[Sommaire] [Imprimer]

   1  <html>
   2  <head>
   3  <title>InputFilter</title>
   4  <link rel="stylesheet" type="text/css" href="../media/style.css">
   5  </head>
   6  <body>
   7  
   8  <table border="0" cellspacing="0" cellpadding="0" height="48" width="100%">
   9    <tr>
  10      <td class="header_top">PHPonTrax</td>
  11    </tr>
  12    <tr><td class="header_line"><img src="../media/empty.png" width="1" height="1" border="0" alt=""  /></td></tr>
  13    <tr>
  14      <td class="header_menu">
  15              [ <a href="../classtrees_PHPonTrax.html" class="menu">class tree: PHPonTrax</a> ]
  16            [ <a href="../elementindex_PHPonTrax.html" class="menu">index: PHPonTrax</a> ]
  17            [ <a href="../elementindex.html" class="menu">all elements</a> ]
  18      </td>
  19    </tr>
  20    <tr><td class="header_line"><img src="../media/empty.png" width="1" height="1" border="0" alt=""  /></td></tr>
  21  </table>
  22  
  23  <table width="100%" border="0" cellpadding="0" cellspacing="0">
  24    <tr valign="top">
  25      <td width="200" class="menu">
  26      <div id="todolist">
  27              <p><a href="../todolist.html">Todo List</a></p>
  28      </div>
  29        <b>Packages:</b><br />
  30                <a href="../li_PHPonTrax.html">PHPonTrax</a><br />
  31                <a href="../li_PHPonTraxTest.html">PHPonTraxTest</a><br />
  32              <br /><br />
  33          <b>Tutorials/Manuals:</b><br />
  34                      <strong>Package-level:</strong>
  35                              <ul>
  36      <li type="square"><a href="../PHPonTrax/tutorial_PHPonTrax.pkg.html">PHP On Trax</a>
  37  <ul>
  38      <li type="square"><a href="../PHPonTrax/tutorial_rails_examples.pkg.html">Examples From The Rails Book</a>
  39  </ul>
  40  
<ul>
  41      <li type="square"><a href="../PHPonTrax/tutorial_simpleapp.pkg.html">Build A Simple Trax Application</a>
  42  </ul>
  43  
<ul>
  44      <li type="square"><a href="../PHPonTrax/tutorial_database.pkg.html">Create A Database and User</a>
  45  </ul>
  46  
<ul>
  47      <li type="square"><a href="../PHPonTrax/tutorial_advbuild.pkg.html">Advanced Application Build Topics</a>
  48  </ul>
  49  
<ul>
  50      <li type="square"><a href="../PHPonTrax/tutorial_naming.pkg.html">The Trax Naming Convention</a>
  51  </ul>
  52  
<ul>
  53      <li type="square"><a href="../PHPonTrax/tutorial_troubleshoot.pkg.html">Troubleshooting</a>
  54  </ul>
  55  
<ul>
  56      <li type="square"><a href="../PHPonTrax/tutorial_reference.pkg.html">Reference</a>
  57  </ul>
  58  
</li></ul>
  59  
  60                                          <strong>Class-level:</strong>
  61                              <ul>
  62      <li type="square"><a href="../PHPonTrax/tutorial_ActiveRecordHelper.cls.html">ActiveRecordHelper</a>
  63  </ul>
  64  
  65                              <ul>
  66      <li type="square"><a href="../PHPonTrax/tutorial_FormTagHelper.cls.html">FormTagHelper</a>
  67  </ul>
  68  
  69                              <ul>
  70      <li type="square"><a href="../PHPonTrax/tutorial_Helpers.cls.html">Helpers</a>
  71  </ul>
  72  
  73                              <ul>
  74      <li type="square"><a href="../PHPonTrax/tutorial_UrlHelper.cls.html">UrlHelper</a>
  75  </ul>
  76  
  77                              <ul>
  78      <li type="square"><a href="../PHPonTrax/tutorial_FormHelper.cls.html">FormHelper</a>
  79  </ul>
  80  
  81                              <ul>
  82      <li type="square"><a href="../PHPonTrax/tutorial_InputFilter.cls.html">InputFilter</a>
  83  </ul>
  84  
  85                              <ul>
  86      <li type="square"><a href="../PHPonTrax/tutorial_ActionMailer.cls.html">ActionMailer</a>
  87  </ul>
  88  
  89                              <ul>
  90      <li type="square"><a href="../PHPonTrax/tutorial_ApplicationController.cls.html">ApplicationController</a>
  91  </ul>
