Skip to content

Commit

Permalink
Added function to sanitize db/table names.
Browse files Browse the repository at this point in the history 
git-svn-id: file:///Users/Shitiz/Downloads/lssvn/source/phpsurveyor@2012 b72ed6b6-b9f8-46b5-92b4-906544132732
  • Loading branch information
David Olivier committed Aug 23, 2006
1 parent 9a2c270 commit 8f1e4e9
Showing 1 changed file with 138 additions and 131 deletions.
269 changes: 138 additions & 131 deletions classes/core/sanitize.php
View file
@@ -1,28 +1,28 @@
<?
/*
* Copyright (c) 2002,2003 Free Software Foundation
* developed under the custody of the
* Open Web Application Security Project
* (http://www.owasp.org)
*
* This file is part of the PHP Filters.
* PHP Filters is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PHP Filters is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU General Public License for more details.
*
* If you are not able to view the LICENSE, which should
* always be possible within a valid and working PHP Filters release,
* please write to the Free Software Foundation, Inc.,
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
* to get a copy of the GNU General Public License or to report a
* possible license violation.
*/
* Copyright (c) 2002,2003 Free Software Foundation
* developed under the custody of the
* Open Web Application Security Project
* (http://www.owasp.org)
*
* This file is part of the PHP Filters.
* PHP Filters is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* PHP Filters is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the GNU General Public License for more details.
*
* If you are not able to view the LICENSE, which should
* always be possible within a valid and working PHP Filters release,
* please write to the Free Software Foundation, Inc.,
* 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
* to get a copy of the GNU General Public License or to report a
* possible license violation.
*/
///////////////////////////////////////
// sanitize.inc.php
// Sanitization functions for PHP
Expand Down Expand Up @@ -78,195 +78,202 @@
// addslashes wrapper to check for gpc_magic_quotes - gz
function nice_addslashes($string)
{
// if magic quotes is on the string is already quoted, just return it
if(MAGIC_QUOTES)
return $string;
else
return addslashes($string);
// if magic quotes is on the string is already quoted, just return it
if(MAGIC_QUOTES)
return $string;
else
return addslashes($string);
}

// internal function for utf8 decoding
// thanks to Hokkaido for noticing that PHP's utf8_decode function is a little
// screwy, and to jamie for the code
function my_utf8_decode($string)
{
return strtr($string,
"???????¥ Ä Ä á °·· ˜ ",
"SOZsozYYuAAAAAAACEEEEIIIIDNOOOOOOUUUUYsaaaaaaaceeeeiiiionoooooouuuuyy");
return strtr($string,
"???????? ? ? ? ??? ? ",
"SOZsozYYuAAAAAAACEEEEIIIIDNOOOOOOUUUUYsaaaaaaaceeeeiiiionoooooouuuuyy");
}

// paranoid sanitization -- only let the alphanumeric set through
function sanitize_paranoid_string($string, $min='', $max='')
{
$string = preg_replace("/[^a-zA-Z0-9]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
$string = preg_replace("/[^a-zA-Z0-9]/", "", $string);
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}

// sanitize a string in prep for passing a single argument to system() (or similar)
function sanitize_system_string($string, $min='', $max='')
{
$pattern = '/(;|\||`|>|<|&|^|"|'."\n|\r|'".'|{|}|[|]|\)|\()/i'; // no piping, passing possible environment variables ($),
// seperate commands, nested execution, file redirection,
// background processing, special commands (backspace, etc.), quotes
// newlines, or some other special characters
$string = preg_replace($pattern, '', $string);
$string = '"'.preg_replace('/\$/', '\\\$', $string).'"'; //make sure this is only interpretted as ONE argument
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
$pattern = '/(;|\||`|>|<|&|^|"|'."\n|\r|'".'|{|}|[|]|\)|\()/i'; // no piping, passing possible environment variables ($),
// seperate commands, nested execution, file redirection,
// background processing, special commands (backspace, etc.), quotes
// newlines, or some other special characters
$string = preg_replace($pattern, '', $string);
$string = '"'.preg_replace('/\$/', '\\\$', $string).'"'; //make sure this is only interpretted as ONE argument
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return $string;
}

// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_sql_string($string, $min='', $max='')
{
$string = nice_addslashes($string); //gz
$pattern = "/;/"; // jp
$replacement = "";
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, $replacement, $string);
$string = nice_addslashes($string); //gz
$pattern = "/;/"; // jp
$replacement = "";
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, $replacement, $string);
}

// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_sql_db_tablename($string)
{
$bad = array ('*','^','&','\'','-',';','\"','(',')','%','$','?');
return str_replace($bad, "",$string);
}

// sanitize a string for SQL input (simple slash out quotes and slashes)
function sanitize_ldap_string($string, $min='', $max='')
{
$pattern = '/(\)|\(|\||&)/';
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, '', $string);
$pattern = '/(\)|\(|\||&)/';
$len = strlen($string);
if((($min != '') && ($len < $min)) || (($max != '') && ($len > $max)))
return FALSE;
return preg_replace($pattern, '', $string);
}


