PHP filter POST from PayPal IPN?

Question

I have a PayPal IPN PHP file set up which assigns all of the IPN post contents variables to variables. This file is only 'hit' from paypal.com (ie nobody should know it's url).

My question is should I take the necessary steps to filter and sanitize the POST data from PayPal or is masking my IPN file name (IPN_082j3f08jasdf.php) enough?

Also, could somebody confirm my sanitize code? It's pretty basic. I run it on EVERYTHING sent via POST or GET and my goal is to prevent any kind of MySQL injections or whatever hackers do.

function filter($data){
 // changes & to &
 // changes " to "
 // removes \ < >

 $data = trim(htmlentities(strip_tags($data)));

 if(get_magic_quotes_gpc()){
  $data = stripslashes($data);
 }
 $data = mysql_real_escape_string($data);

 return $data;
}

Answer 1

You may also consider using more robust filtration mechanism used also by Kohana php framework which can be found here:

http://svn.bitflux.ch/repos/public/popoon/trunk/classes/externalinput.php

Answer 2

obfuscating the filename is never enough -- you need to filter the POST data, yes. Assume it is not PayPal calling the script until you can prove it.

the sanitation looks OK -- if your code becomes quite long though, I would tend to sanitize it in two steps --the strip_tags and basic sanitation at the beginning, and the mysql escaping at the same time you contact the database -- it makes it easier to maintain IMO.

Answer 3

Sorry for the bad advice! Please disregard this post! - keeping it undeleted, as it's generated some interesting discussion below

If no one should know its URL, the SQL-sanitize is probably not that big of an issue. Masking your IPN file should be enough unless someone hijacks your directory listing.

htmlentities() will need to have an ENT_QUOTES flag to convert quotes.

if get_magic_quotes_gpc() is on, then strip_slashes are automatically done... in your case, it looks like you will double strip slashes.

also mysql_real_escape_string will do the work of strip_slashes() already ...