  92  
  93                              <ul>
  94      <li type="square"><a href="../PHPonTrax/tutorial_ActionController.cls.html">ActionController</a>
  95  </ul>
  96  
  97                              <ul>
  98      <li type="square"><a href="../PHPonTrax/tutorial_ActiveRecord.cls.html">ActiveRecord</a>
  99  </ul>
 100  
 101                              <ul>
 102      <li type="square"><a href="../PHPonTrax/tutorial_DateHelper.cls.html">DateHelper</a>
 103  </ul>
 104  
 105                              <ul>
 106      <li type="square"><a href="../PHPonTrax/tutorial_Router.cls.html">Router</a>
 107  </ul>
 108  
 109                              <ul>
 110      <li type="square"><a href="../PHPonTrax/tutorial_FormOptionsHelper.cls.html">FormOptionsHelper</a>
 111  </ul>
 112  
 113                              <ul>
 114      <li type="square"><a href="../PHPonTrax/tutorial_TraxGenerator.cls.html">TraxGenerator</a>
 115  </ul>
 116  
 117                              <ul>
 118      <li type="square"><a href="../PHPonTrax/tutorial_Session.cls.html">Session</a>
 119  </ul>
 120  
 121                              <ul>
 122      <li type="square"><a href="../PHPonTrax/tutorial_Inflector.cls.html">Inflector</a>
 123  </ul>
 124  
 125                              <ul>
 126      <li type="square"><a href="../PHPonTrax/tutorial_ActiveRecordError.cls.html">ActiveRecordError</a>
 127  </ul>
 128  
 129                              <ul>
 130      <li type="square"><a href="../PHPonTrax/tutorial_ActionControllerError.cls.html">ActionControllerError</a>
 131  </ul>
 132  
 133                              <ul>
 134      <li type="square"><a href="../PHPonTrax/tutorial_ScaffoldController.cls.html">ScaffoldController</a>
 135  </ul>
 136  
 137                              <ul>
 138      <li type="square"><a href="../PHPonTrax/tutorial_Dispatcher.cls.html">Dispatcher</a>
 139  </ul>
 140  
 141                              <ul>
 142      <li type="square"><a href="../PHPonTrax/tutorial_TraxError.cls.html">TraxError</a>
 143  </ul>
 144  
 145                              <ul>
 146      <li type="square"><a href="../PHPonTrax/tutorial_ApplicationMailer.cls.html">ApplicationMailer</a>
 147  </ul>
 148  
 149                                                      <b>Files:</b><br />
 150              <div class="package">
 151              <a href="../PHPonTrax/_vendor_trax_action_controller_php.html">        action_controller.php
 152          </a><br>
 153              <a href="../PHPonTrax/_vendor_trax_action_mailer_php.html">        action_mailer.php
 154          </a><br>
 155              <a href="../PHPonTrax/_vendor_trax_action_view_php.html">        action_view.php
 156          </a><br>
 157              <a href="../PHPonTrax/_vendor_trax_active_record_php.html">        active_record.php
 158          </a><br>
 159              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_active_record_helper_php.html">        active_record_helper.php
 160          </a><br>
 161              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_add_phtml.html">        add.phtml
 162          </a><br>
 163              <a href="../PHPonTrax/_data_app_controllers_application_php.html">        application.php
 164          </a><br>
 165              <a href="../PHPonTrax/_data_app_views_layouts_application_phtml.html">        application.phtml
 166          </a><br>
 167              <a href="../PHPonTrax/_data_app_helpers_application_helper_php.html">        application_helper.php
 168          </a><br>
 169              <a href="../PHPonTrax/_data_app_application_mailer_php.html">        application_mailer.php
 170          </a><br>
 171              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_asset_tag_helper_php.html">        asset_tag_helper.php
 172          </a><br>
 173              <a href="../PHPonTrax/_test_layouts_catalog_phtml.html">        catalog.phtml
