Methods of data filtering in PHP _php tips

At the beginning of the guide, we said that data filtering is the cornerstone of Web application security in any language, on any platform. This includes testing the data entered into the application and the output from the application, and a good software design can help developers to:
Ensure that data filtering cannot be bypassed,
Make sure that the illegal information does not affect the legitimate information and
Identify the source of the data.
There are various views on how to ensure that data filtering cannot be bypassed, and two of these views are more versatile and provide a higher level of protection than others.
Scheduling method
This method is scheduled with a single PHP script (via URL). Any other action is included with include or require when necessary. This method generally requires each URL to pass a separate get variable for scheduling. This get variable can be thought of as a simpler design to replace the script name. For example:
Http://a.org/dispatch.php?task=PRint_formdispatch.php is the only root file (document root). It allows developers to do two things that are very important:
At the beginning of the dispatch.php, some global security processing is implemented, and it is ensured that these processes cannot be bypassed.
It is easy to determine the data filtering in the necessary place, especially for some special purpose control flow operations.
Look at the following example to further discuss the dispatch.php script:
<?php/* Global Security Handling */switch ($_get[' task ') {case ' print_form ': include '/inc/presentation/form.inc '; Break;case ' Process_form ': $form _valid = False;include '/inc/logic/process.inc '; if ($form _valid) {include '/inc/presentation/ End.inc ';} Else{include '/inc/presentation/form.inc ';} Break;default:include '/inc/presentation/index.inc '; > If this is the only publicly accessible PHP script, the one thing you can be sure of is that the program is designed to ensure that the initial global security process cannot be bypassed. It also makes it easy for developers to see the control process for specific tasks. For example, it's easy to know that when $form_valid is true, you don't need to browse the entire code: End.inc is the only one that is displayed to the user, and because it is only initialized to False before Process.inc is included, it is possible to determine that the internal logic of PROCESS.INC will set it to true; otherwise the form will appear again (possibly with related error messages).
Attention
If you use directory-directed files, such as index.php (instead of dispatch.php), you can use URL addresses like this: Http://a.org/?task=print_form.
You can also use Apacheforcetype redirection or mod_rewrite to adjust the URL address: Http://a.org/app/print-form.
Include method
Another way is to use a separate module, which is responsible for all security handling. This module is included in the front end of all publicly available PHP scripts (or the very front part). Refer to the script below Security.inc

Copy Code code as follows:

<?phpswitch ($_post[' form ') {case ' login ': $allowed = Array (); $allowed [] = ' form '; $allowed [] = ' username '; $allowed [] = ' PassWord '; $sent = Array_keys ($_post); if ($allowed = = $sent) {include '/inc/logic/process.inc ';} break;}? >

In this case, each submitted form considers that it should contain the unique validation value of form, and security.inc independently processes 0 of the data that needs to be filtered in the form. The HTML form that implements this requirement is shown below:

Copy Code code as follows:

<form action= "/receive.php" method= "POST" ><input type= "hidden" name= "form" value= "Login"/><p> Username:<input type= "text" name= "Username"/></p><p>password:<input type= "Password" Password "/></p><input type=" Submit "/></form>

An array called $allowed is used to verify which form variables are allowed, and the list should be consistent before the form is processed. Process Control determines what to do, and Process.inc is where the data is actually filtered.
Attention
It is better to make sure that Security.inc is always included in the first position of each script by using the Auto_prepend_file setting.
Examples of filtering
The establishment of whitelist is very important for data filtering. Because it is not possible to give examples of each form data that may be encountered, some examples can help you to have a general understanding of this.
The following code verifies the e-mail address:

Copy Code code as follows:

<?php$clean = Array (); $email _pattern = '/^[^@\s<&>]+@ ([-a-z0-9]+\.) +[a-z]{2,}$/i '; if (Preg_match ($email _pattern, $_post[' email ')) {$clean [' email '] = $_post[' email ']; >

The following code ensures that the contents of $_post[' color ' are red,green, or blue:

Copy Code code as follows:

[/co<?php$clean = array (); switch ($_post[' color ']) {case ' red ': Case ' green ': Case ' Blue ': $clean [' color '] = $_post[' Color '];break; >de]
The following code ensures that $_post[' num ' is an integer (integer):
[Code]
<?php$clean = Array (); if ($_post[' num '] = = Strval (intval ($_post[' num '))) {$clean [' num '] = $_post[' num ']; >

The following code ensures that $_post[' num ' is a floating-point number (float):

Copy Code code as follows:

<?php$clean = Array (); if ($_post[' num '] = = Strval (floatval ($_post[' num '))) {$clean [' num '] = $_post[' num ']; >

Name Conversion
Each of the previous examples uses an array $clean. This is a good habit for developers to determine whether the data has a potential threat. Never, after validating data, keep it in $_post or $_get, as developers should always remain fully skeptical of data stored in the Super Global array.
To add, the use of $clean can help to think about what's not being filtered, which is more like a whitelist role. Can raise the level of security.
If only the validated data is stored in $clean, the only risk to data validation is that the array element you are referencing does not exist, rather than the unfiltered risk data.
Time
Once the PHP script starts executing, it means that the HTTP request has all ended. At this point, the user will not have the opportunity to send data to the script. Therefore, no data can be entered into the script (even if the register_globals is opened). That's why initializing variables is a very good habit.