Validate user input
Snippet Menu
-17
Mon. Oct. 9th, 2006 7:07 AM
A little function that does some basic checking for data input by a user. Should get rid of code injection ;-)
function safeInput($data){
$cleanData = strip_tags($data);
$cleanData = ereg_replace("<[^>]*>","",$cleanData);
$cleanData = preg_replace('/<(.|\s)*?>/', '', $cleanData);
if ($cleanData == "" || $cleanData == NULL){
return FALSE;
} else {
return $cleanData;
}
}
Jon Thompson
Comments
Voting
Votes Up
Votes Down
strip_tags() removes all html and php tags from your string, so there is no need to do it again by adding the 2 regular expression replaces (both, which I might add, do esentially the same thing).
If code injection (assuming php code injection) was what you were trying to avoid, a single call to strip_tags() should provide proficient. I would still, however, use htmlspecialchars().
http://ha.ckers.org/xss.html