,058
  • 1
    thanks,i realise this, I am just trying to achieve this without writing lots of repetitive code... – SirG Sep 06 '10 at 10:27
  • @SirG: by al means validate input, but you should only ever apply sanitization transformations to data when it **leaves** PHP - and the method should be appropriate to where the data is going (mysql_real_escape_string(), htmlentities(), urlencode(), base64)_encode(), escapeshellarg(), addslashes()....etc all do **different** things) – symcbean Sep 06 '10 at 11:26
  • @symcbean, thanks for the answer, so would filter_var be suitable to apply just before sending an email via php's mail function ? cheers. – SirG Sep 12 '10 at 11:08
  • Maybe - you can validate an email address with filter_var - but you can't validate the body of an email, subject or additional headers. The MTA should take care of the former but the latter 2 are both targets for header injection which can compromise your application. – symcbean Sep 13 '10 at 10:49
2

This is what I use in all my projects:

function util_array_trim(array &$array, $filter = false)
{
    array_walk_recursive($array, function (&$value) use ($filter) {
        $value = trim($value);
        if ($filter) {
            $value = filter_var($value, FILTER_SANITIZE_STRING);
        }
    });

    return $array;
}

It allows to trim and sanitize a nested array of posted data

ymakux
  • 2,859
  • 1
  • 30
  • 37
1

To apply specific filters on multiple fields, use a switch statement.

$post  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

foreach($post as $k => $v) {
    switch ($k) {
        case 'int_1':
        case 'int_2':
            $post[$k] = filter_var($v, FILTER_SANITIZE_NUMBER_INT) * 1;
            break;
        case 'float_1':
        case 'float_2':
            $post[$k] = filter_var($v, FILTER_SANITIZE_NUMBER_FLOAT, FILTER_FLAG_ALLOW_FRACTION) * 1;
            break;
        default:
            break;
    }
}

Note: My IDE (NetBeans) warns about using global $_POST anywhere as a security violation, so I've just gotten into the habit of using a local $post variable instead. If you choose not to do the blanket string sanitation first, FILTER_SANITIZE_STRING could be used for the default: case.

OXiGEN
  • 995
  • 13
  • 13