Sanitize Database Inputs

<?php
function cleanInput($input) {

  $search = array(
    '@<script[^>]*?>.*?</script>@si',   // Strip out javascript
    '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
    '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
    '@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments
  );

    $output = preg_replace($search, '', $input);
    return $output;
  }
?>

<?php
function sanitize($input) {
    if (is_array($input)) {
        foreach($input as $var=>$val) {
            $output[$var] = sanitize($val);
        }
    }
    else {
        if (get_magic_quotes_gpc()) {
            $input = stripslashes($input);
        }
        $input  = cleanInput($input);
        $output = mysql_real_escape_string($input);
    }
    return $output;
}
?>

<?php
  $bad_string = "Hi! <script src='http://www.evilsite.com/bad_script.js'></script> It's a good day!";
  $good_string = sanitize($bad_string);
  // $good_string returns "Hi! It\'s a good day!"

  // Also use for getting POST/GET variables
  $_POST = sanitize($_POST);
  $_GET  = sanitize($_GET);
?>

10 Responses

1. iMaxEst says:

   03/03/2010 at 9:01 am

   I use my own functions as follow:

   function text_global($poster) {
     $poster = stripslashes($poster);
     $poster = str_replace(Array("\n", "'", "‘", "’", "′", "“", "”", "„", "″", '"'), Array("", "’", "’", "’", "’", """, """, """, """, """), $poster);
       return $poster;
   }
   
   while (list($Key, $Val) = each($_POST)) {
    if (substr($Key, 0, 4) != "fsk_") {
     if (is_array($Val) === true) {
      while (list($sKey, $sVal) = each($Val)) {
       $Val[$sKey] = text_global($sVal);
      }
      $_POST[$Key] = $Val;
     } else {
      $_POST[$Key] = text_global($Val);
     }
    }
   }

   Where “fsk_” prefix is used for WYSIWYG editor variables. Works perfectly.

   Reply
   • OldGuy says:

     03/03/2010 at 4:04 pm

     @iMaxEst: I think you may have missed the point here. Preparing data is just a side issue. Sanitizing data prevents code injection attacks.

     stripslashes() != sanitize()

     Reply
2. Laura says:

   03/04/2010 at 5:46 am

   Really nice functions Chris! Neat way using regular Expressions these snippets will definetly find there way to my library script.

   Thanks a bunch!

   Reply
3. Henk says:

   03/05/2010 at 8:03 am

   Why to clean the input from html/script tags?
   You only have to worry about XSS when you prepare the output!

   Protect your database through prepared statements and htmlspecialchars() will care about the output.

   Reply
4. jeff says:

   03/08/2010 at 8:30 am

   It seems like a good idea to clean input. Why do I want to store potentially malignant code in my database?

   Reply
5. Phil says:

   03/15/2010 at 11:08 pm

   What about ASP ? anyone..

   Reply
6. Brian Lang says:

   03/19/2010 at 8:19 am

   These code snippets don’t come through very nicely via RSS. All the line breaks seem to disappear.

   Reply
7. amm257 says:

   03/31/2010 at 11:47 am

   These are nigh useless and overly complicated; e.g. the html one simply matches anything with “<", so why not make that explicit? Currently that's all that expression does, all this extra stuff merely serves to obfuscate the issue. E.g. the javascript one doesn't work, all I have to do is add a space: "scripthere”, the browser will figure out what I meant, and the script will execute.

   Reply
   • amm257 says:

     03/31/2010 at 11:49 am

     I apologize, whoever wrote this filter did it both right and wrong (wrong because they simply remove it, instead of escaping it, right because it catches it), I’ve cleaned it up with characters escaped by hand, this should work:

     These are nigh useless and overly complicated; e.g. the html one simply matches anything with “<”, so why not make that explicit? Currently that’s all that expression does, all this extra stuff merely serves to obfuscate the issue. E.g. the javascript one doesn’t work, all I have to do is add a space: “< script>scripthere</script>”, the browser will figure out what I meant, and the script will execute.

     Reply
8. gibigbig says:

   06/13/2010 at 9:16 pm

   Mines is pretty small and handy for getting rid of nasty hacking injections

   function clean($text)
   {
   	$text = strip_tags($text);
   	$text = htmlspecialchars($text, ENT_QUOTES);
   
       return ($text); //output clean text
   }

   Reply