// sanitize a string for HTML (make sure nothing gets interpretted!)
function sanitize_html_string($string)
{
$pattern[0] = '/\&/';
$pattern[1] = '/</';
$pattern[2] = "/>/";
$pattern[3] = '/\n/';
$pattern[4] = '/"/';
$pattern[5] = "/'/";
$pattern[6] = "/%/";
$pattern[7] = '/\(/';
$pattern[8] = '/\)/';
$pattern[9] = '/\+/';
$pattern[10] = '/-/';
$replacement[0] = '&amp;';
$replacement[1] = '&lt;';
$replacement[2] = '&gt;';
$replacement[3] = '<br>';
$replacement[4] = '&quot;';
$replacement[5] = '&#39;';
$replacement[6] = '&#37;';
$replacement[7] = '&#40;';
$replacement[8] = '&#41;';
$replacement[9] = '&#43;';
$replacement[10] = '&#45;';
return preg_replace($pattern, $replacement, $string);
$pattern[0] = '/\&/';
$pattern[1] = '/</';
$pattern[2] = "/>/";
$pattern[3] = '/\n/';
$pattern[4] = '/"/';
$pattern[5] = "/'/";
$pattern[6] = "/%/";
$pattern[7] = '/\(/';
$pattern[8] = '/\)/';
$pattern[9] = '/\+/';
$pattern[10] = '/-/';
$replacement[0] = '&amp;';
$replacement[1] = '&lt;';
$replacement[2] = '&gt;';
$replacement[3] = '<br>';
$replacement[4] = '&quot;';
$replacement[5] = '&#39;';
$replacement[6] = '&#37;';
$replacement[7] = '&#40;';
$replacement[8] = '&#41;';
$replacement[9] = '&#43;';
$replacement[10] = '&#45;';
return preg_replace($pattern, $replacement, $string);
}

// make int int!
function sanitize_int($integer, $min='', $max='')
{
$int = intval($integer);
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
return FALSE;
return $int;
$int = intval($integer);
if((($min != '') && ($int < $min)) || (($max != '') && ($int > $max)))
return FALSE;
return $int;
}

// make float float!
function sanitize_float($float, $min='', $max='')
{
$float = floatval($float);
if((($min != '') && ($float < $min)) || (($max != '') && ($float > $max)))
return FALSE;
return $float;
$float = floatval($float);
if((($min != '') && ($float < $min)) || (($max != '') && ($float > $max)))
return FALSE;
return $float;
}

// glue together all the other functions
function sanitize($input, $flags, $min='', $max='')
{
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & SQL) $input = sanitize_sql_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max);
return $input;
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & SQL) $input = sanitize_sql_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max);
return $input;
}

function check_paranoid_string($input, $min='', $max='')
{
if($input != sanitize_paranoid_string($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_paranoid_string($input, $min, $max))
return FALSE;
return TRUE;
}

function check_int($input, $min='', $max='')
{
if($input != sanitize_int($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_int($input, $min, $max))
return FALSE;
return TRUE;
}

function check_float($input, $min='', $max='')
{
if($input != sanitize_float($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_float($input, $min, $max))
return FALSE;
return TRUE;
}

function check_html_string($input, $min='', $max='')
{
if($input != sanitize_html_string($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_html_string($input, $min, $max))
return FALSE;
return TRUE;
}

function check_sql_string($input, $min='', $max='')
{
if($input != sanitize_sql_string($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_sql_string($input, $min, $max))
return FALSE;
return TRUE;
}

function check_ldap_string($input, $min='', $max='')
{
if($input != sanitize_string($input, $min, $max))
return FALSE;
return TRUE;
if($input != sanitize_string($input, $min, $max))
return FALSE;
return TRUE;
}

function check_system_string($input, $min='', $max='')
{
if($input != sanitize_system_string($input, $min, $max, TRUE))
return FALSE;
return TRUE;
if($input != sanitize_system_string($input, $min, $max, TRUE))
return FALSE;
return TRUE;
}

// glue together all the other functions
function check($input, $flags, $min='', $max='')
{
$oldput = $input;
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & SQL) $input = sanitize_sql_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max, TRUE);
if($input != $oldput)
return FALSE;
return TRUE;
$oldput = $input;
if($flags & UTF8) $input = my_utf8_decode($input);
if($flags & PARANOID) $input = sanitize_paranoid_string($input, $min, $max);
if($flags & INT) $input = sanitize_int($input, $min, $max);
if($flags & FLOAT) $input = sanitize_float($input, $min, $max);
if($flags & HTML) $input = sanitize_html_string($input, $min, $max);
if($flags & SQL) $input = sanitize_sql_string($input, $min, $max);
if($flags & LDAP) $input = sanitize_ldap_string($input, $min, $max);
if($flags & SYSTEM) $input = sanitize_system_string($input, $min, $max, TRUE);
if($input != $oldput)
return FALSE;
return TRUE;
}

?>

0 comments on commit 8f1e4e9

Please sign in to comment.