Codeigniter - Best Practices for Disinfecting Materials

Question

I would like to know what is the best practice for disinfecting user input with Codeigniter.

I understand that CI offers form_validation, like set_rules.

'set_rules'=>'trim|xss_clean|alpha_numeric|htmlspecialchars' 

"Any native PHP function that takes a single parameter can be used as a rule, for example, htmlspecialchars, trim, MD5, etc."

Now my question is:

enough to protect us from xss, sql etc. attacks?

What other rules are there that I can apply?

In terms of performance, is it expensive for us to apply all of these rules to all inputs?

I understand that MD5 is a hash function, but what happens if you install MD5 as part of the rule?

above that i added also javascript check. Am I on the right track to sanitize user input and validate user input? Please advice.

Answer 1

Sanitizing is more than just starting your login through all sorts of filters.

Sanitizing your input is not contaminating your application with user data that you do not need.
The big question, however, is, what do you not want?

First example

You have created a page that allows the user to send a text message. Your expected entry will be a phone number and a text message.
Looking at the rule link in the manual, I would probably go for these rules:

 numeric|exact_length[8] 

These rules, as I would like to make sure that the input is nummeric and that the input matches the length of the phonenumbers in my region. Since I already confirm that the input is numeric, I can assume that attempts to inject XSS and SQL should fail (since these attacks contain non-numeric characters).

In the text message field, I use trim and be sure to: trim|required , because I am not sending an empty message.

Second example

Enabling users to comment is a good way to allow users to spam your site or enter malicious code.

Basically, the fact that you are not a name, email and comment.

All input required. Email must be verified. But the comment and name should have some cleanup of XSS and service spaces / lines.

My sanitazion check would look like this:

 $this->form_validation->set_rules('name', 'Name', 'required|trim|xss_clean'); $this->form_validation->set_rules('email', 'Email', 'required|trim|valid_email'); $this->form_validation->set_rules('comment', 'Comment', 'required|trim|xss_clean'); 

Sanitize what you must — not what you can — and make sanitazitone for what you need.
Make sure when you paste data into your server to use Active Record / Query Builder to exit your input correctly or use Query Bindings , which does the same for you.

Answer 2

Private function if you are looking for

 function sanitizeString($value = ''){ $value = trim($value); if (get_magic_quotes_gpc()) { $value = stripslashes($value); } $value = strtr($value,array_flip(get_html_translation_table(HTML_ENTITIES))); $value = strip_tags($value); $value = mysqli_real_escape_string(get_mysqli(), $value); $value = htmlspecialchars($value); return $value; } function get_mysqli() { $db = (array)get_instance()->db; return mysqli_connect('localhost', $db['username'], $db['password'], $db['databse']); } 

I use this as a custom function to sanitize every parameter passed in the form, in the future we can add more custom functions, I hope. Always having a custom function is an advantage of array_map or array_walk can also be used to simplify it for arrays like $ _GET, $ _POST, etc.