Posts: 2,339
Name: Keith Marshall
Location: West Hartford, CT
|
Here is (hopefully) a helpful resource to give you some basic cleaning tools for your users input. This type of input cleaning forces the input into specific types. Would be best to used written in functions, and also allow the recursive cleaning within arrays.
PHP Code:
<?php
// Signed Integer
// Can be any whole number pos or neg
$int = intval($_REQUEST['int']);
// Unsigned Integer
// Can be any whole number pos only
$uint = ($uint = intval($_REQUEST['uint'])) < 0 ? 0 : $uint;
// Signed Floating Number
// Can be any floating (decimal) number pos or neg
$float = floatval($_REQUEST['float']);
// Unsigned Floating Number
// Can be any floating (decimal) number pos only
$ufloat = ($ufloat = intval($_REQUEST['ufloat'])) < 0 ? 0 : $ufloat;
// Boolean
// Will set to True or False
$bool = (bool)$_REQUEST['bool'];
// String for possible SQL
// This only cleans the string, still needs to be
// properly escaped before submitting SQL query
$string = trim(stripslashes($_REQUEST['string']));
// String for HTML Display
// Allows strings to be safely displayed on HTML pages
// second line helps prevent RSS attacks
$html = htmlentities(trim(stripslashes($_REQUEST['html'])));
$html = preg_replace(array('#javascript#i', '#vbscript#i'), array('java script', 'vb script'), $html);
__________________
<mgraphic /> - I don't have a solution but I admire the problem.
Last edited by mgraphic : 03-21-2008 at 10:57 AM.
Reason: Strings don't neccessary need htmlentities()
|
