Keeping users from breaking the code

[southbeach]

I know, nearly impossible but I know I have a huge whole and I want to close it (not patch it) before it is too late.

I am afraid that my code will start breaking apart once users start using characters like

' , ` # " % \ / {} [ ] & * @

within fields. It already happened when I tried to pass (via URL) a field that had # in it. Ironically, the user himself reported the problem and the cause.

I cannot ask them not to use these characters so, what is my solution to

1. Write to MySQL, read from MySQL and display on screen
2. Pass them via URL
3. When passing via URL, what must I use on the other end if not our normal $_GET/REQUEST

Thank you all in advance for your assistance.

 

[vacunita]

You may want to run your field inputs through functions such as
htmlentities() or htmlspecialchars()

These will transform characters like the ones your posted into their html code equivalents.

If this does not help, perhaps you can tell us how your code breaks when one of those characters is used.

----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[DonQuichote]

You don't "just glue them" to the URL, do you? If you do, escape them first by using the urlencode function AND find a good book on web security.

+++ Despite being wrong in every important aspect, that is a very good analogy +++
Hex (in Darwin's Watch)

 

[jpadie]

browsers will encode these characters for the journey from the browser to the server. the method of encoding depends on what you have specified for the form. if you are constructing the query string manually, remember to use encodeURI or similar from javascript.

for the processing of the input in php: no.1 rule is never to trust user input. you should have a suite of cleansing code to protect your database from misuse and your code from breaking. vacunita's pointers are a great place for you to start that process.

 

[southbeach]

Thank you guys!

I also found that using mysql_real_escape_string() is a good practice.

Regards