 174          </a><br>
 175              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_controller_php.html">        controller.php
 176          </a><br>
 177              <a href="../PHPonTrax/_vendor_trax_templates_controller_php.html">        controller.php
 178          </a><br>
 179              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_date_helper_php.html">        date_helper.php
 180          </a><br>
 181              <a href="../PHPonTrax/_data_config_environments_development_php.html">        development.php
 182          </a><br>
 183              <a href="../PHPonTrax/_data_public_dispatch_php.html">        dispatch.php
 184          </a><br>
 185              <a href="../PHPonTrax/_vendor_trax_dispatcher_php.html">        dispatcher.php
 186          </a><br>
 187              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_edit_phtml.html">        edit.phtml
 188          </a><br>
 189              <a href="../PHPonTrax/_data_config_environment_php.html">        environment.php
 190          </a><br>
 191              <a href="../PHPonTrax/_vendor_trax_templates_error_phtml.html">        error.phtml
 192          </a><br>
 193              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_form_helper_php.html">        form_helper.php
 194          </a><br>
 195              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_form_options_helper_php.html">        form_options_helper.php
 196          </a><br>
 197              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_form_scaffolding_phtml.html">        form_scaffolding.phtml
 198          </a><br>
 199              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_form_tag_helper_php.html">        form_tag_helper.php
 200          </a><br>
 201              <a href="../PHPonTrax/_data_script_generate_php.html">        generate.php
 202          </a><br>
 203              <a href="../PHPonTrax/_vendor_trax_templates_helper_php.html">        helper.php
 204          </a><br>
 205              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_php.html">        helpers.php
 206          </a><br>
 207              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_index_phtml.html">        index.phtml
 208          </a><br>
 209              <a href="../PHPonTrax/_vendor_trax_inflector_php.html">        inflector.php
 210          </a><br>
 211              <a href="../PHPonTrax/_vendor_trax_input_filter_php.html">        input_filter.php
 212          </a><br>
 213              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_javascript_helper_php.html">        javascript_helper.php
 214          </a><br>
 215              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_layout_phtml.html">        layout.phtml
 216          </a><br>
 217              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_layout_phtml.html">        layout.phtml
 218          </a><br>
 219              <a href="../PHPonTrax/_makepkg_php.html">        makepkg.php
 220          </a><br>
 221              <a href="../PHPonTrax/_vendor_trax_templates_model_php.html">        model.php
 222          </a><br>
 223              <a href="../PHPonTrax/_data_config_environments_production_php.html">        production.php
 224          </a><br>
 225              <a href="../PHPonTrax/_vendor_trax_router_php.html">        router.php
 226          </a><br>
 227              <a href="../PHPonTrax/_data_config_routes_php.html">        routes.php
 228          </a><br>
 229              <a href="../PHPonTrax/_vendor_trax_scaffold_controller_php.html">        scaffold_controller.php
 230          </a><br>
 231              <a href="../PHPonTrax/_vendor_trax_session_php.html">        session.php
 232          </a><br>
 233              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_show_phtml.html">        show.phtml
 234          </a><br>
