php form validation with mysql

Posted on 2011-10-03
Last Modified: 2013-12-12
Hi all,

Is there any up to date information with regards validating and sanitising form data in PHP. The data will be stored in a mysql database.

I tend to use htmlentities and mysql_real_escape_string but have read various sites, some old, some new that suggest these methods are not entireley flawless and was wondering if there were better methods of checking user input data.

The types of data I would be looking at would require removing special characters from strings, verifying numeric input and reducing the risk of mysql injection.

I'm using php 5.3
Question by:jools
    LVL 107

    Expert Comment

    by:Ray Paseur
    The mantra is "Accept only known good values."  Regular expressions and the filter_var() functions are what the professionals would use.
    LVL 30

    Expert Comment

    by:Marco Gasi
    I suggest to refer directly to

    Here you find all useul informations. The security in php is hard, but is the best source to refer to for updated info about his and other questions.

    LVL 107

    Accepted Solution

    SQL injection is certainly one risk, but hardly the only one.  Let's look at these: removing special characters from strings, verifying numeric input and reducing the risk of mysql injection.

    Removing special characters is the wrong approach.  You do not want to remove bad values; you want to accept only known good values.  If you had to guess at all of the bad values, you would be at terrible risk that you might have overlooked one.

    Verifying numeric input.   Again, check the data to see if it matches the expected data type and if it is in the expected range of allowable values.  Then you will know whether it is good or not.

    Reducing the risk of SQL injection can be accomplished with this function.  Use as directed in the man page.

    There is more on  Follow all the links here to get a good overview.

    You might also want to make a Google search for "PHP Security" and read the top ten recommendations.  Do that once a month, as good practice for continuing education!

    best regards, ~Ray
    LVL 19

    Author Comment

    Thx for the posts, I'd been looking at the filter options but had also found sites like this;

    Most of the articles I read today (been googling for over four hours) seem to contradict each other, on one hand there are the people who favour the builtin filter options then there are others which say the filter options are useless and to stick with htmlentities, mysql_real_excape_string et al. This I put down to programmer preference and the possibility that the filter options may have been new features (at the time the articles were published) and not that mature when it comes to options.

    I'm more famialiar with the htmlentities etc functions and have dabbled in the regex/preg_replace nightmare for sanitising some string inputs but want to be sure I keep my knowledge as up to date as possible and learn as much as I can along the way.

    I wasnt expecting a single answer to what is a quite large subject but I was hoping to find some more up to date articles with real world example code.
    LVL 19

    Author Comment

    Thanks for the update Ray, you must be a quicker typist than me :-)

    I'll check out the links and info you posted and get back to you tomorrow. I'll leave the Q open in the hope of getting more points of view.

    Cheers All.
    LVL 5

    Assisted Solution

    Ray has covered a lot, however just to reiterate:

    1) Use regex where you need to limit what is being entered i.e check a date is a date, a phone number is a phone number.  Use filter_var to cover some scenarios (prevent "reinventing the wheel" so to speak).  Some cases you can't really restrict what people are entering i.e a

    2) Use mysql_real_escape_string on data that is going into the database, as well as htmlspecialchars or even strip_tags if you don't want to allow any html tags (you can specify a white-list for strip_tags, can be handy to allow <br />).  Although you won't cover all scenarios (i.e hex values) these functions will help a lot

    3) Use PDO or some sort of similar data access layer. Using prepared statements reduces the risk of inserting unsanitized input into the db, dramatically reducing the risk of sql injection.

    4) Only give your database the permissions it needs to perform its tasks.  It's unlikely that you would need to drop any tables, so create a user with read permissions (your application may need update and delete too) and only connect to the db in your application with that user.

    Obviously there is plenty more, but the main thing is that you are proactive about it, you will learn a lot by both reading and implementing, just remember that there is no 'one size fits all approach' hence why on forums etc you get differening opinions. Read, take stock and implement what you think is best for your application then readjust as you learn more.

    All the best,


    LVL 19

    Author Closing Comment

    Thanks for your views on what is a particularly large subject, it certainly reaffirmed some of my original thoughts and also gave me something else to think about.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    As this topic comes over and over again in different forms, I've finally decided to write a short (yea, right...) article / tutorial about pagination with PHP with MySQL database. There are dozens of these kind of tutorials, I know - I wanted to mak…
    Foreword (July, 2015) Since I first wrote this article, years ago, a great many more people have begun using the internet.  They are coming online from every part of the globe, learning, reading, shopping and spending money at an ever-increasing ra…
    Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
    This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now