Hello guys.

 

Im building my first app, so be easy, whats the best way to secure data being posted? like remove symbles forword slashes backslashes, all i want is this to allow numbers and full stops...

 

$aip1 = $_POST['aip1'];

$aip1 = strip_tags($aip1);
$aip1 = trim($aip1);
$aip1 = htmlspecialchars($aip1);
$aip1 = stripslashes($aip1);

echo("$aip1");

Hello guys.

 

Im building my first app, so be easy, whats the best way to secure data being posted? like remove symbles forword slashes backslashes, all i want is this to allow numbers and full stops...

 

$aip1 = $_POST['aip1'];

$aip1 = strip_tags($aip1);
$aip1 = trim($aip1);
$aip1 = htmlspecialchars($aip1);
$aip1 = stripslashes($aip1);

echo("$aip1");

 

 

Heres a simple security function you could do it also includes mysql_real_escape_string which is only needed if you are dealing with databases so you can delete it if your not

 

<?php
function protect($string){
$string = mysql_real_escape_string($string);
$string = htmlspecialchars($string);
$string = trim($string);
$string = rawurldecode($string);
$string = strip_tags($string);
$string = preg_replace('/<.+>/','',$string);

return string;
}

?>

 

Then just use it like this $aip1 = protect($_POST['aip1']);

 

If this helps some please +1 me if you like

Heres a simple security function you could do it also includes mysql_real_escape_string which is only needed if you are dealing with databases so you can delete it if your not

 

<?php
function protect($string){
$string = mysql_real_escape_string($string);
$string = htmlspecialchars($string);
$string = trim($string);
$string = rawurldecode($string);
$string = strip_tags($string);
$string = preg_replace('/<.+>/','',$string);

return string;
}

?>

 

Then just use it like this $aip1 = protect($_POST['aip1']);

 

If this helps some please +1 me if you like

 

Hi Steve, Are you on msn still pal? i could do with your help if you forgot me im the guy that you was doing the aboutghosts project with

hm.. that function is a bit overkill.

 

Usually there's two parts to making text safe/clean.. but it's totally dependent on if you're entering it into a database.

 

 

Use this function to display text. It spit out html entities without breaking the encoding

function cleanString($string)
{
   return htmlspecialchars($string,ENT_QUOTES,'utf-8');
}

 

Use this function before you enter something into a database.

function mysqlEscape($string,$conn_id=null)
{
   return mysql_real_escape_string($string);
}

 

 

Really if you're looking to enter something into a database you should be using prepared statements. Ideally you should encode strings when you're displaying them, that way you can easily update your functions if a new security flaw is found.

All you need if you are wanting just numbers and full stops is a simple sanitization using a regex

$output = preg_replace('/[^\d\.]+/', '', $input);

You can just check if something is numberic using is_numeric()

You could also do this with filter_var()

$output = filter_var($input, FILTER_SANITIZE_NUMBER_FLOAT)

mysql_real_escape_string is pointless for what you asked to be done (ie getting just numbers/full stops)

 

@KieranA - Why bother with aliasing mysql_real_escape_string to something as long as that? Why not just use

function mres($s) { mysql_real_escape_string($s)}

Also in your function the $conn_id is redundant since it's not used

I agree that you should really be using prepared statements for this kind of thing

mysql_real_escape_string is pointless for what you asked to be done (ie getting just numbers/full stops)

 

I didn't read his question correctly it seems

 

 

@KieranA - Why bother with aliasing mysql_real_escape_string to something as long as that? Why not just use

function mres($s) { mysql_real_escape_string($s)}

Also in your function the $conn_id is redundant since it's not used

I agree that you should really be using prepared statements for this kind of thing

Forgot to whack it into the mysql_real_escape_string... typo.

 

I alias in a readable, clean way - well that's what i consider clean.

in your case a simple test would suffice :

 

class variablechecks
{ /* check if values are valid */   
 public function __check_string_for_numbers($string)
 {
   $error = 0;  /* initialize error with value of 0 */     	
   foreach (array('1','2','3','4','5','6','7','8','9','0','.') as $banned) if (strpos($string,$banned) !== false) $error = 1; 
   /* check for any other invalid characters */  
   return $error;
 }  
}

 

 

to use this : ( lets say it is from a posted form where the field is called 'number'

$check = new variablechecks();
if ($check->__check_string_for_numbers($_POST['number']))
{
// process success here
}
else
{
// not valid
}

the only easier but less extendable method would be MUCH simpler

if (is_int($_POST['number']))
{
// process success here
}
else
{
// not valid
}

if you know you will only ever need numbers then use the second option, it is always better to use PHP's built in functions.

sorry my bad class should be :

 

class variablechecks
{ /* check if values are valid */   
 public function __check_string_for_numbers($string)
 {
   $error = 0;  /* initialize error with value of 0 */         
   foreach (array('1','2','3','4','5','6','7','8','9','0','.') as $allowed) if (strpos($string,$allowed) !== true) $error = 1; 
   /* check for any other invalid characters */  
   return $error;
 }  
}

 

not tested but it should work

Creating a whole class for this when it can be done on one line seems a little overkill don't you think?

Also your second method is_int won't allow full stops (as the OP asked) since it will only return true if it's an integer. In that case it should be is_float()

totally overkill as I said in the previous post rather use PHP built in functions thanks for the is_float (totally overlooked that)

 

the class is only good if there are other values you would like to allow eg all numbers, and the letters a,b and c

In that case a regex would still do it /[^\d\.abc]/ Sorry didnt see your text between the codes

no problem:D,

 

I thought about regex but isn't it being phased out

 

from : php manual.net documentation on regex:

Note: As of PHP 5.3.0 this extension is deprecated, calling any function provided by this extension will issue an E_DEPRECATED notice.

