Is there any up to date information with regards validating and sanitising form data in PHP. The data will be stored in a mysql database.
I tend to use htmlentities and mysql_real_escape_string but have read various sites, some old, some new that suggest these methods are not entireley flawless and was wondering if there were better methods of checking user input data.
The types of data I would be looking at would require removing special characters from strings, verifying numeric input and reducing the risk of mysql injection.
I'm using php 5.3
PHP
Last Comment
Julian Parker
8/22/2022 - Mon
Ray Paseur
The mantra is "Accept only known good values." Regular expressions and the filter_var() functions are what the professionals would use.
Here you find all useul informations. The security in php is hard, but php.net is the best source to refer to for updated info about his and other questions.
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
Most of the articles I read today (been googling for over four hours) seem to contradict each other, on one hand there are the people who favour the builtin filter options then there are others which say the filter options are useless and to stick with htmlentities, mysql_real_excape_string et al. This I put down to programmer preference and the possibility that the filter options may have been new features (at the time the articles were published) and not that mature when it comes to options.
I'm more famialiar with the htmlentities etc functions and have dabbled in the regex/preg_replace nightmare for sanitising some string inputs but want to be sure I keep my knowledge as up to date as possible and learn as much as I can along the way.
I wasnt expecting a single answer to what is a quite large subject but I was hoping to find some more up to date articles with real world example code.
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
Julian Parker
ASKER
Thanks for the update Ray, you must be a quicker typist than me :-)
I'll check out the links and info you posted and get back to you tomorrow. I'll leave the Q open in the hope of getting more points of view.
Unlimited question asking, solutions, articles and more.
Julian Parker
ASKER
Thanks for your views on what is a particularly large subject, it certainly reaffirmed some of my original thoughts and also gave me something else to think about.