Comments on: Writing Secure PHP Scripts – Part 1

By: Karolis

Karolis — Tue, 08 Jan 2008 18:26:45 +0000

Hello there, great article.
i have been using a slightly different approach.


##
# Get rid of magic quotes in .htaccess
#php_flag magic_quotes_gpc off
##

$cleanPost=array();

foreach($_POST as $key=>$value){
 $cleanPost[$key]=mysql_real_escape_string(htmlentities($value,ENT_QUOTES));
}

I combined htmlentities() and mysql_real_escape_string() for the sake of keeping it short.
Now, whenever i need a user submitted value from $_POST,
i reference $cleanPost instead.

I’d like to hear your opinion on this method.
Thanks

By: Ryan

Ryan — Sun, 04 Nov 2007 15:15:54 +0000

Thanks for this! I was gonna release a login form + some other scripts without any security knowledge..saved this in a category called very imp on my bookmarks

Thanks again

By: Igor

Igor — Fri, 14 Sep 2007 21:26:55 +0000

This is not only good stuff, it is _exceptionally_ well written — an all-too-rare combination. Thanks.

By: Frank

Frank — Thu, 30 Aug 2007 18:57:06 +0000

So, part one from 2005. When and where is part 2

By: Admin

Admin — Thu, 21 Jun 2007 00:50:31 +0000

vanj: There is no information here about encrypting email messages, so I am not sure what you mean.

By: vanj

vanj — Wed, 20 Jun 2007 09:11:33 +0000

Great articles and work!
I just have a question:

After sending the encripted email, will the receiver viewing the email be able to read the message using an any POP mail software like outlook or entourage?

Thanks!

By: Frank

Frank — Sat, 19 May 2007 05:11:55 +0000

Very helpful. I never came by the mailer issue until now. I am really glad I did!

-Frank

By: jeff

jeff — Wed, 18 Apr 2007 18:54:29 +0000

Very helpful information! I like the way you kept it focused, direct, and very practical. Many thanks!!

By: Abbe

Abbe — Mon, 16 Apr 2007 20:58:52 +0000

I enjoyed reading this useful, easy to read and understand, article and am looking forward to read next parts soon.
Thanks.

By: anna

anna — Thu, 05 Apr 2007 09:08:33 +0000

Can I write from PHP to an html form(a text area)

By: Peter

Peter — Thu, 21 Dec 2006 21:33:20 +0000

Thanks for the tutorial. I wasn’t aware of the special mysql_real_escape_string function. I will have go go through and make sure that I am securing my user input.

By: Matt

Matt — Mon, 28 Aug 2006 17:08:06 +0000

Thx. Was about to publish something with almost no user input secruity.

By: Admin

Admin — Wed, 08 Mar 2006 20:56:50 +0000

vipin: It is always a good idea. Never trust user input!

By: vipin

vipin — Wed, 08 Mar 2006 06:48:06 +0000

Is it must to validate all field seperately before sending mails in secure php mail scriptiing?

By: Admin

Admin — Sun, 19 Feb 2006 23:28:58 +0000

There may be, but I am not aware of any.

By: Gee

Gee — Sun, 19 Feb 2006 17:50:09 +0000

Is there any software which can check security holes in .php files?