 

I also have read up that regex is slower than strpos

 

but I could be wrong.

A regex is slower than a single replace yes, as for multiple replacements I'm not so sure to be honest. As for regex being phased out, definitely not. Regex is a vital part of php programming. The regex that was phased out was eregi and it's associated functions. the preg functions are still there

eregi has always been considered bad practice, but it's taken til 5.3 for them to remove it

aahhh *drops a penny and hears it hit the floor*

 

I thought it was insane to remove such a powerful function as for speed could be interesting I will do some tests

hehe I'm already on the case for the testing

 

$var = new variablechecks();
$text = 'abcabc12.345abcabc';
$timer1 = new timer();
$timer2 = new timer();

$timer1->start();
var_dump($var->__check_string_for_numbers($text));
$t1 = $timer1->stop();

$timer2->start();
var_dump(preg_replace('/[^\d\.]/', '', $text));
$t2 = $timer2->stop();
echo "<br />Timer1: $t1<br />Timer2: $t2<br />";
echo ($t1 < $t2) ? 'Method 1 is quicker' : 'Method 2 is quicker';

Using your class along with my timer class I used the above code. It seems that preg_replace() is quicker than just str_pos every time (by a fraction). I get Method 2 is quicker every time. This also doesn't take into account the fact that the second method also edits the string (which takes longer). I also instantiated your class before the timer just to make it a level playing field, but that will bulk up the time for that too

sorry got a bit busy here , here is my check it proves that is_float is the fastest by some distance :

 

seems my silly little class is a waste of time

 

<?php
 class variablechecks
 { /* check if values are valid */   
   public function __check_string_for_numbers($string)
   {
     $error = 0;  /* initialize error with value of 0 */ 		
     foreach (array('1','2','3','4','5','6','7','8','9','0','.') as $allowed) if (strpos($string,$allowed) !== true) $error = 1; 
     /* check for any other invalid characters */  
     return $error;
   }  
 }
 $numbers = "1234567fds8427849324372892423454324525432543254325345432";
 $to_do_n_times = 10000;
 $time_start = microtime(true);
 for($i=0;$i<$to_do_n_times;$i++)
 {
   preg_replace('/^\d\./', '', $numbers);  
 }
 $time_end = microtime(true);
 $time1 = $time_end - $time_start;

 $time_start = microtime(true);
 $vc = new variablechecks(); 
 for($i=0;$i<$to_do_n_times;$i++)
 {
   $vc->__check_string_for_numbers($numbers);  
 }
 $time_end = microtime(true);
 $time2 = $time_end - $time_start;

 $time_start = microtime(true);
 $vc = new variablechecks(); 
 for($i=0;$i<$to_do_n_times;$i++)
 {
   is_float($numbers);  
 }
 $time_end = microtime(true);
 $time3 = $time_end - $time_start;

 echo "preg_replace $to_do_n_times times = $time1 seconds<hr />";
 echo "check class $to_do_n_times times = $time2 seconds<hr />";
 echo "is_float $to_do_n_times times = $time3 seconds<hr />";

 $times = array($time1,$time2,$time3);
 if($time1 == min($times)) echo "preg_replace is the fastest"; 
 if($time2 == min($times)) echo "check class is the fastest"; 
 if($time3 == min($times)) echo "is_float is the fastest";  


?>                          

 

 

results when running it 1 million times look pretty convincing :

 

preg_replace a million times = 5.8287880420685 seconds

check class a million times = 41.363204956055 seconds

is_float a million times = 1.4893140792847 seconds

is_float is the fastest

 

sorry my bad class should be :

 

class variablechecks
{ /* check if values are valid */   
 public function __check_string_for_numbers($string)
 {
   $error = 0;  /* initialize error with value of 0 */         
   foreach (array('1','2','3','4','5','6','7','8','9','0','.') as $allowed) if (strpos($string,$allowed) !== true) $error = 1; 
   /* check for any other invalid characters */  
   return $error;
 }  
}

 

not tested but it should work

 

hm.. Total overkill and misuse of a class, that'd be best off in a function.

 

is_float will not work because well you're checking if a string is a float....

 

<?php
$input = '19.8';
$input2 = 19.8;
echo '<pre>';
var_dump(is_float($input));  // obviously going to return false....
var_dump(is_float($input2));  // obviously going to return true...

 

 

also why are you combing 2 different methods.. is_float is going to be used in a conditional whereas preg_replace is not. When testing you really need to base it off of a real life scenario.

 

I'm guessing if you cast a string to a float it'll be the best way of checking if it's ok.

 

 

an example...

function makeFloat($str) 
{
   $str = (float)$str;
   return $str == 0 ? false : $str;
}

var_dump(isFloat('1a') ); // 1
var_dump(isFloat('dasad') ); // false
var_dump(isFloat('1.1') ); // true

 

 

 

 

hehe I'm already on the case for the testing

 

$var = new variablechecks();

$text = 'abcabc12.345abcabc';

$timer1 = new timer();

$timer2 = new timer();

 

$timer1->start();

var_dump($var->__check_string_for_numbers($text));

$t1 = $timer1->stop();

 

 

You forgot to put the $var = new variablechecks(); inside the $timer1->start() - wouldn't have added much, but a speed increase nevertheless.

 

 

By using my method on a PC without any opcache you're looking at 1.0245320796967 seconds, however Jay's preg_replace example provides much, much more functionality at the cost of .5 second? IMO ignore the benchmarking as preg_replace/my method will work fine. I personally think that you should be looking at using preg_match to actually tell the user they've entered something wrong.

lol, my bad. was meant to be just eregi

 

sorry my bad