 235              <a href="../PHPonTrax/_data_config_environments_test_php.html">        test.php
 236          </a><br>
 237              <a href="../PHPonTrax/_trax_php.html">        trax.php
 238          </a><br>
 239              <a href="../PHPonTrax/_vendor_trax_trax_exceptions_php.html">        trax_exceptions.php
 240          </a><br>
 241              <a href="../PHPonTrax/_vendor_trax_trax_generator_php.html">        trax_generator.php
 242          </a><br>
 243              <a href="../PHPonTrax/_vendor_trax_action_view_helpers_url_helper_php.html">        url_helper.php
 244          </a><br>
 245              <a href="../PHPonTrax/_vendor_trax_templates_view_phtml.html">        view.phtml
 246          </a><br>
 247              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_view_add_phtml.html">        view_add.phtml
 248          </a><br>
 249              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_view_edit_phtml.html">        view_edit.phtml
 250          </a><br>
 251              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_view_index_phtml.html">        view_index.phtml
 252          </a><br>
 253              <a href="../PHPonTrax/_vendor_trax_templates_scaffolds_generator_templates_view_show_phtml.html">        view_show.phtml
 254          </a><br>
 255        </div><br />
 256        
 257              <b>Classes:</b><br />
 258          <div class="package">
 259                      <a href="../PHPonTrax/.html"></a><br />
 260                  <a href="../PHPonTrax/ActionController.html">ActionController</a><br />
 261                  <a href="../PHPonTrax/ActionControllerError.html">ActionControllerError</a><br />
 262                  <a href="../PHPonTrax/ActionMailer.html">ActionMailer</a><br />
 263                  <a href="../PHPonTrax/ActiveRecord.html">ActiveRecord</a><br />
 264                  <a href="../PHPonTrax/ActiveRecordError.html">ActiveRecordError</a><br />
 265                  <a href="../PHPonTrax/ActiveRecordHelper.html">ActiveRecordHelper</a><br />
 266                  <a href="../PHPonTrax/ApplicationController.html">ApplicationController</a><br />
 267                  <a href="../PHPonTrax/ApplicationMailer.html">ApplicationMailer</a><br />
 268                  <a href="../PHPonTrax/AssetTagHelper.html">AssetTagHelper</a><br />
 269                  <a href="../PHPonTrax/DateHelper.html">DateHelper</a><br />
 270                  <a href="../PHPonTrax/Dispatcher.html">Dispatcher</a><br />
 271                  <a href="../PHPonTrax/FormHelper.html">FormHelper</a><br />
 272                  <a href="../PHPonTrax/FormOptionsHelper.html">FormOptionsHelper</a><br />
 273                  <a href="../PHPonTrax/FormTagHelper.html">FormTagHelper</a><br />
 274                  <a href="../PHPonTrax/Helpers.html">Helpers</a><br />
 275                  <a href="../PHPonTrax/Inflector.html">Inflector</a><br />
 276                  <a href="../PHPonTrax/InputFilter.html">InputFilter</a><br />
 277                  <a href="../PHPonTrax/JavaScriptHelper.html">JavaScriptHelper</a><br />
 278                  <a href="../PHPonTrax/Router.html">Router</a><br />
 279                  <a href="../PHPonTrax/ScaffoldController.html">ScaffoldController</a><br />
 280                  <a href="../PHPonTrax/Session.html">Session</a><br />
 281                  <a href="../PHPonTrax/TraxError.html">TraxError</a><br />
 282                  <a href="../PHPonTrax/TraxGenerator.html">TraxGenerator</a><br />
 283                  <a href="../PHPonTrax/UrlHelper.html">UrlHelper</a><br />
 284        </div>
 285                  </td>
 286      <td>
 287        <table cellpadding="10" cellspacing="0" width="100%" border="0"><tr><td valign="top">
 288  
 289  <table width="100%" border="0" cellpadding="0" cellspacing="0">
 290  <tr>
 291  <td width="10%" align="left" valign="bottom"><a href=
 292  "../PHPonTrax/tutorial_FormHelper.cls.html">Prev</a></td>
