Bugabuse.Net Pastebin

Re: MySQL Sanitization

From sixx, 1 Year ago, written in PHP, viewed 90 times. This paste is a reply to MySQL Sanitization from sixx - view diff
URL https://paste.bugabuse.net/view/f8d5d01f Embed
Download Paste or View Raw
  1. //Revision 2, fixed an error
  2.  
  3.  
  4. //First function is to remove malicious characters
  5.  
  6. <?php
  7. function cleanInput($input) {
  8.  
  9.   $search = array(
  10.     '@<script[^>]*?>.*?</script>@si',   // Strip out javascript
  11.     '@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
  12.     '@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
  13.     '@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments
  14.   );
  15.  
  16.     $output = preg_replace($search, '', $input);
  17.     return $output;
  18.   }
  19. ?>
  20.  
  21. //Second function implements first function and does the actual sanitation
  22.  
  23. <?php
  24. function sanitize($input) {
  25.     if (is_array($input)) {
  26.         foreach($input as $var=>$val) {
  27.             $output[$var] = sanitize($val);
  28.         }
  29.     }
  30.     else {
  31.         if (get_magic_quotes_gpc()) {
  32.             $input = stripslashes($input);
  33.         }
  34.         $input  = cleanInput($input);
  35.         $output = mysql_real_escape_string($input);
  36.     }
  37.     return $output;
  38. }
  39. ?>
  40.  
  41. //Example use on phisher
  42.  
  43. <?php
  44. $username = sanitize($_POST["username"]);
  45. ?>
  46.  
  47. //Signed
  48. -sixxfeetundr

Reply to "Re: MySQL Sanitization"

Here you can reply to the paste above

Powered by Stikked