Protection of PHP sites - processing of incoming data

19-03-2016, 07:44 PM

Sozin Wrote:

02-03-2016, 11:01 PM

ivoivo Wrote: good lesson

How do I filter php code in $_POST?

Do you mean all values? Then:

[pre]
array_walk( $_POST, function( &$value, $key ){
$value = filter_function( $value ); // The filter function can be intval, floatval, or anything.. even a custom function will do.
});
[/pre]

Things to look into after considering the above code:
http://php.net/array_walk
http://php.net/manual/en/functions.anonymous.php

Fuck you, your too good with your shit :D

mysql_real_escape_string is deprecated and as we're moving into PHP 7 it should now be avoided.

I used to use a function like this:



But since mysqli connections in PHP 5, the function above would require redeclaring the mysqli connection we want to use every time we call the function, so instead we now place our mysql connection into a public class:


Then make the connection:


Then declare our function:

Now every time we handle $_POST or $_GET variables we simply call the function, e.g:

thanks for the tips,,

this coed i have to add it in every page?

thanks for the lesson.. will practice soon

you are just talking about mysql mod haha but what about other db ? :p

Well ... this could work .... but I really suggest anyone reading this to further investigate in security before going Live.

I really like this site! Nice work, staff!
I really like this site! Nice work, staff!

Oh my God, thank you for sharing, I really liked the project.

Thanks for the good advice, some of the other posts also contain some good information