 293  <td width="80%" align="center" valign="bottom"></td>
 294  <td width="10%" align="right" valign="bottom"><a href=
 295  "../PHPonTrax/tutorial_ActionMailer.cls.html">Next</a></td>
 296  </tr>
 297  </table>
 298  <div><a name=""></a><div class="ref-title-box">InputFilter<h1 class="ref-title">InputFilter</h1>
 299    <h2 class="ref-purpose">Protect Against Malicious SQL and HTML</h2></div>
 300   <div class="ref-synopsis"><span class="author">Walt Haas
 301     <div class="author-blurb"><a href="mailto:haas@xmission.com">haas@xmission.com</a></div></span></div>
 302   <h1 align="center">Table of Contents</h1>
 303  <ul>
 304  
 305  <a href="../PHPonTrax/tutorial_InputFilter.cls.html#intro">Introduction</a><br />
 306  
 307  <a href="../PHPonTrax/tutorial_InputFilter.cls.html#safesql">safeSQL(): Protect SQL</a><br />
 308  
 309  <a href="../PHPonTrax/tutorial_InputFilter.cls.html#process">process(): Protect Against HTML Tags and Attributes</a><br />
 310  
 311  <a href="../PHPonTrax/tutorial_InputFilter.cls.html#process_all">process_all(): Protect Against HTML in Request Variables</a><br />
 312  </ul>
 313  
 314   <span><a name="intro"></a><h2 class="title">Introduction</h2><p><a href="../PHPonTrax/InputFilter.html">InputFilter</a> is a
 315    <a href="http://en.wikipedia.org/wiki/Singleton_pattern">singleton</a>
 316    class (although not enforced by the constructor) with three public
 317    methods that are useful in protecting  a web site from potential
 318    security threats from user input.</p>
 319    <li><a href="../PHPonTrax/InputFilter.html#methodsafeSQL">InputFilter::safeSQL()</a> protects SQL from the
 320      user.</li> 
 321     <li><a href="../PHPonTrax/InputFilter.html#methodprocess">InputFilter::process()</a> protects HTML tags and
 322      attributes from the user.</li>
 323     <li><a href="../PHPonTrax/InputFilter.html#methodprocess_all">InputFilter::process_all()</a> applies
 324      process() to all possible sources of user input</li></span>
 325   <span><a name="safesql"></a><h2 class="title">safeSQL(): Protect SQL</h2><p>Web site security may be threatened by
 326    <a href="http://en.wikipedia.org/wiki/SQL_injection">SQL injection</a>
 327    if a user is allowed to input a query that is not properly screened.
 328    SQL statements are delimited by punctuation characters.  In
 329    particular, the beginning and end of the information being stored or
 330    searched for are delimited by quotes.  If a user is permitted to
 331    include unprotected quotes in their search, there is a danger that
 332    a malicious user might take advantage of this to inject unauthorized
 333    commands into the database.</p>
 334  
 335    <p>To protect against this attack, user information is examined
 336    for quotes and other characters that might be used in an attack, and
 337    every such character is <strong>escaped</strong> by prefixing
 338    the character with a backslash ('\').  The backslash tells the
 339    database to treat the following character as data, not a
 340    command.</p>
 341  
 342    <p><a href="../PHPonTrax/InputFilter.html#methodsafeSQL">InputFilter::safeSQL()</a> may be called as a static
 343    method to screen character strings for threatening characters and
 344    apply the protective backslashes.  An open MySQL connection resource
 345    is needed to establish the appropriate character set.  For
 346    example:</p> 
 347  
 348    <pre class="example">$rs = mysql_connect('hostname', 'username', 'password');
 349  $unsafe = &quot;search term'; drop database employees;&quot;;
 350  $protected = InputFilter::safeSQL($unsafe,$rs);
 351  // $protected contains &quot;search term\'; drop database employees;&quot;</pre></span>
 352   <span><a name="process"></a><h2 class="title">process(): Protect Against HTML Tags and Attributes</h2><p><a href="../PHPonTrax/InputFilter.html#methodprocess">InputFilter::process()</a> eliminates potentially
