Idea for data cleaning and processing library

Asked

Viewed 38 times

0

I need to make a library for data processing, so I can use it before calling functions like: Register, Change, Delete and etc...

I am using PDO for communication with the mysql database, and the method itself already has some security measures to avoid sql Injection, but I would like a more security.

I have been researching and found nothing better than the filter Anitize that the php language itself offers, but I believe you have better and more complete ways to use these features.

Follow the function I’ve done:

function limpeza($dados) {
    foreach ($dados as $key => $valor) {
        if (is_numeric($valor)) {
            $dados[$key] = filter_var($dados[$key], FILTER_SANITIZE_NUMBER_INT);
        } else {
            $dados[$key] = filter_var(utf8_decode($dados[$key]), FILTER_SANITIZE_STRING);
        }
    }
    return $dados;
}

My idea is to take for example the array with the form POST and pass directly to the function, and that it returns me a clean and free array of for example html tags, php or other malicious scripts. The way it is, the function actually cleans all malicious tags and scripts and returns me the clean array. But I feel like there are much better ways to do it, and I haven’t found much content on the Internet about it.

  • 1

    And difference between int and float ? It seems safer to come from one gettype instead of a is_numeric. And you can even receive an optional second array as a parameter with the filter to apply to each field, so you can in some cases apply FILTER_SANITIZE_EMAIL for example

  • 1

    Check https://github.com/Wixel/GUMP, easy to extend, and easy to use.

  • From a look at Safemysql. It is a mysqli wrapper to solve the security, reading, implementation and repetition problems that the mysqli AIDS code can provide. It is developed/maintained by an OS user.

No answers

Browser other questions tagged

You are not signed in. Login or sign up in order to post.