How to filter data entries in PHP

Question

Good evening, I have a form serving data entry that is displayed on the screen. The problem is that this data can be html tags or scripts, if someone puts this code in my form, the page will be redirected.

<meta http-equiv="refresh" content="6; url=/">   

How could I clear html tags or any other kind of malicious injection ?

Answer 1

Objective response !

strip_tags() allows other types of insertion of XSS then use htmlspecialchars()

echo htmlspecialchars($Variavel, ENT_QUOTES, 'UTF-8');

Long answer.....

Let’s start by parts, what you want and protect yourself from the XSS, its data input is enabling the injection of commands or markup, we will analyze this well to be able to create a 100% functional solution, in security we must be calculating.

Analyzing the scenario where XSS can happen!

Let’s put two scenarios for this situation

<input type="text" value="$Suspeito">

and another common good is when we put the content in a div

<div class="container" id="ct">
    <?php echo $Suspeito ?>
</div>

Now, let’s replace this variable with a classic xss

Doesn’t work !

<input type="text" value="<script> alert("Xss here");</script> ">

Works !

<div class="container" id="ct">
        <script> alert("Xss here");</script> 
    </div>

Solution at first sight!

We can add extra protection using strip_tags() to escape tags !

Let’s see how it would look if our variable had a protection with strip_tags()

Doesn’t work !

<input type="text" value="alert("Xss here"); ">

Doesn’t work !

<div class="container" id="ct">
         alert("Xss here"); 
    </div>

Just like in Brazil, there is a way for everything and this solution is far from solving any problem, just use your imagination.

imagine this situation, apparently there are no problems right ?

Wrong, let’s force our imagination, I need to fuck with this code without using tags

<?php $Suspeito = '" onfocus=document.write("");" fecha="';
<input type="text" value="" onfocus=document.write("");" fecha="">

Oops, now it’s a problem Is it just that ?

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";
alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//--
></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>


'';!--"<XSS>=&{()}

<IMG SRC="javascript:alert('XSS');">

<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&
#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>

So then we need another solution that doesn’t fail that way, remembering that we have another problem, if you escape the tags, no one will be able to use... remember math, comparisons, or even code, you will simply lose data...

More flexible solution

By limiting encoding to UTF-8 and using htmlspecialchars, it becomes possible to use tags and scripts in html without having any effect on the page, the characters are disubstituted by <> entities will turn <> fully transparent to the user.

echo htmlspecialchars($Suspeito, ENT_QUOTES, 'UTF-8');

Look at this link showing a comparison between htmlspecialchars vs strip_tags Online script

This is maybe not a perfect solution, maybe there is a way to cheat, try to do it whenever you come across some security issue, ? "

Answer 2

You want to know how to take these tags out, if the user inserts this into the text field to add to the mysql database, avoiding unnecessary redirects in ECHO, I’m sure?

If yes Can use strip_tags() function that removes html tags from strings.

Answer 3

There are ways and means to solve problems, I personally prefer to turn to PHP the right way when it comes to PHP, because in the language itself there are numerous solutions to everyday problems, where they are usually juggled to reach the same solution.

Whenever you obtain information from a source not known, such as sending information from a form, the input and output information should always be processed, sent or received from a database or on the HTML page itself.

In the PHP language there are filters, which are used to validate (as in the case of e-mail validation through the FILTER_VALIDATE_EMAIL filter) and sanitize the values (as in the case of FILTER_SANITIZE_STRING, which clears strings and FILTER_SANITIZE_EMAIL which clears characters that are not used in the construction of an e-mail). These filters work together with the function filter_var, filter_input and others.

Taking into account the PHP documentation and the PHP reference the right way I would use the example below:

<?php

//inseguro
$input = 'alert("ola")';
echo $input;

//seguro
$input_filter = filter_var($input, FILTER_SANITIZE_STRING);
echo "<br>". $input_filter;

Example in the ideone: http://ideone.com/Y2w9tr