Php security issue

Question

It has been a long day, but I cannot choose in my head which is better, or I must use both.

Basically, what should I use to disinfect user-entered values. Is it either htmlentities or the preg_match function?

I will then if the value goes into the sql query using the mysql_real_escape_string function, but only until I change it to a prepared statement, then I can delete it.

Or would it be nice to use both htmlentities and preg_match?

Answer 1

Why didn't you ask about this in your previous question ?

Use preg_match before doing any escaping so that the data matches the whitelist of what you expect from it. Then use escape to insert the database. This is called deep defense (that is, more than one level of security verification if an attacker can break through the first level).

Answer 2

If you are using PHP 5.2+, you should learn the Filter functions to sanitize your data.

http://php.net/manual/en/filter.examples.sanitization.php

Answer 3

It is better to have too many inspection checks and sanitation procedures than too few. The system is no more or less secure, adding redundancy. Ether is its vulnerability or not, its logical not Float. When I check the code and see redundant security measures, I think this is a red flag, and it encourages me to dig deeper. This programmer is paranoid and perhaps they do not understand the nature of vulnerabilities, although this is not always the case.

There is one more problem. htmlentities () does not always stop xss, for example, what if the output is in the <script></script> or even in href? mysql_real_escape_string does not always stop SQL injection, what if: 'select * from user where id='.mysql_real_escape_string($_GET[id]); . preg_match can fix this problem, but intval () is a much better function to use in this case.

I am a HUGE fan of prepared statements. I think this is a great approach, because by default it is safe, but it passes the mysql_real_escape_string () variable before the ready statement just messes up the data. I saw a beginner fix this problem by deleting all the verification procedures, thereby introducing a vulnerability due to redundancy. Cause and investigation.

Web Application Firewalls (WAFs) are a great example of how layers can enhance security. WAFs are heavily dependent on regular expressions. They try to look at the big picture and prevent unpleasant input, or at least register it. They are by no means a silver bullet and should not be the only security measure you use, but they really stop some of the exploits, and I recommend installing mod_security on production machines.

Answer 4

Basically, what should I use to disinfect user-entered values. Is it either htmlentities or the preg_match function?

Of course, not htmlentities, maybe not preg_match either (for security purposes). You change the presentation of any output to the media on which it is collected (htmlentites fora web page, urlencode for URL, mysql_real_escape_string for mysql database ....).

If someone really wants to register in your application as a fictitious' UNION SELECT 'dummy' user AS, 'dummy' password AS FROM DUAL , then let them!

Writing code to isolate it from attacks is much more effective than trying to detect different types of attacks in advance.

Some data entry may correspond to a specific format for its use - and there may be a delay between data capture and data use - for example, if the user is prompted for an email address or date - in this case, preg_match may be appropriate. But this is not about security.

FROM.