Best way to sanitize / filter user input?

[RPicard]

The script I'm creating, like most, involves a lot of user input. What php filters should I use to sanitize the input that will be inserted into a database.

[Buffy]

http://php.net/manual/en/function.mysql-...string.php
http://php.net/manual/en/function.addslashes.php

You could also create an array with unwanted queries, and, if the input contains anything in the array, echo "invalid input";

Those are the first two ideas, but, if you have an imagination, you can come up with different, and fun, ways of protecting input.

[RPicard]

Thanks for the info. I'll check them out.

[hexon]

Do not use addslashes() , because it can be bypassed easily , use mysql_real_escape_string() or mysqli_real_escape_string() if you are using mysqli

[Omniscient]

One of the best things you can do is to create your own function to quick sanitize input. This will allow you a greater degree of control and options plus you can upgrade and alter your sanitize function which will work across your whole site.

Look into this too:
http://us2.php.net/manual/en/ref.filter.php

That's only php 5 compatible but it looks great. Lots of options to filter input.

Pretty cool stuff: http://us2.php.net/manual/en/filter.filt...nitize.php

[Aaron Clifford]

Yeah was about to say that, make a function. Will try and dig one up I created.

[RPicard]

One of the best things you can do is to create your own function to quick sanitize input. This will allow you a greater degree of control and options plus you can upgrade and alter your sanitize function which will work across your whole site.

Look into this too:
http://us2.php.net/manual/en/ref.filter.php

That's only php 5 compatible but it looks great. Lots of options to filter input.

Pretty cool stuff: http://us2.php.net/manual/en/filter.filt...nitize.php

That's a good idea. Thanks.

[Lord-Nikon]

Also a very handy way of sanitizing is using the strip_tags() function from PHP. This will strip all tags and an optional parameter to include tags not to be stripped.

http://www.php.net/strip_tags

This is very useful if you do not want any <script> etc. tags in your user input.