 353    dangerous HTML tags and attributes from its input.  There are
 354    internal lists of
 355    <a href="../PHPonTrax/InputFilter.html#var$tagBlacklist">blacklisted tags</a> and
 356    <a href="../PHPonTrax/InputFilter.html#var$attrBlacklist">blacklisted attributes</a> than can
 357    optionally be removed from the input.  The constructor also accepts
 358    lists of forbidden tags and attributes and allows the listed names
 359    to be removed, or alternatively to be the only names
 360    accepted.</p>
 361  
 362    <p>To use this method, you must construct an object of the
 363    InputFilter class, with optional behavior specified in the
 364    constructor call. The options are stored as static attributes of the
 365    constructed object, so any reference to an object of the class will
 366    use the attributes in the most recent object.  Therefore it makes
 367    code more readable to use static calls. For example:</p>
 368  
 369    <pre class="example">@new InputFilter();
 370  $output_string = InputFilter::process($input_string);</pre>
 371  
 372    <p>The default constructor, as above, rejects all tags and
 373    attributes, returning only the text between tags.  You can construct
 374    an object which rejects only the blacklisted tags and attributes as
 375    follows:</p>
 376  
 377    <pre class="example">@new InputFilter(array(),array(),1,1,1);</pre>
 378  
 379    <p>You would probably be more secure if you listed what you know
 380    to be safe, instead of trying to think of everything that might
 381    be a threat:</p>
 382    <pre class="example">@new InputFilter(array('div','span','strong','em'),
 383                   array('id','class'),0,0,0);</pre></span>
 384   <span><a name="process_all"></a><h2 class="title">process_all(): Protect Against HTML in Request Variables</h2><p><a href="../PHPonTrax/InputFilter.html#methodprocess">InputFilter::process()</a> eliminates potentially
 385    dangerous HTML tags and attributes from the predefined globals
 386    <a href="http://www.php.net/reserved.variables#reserved.variables.post">$_POST</a>,
 387    <a href="http://www.php.net/reserved.variables#reserved.variables.get">$_GET</a>
 388    and
 389   <a href="http://www.php.net/reserved.variables#reserved.variables.request">$_REQUEST</a>.
 390    Call the method statically, as InputFilter::process_all() with the same
 391    arguments as used by <a href="../PHPonTrax/InputFilter.html#method__construct">the constructor</a>.
 392    A new object will be constructed with these options and then
 393    InputFilter::process() will be called on each of $_GET, $_POST and
 394    $_REQUEST.  The options in the call to process_all() are stored as
 395    static attributes of the new object, so they will be used on any calls to
 396    <a href="../PHPonTrax/InputFilter.html#methodprocess">InputFilter::process()</a> until another object is
 397    constructed.</p></span></div>
 398  <table width="100%" border="0" cellpadding="0" cellspacing="0">
 399  <tr>
 400  <td width="33%" align="left" valign="top"><a href="../PHPonTrax/tutorial_FormHelper.cls.html">Prev</a></td>
 401  <td width="34%" align="center" valign="top">&nbsp;</td>
 402  <td width="33%" align="right" valign="top"><a href=
 403  "../PHPonTrax/tutorial_ActionMailer.cls.html">Next</a></td>
 404  </tr>
 405  
 406  <tr>
 407  <td width="33%" align="left" valign="top">FormHelper</td>
 408  <td width="34%" align="center" valign="top"></td>
 409  <td width="33%" align="right" valign="top">ActionMailer</td>
 410  </tr>
 411  </table>
 412          <div class="credit">
 413              <hr />
 414              Documentation generated on Thu, 04 May 2006 19:46:55 -0600 by <a href="http://www.phpdoc.org">phpDocumentor 1.3.0RC4</a>
 415            </div>
 416        </td></tr></table>
 417      </td>
 418    </tr>
 419  </table>
 420  
 421  </body>
 422  </html>