How to do Php Security check for input fields and input treatment ?

Question

Hi,

How to do Php Security check for input user fields and input user treatment(please if you can solve example1+2)?

Example1: check if user insert url or something else:

<label>url: </label>
<input type="text">

Example2: check if user insert html or something else

<label>paste html: </label>
<textarea></textarea>

thanks

Answer 1

USE regex to validate your input

see

http://www.webcheatsheet.com/php/regular_expressions.php

http://articles.sitepoint.com/article/regular-expressions-php

http://www.roscripts.com/PHP_regular_expressions_examples-136.html

http://regular-expressions.info

Answer 2

For string filtering/validating we use RegExp and for html filtering/validating we use DOM extension

Answer 3

1. For the validation of URLs :

$validUrl = strpos($url, "http://") === 0;
if(!$validUrl) $url = "http://".$url;

When the link is return to the user, use htmlentities().

2. For the validation of HTML code, use a lib like http://htmlpurifier.org/.

<?php
require_once 'htmlpurifier/HTMLPurifier.auto.php';

$purifier = new HTMLPurifier();
$clean_html = $purifier->purify($_GET['dirty_html']);
echo $clean_html;
?>

With the input :

<img src="test.gif" onload="alert('xss')"/>

The result is :

<img src="test.gif" alt="test.gif" />