3

I currently have a fairly robust server-side validation system in place, but I'm looking for some feedback to make sure I've covered all angles. Here is a brief outline of what I'm doing at the moment:

  • Ensure the input is not empty, or is too long

  • Escape query strings to prevent SQL injection

  • Using regular expressions to reject invalid characters (this depends on what's being submitted)

  • Encoding certain html tags, like <script> (all tags are encoded when stored in a database, with some being decoded when queried to render in the page)

Is there anything I'm missing? Code samples or regular expressions welcome.

conmulligan
  • 7,038
  • 6
  • 33
  • 44
  • On bullet three, I would change that to say "using regular expressions to accept only valid characters." That is, specify what you accept, rather than trying to think of everything bad that you could possibly reject. – bmb Sep 29 '08 at 00:19

5 Answers5

8

You shouldn't need to "Escape" query strings to prevent SQL injection - you should be using prepared statements instead.

Ideally your input filtering will happen before any other processing, so you know it will always be used. Because otherwise you only need to miss one spot to be vulnerable to a problem.

Don't forget to encode HTML entities on output - to prevent XSS attacks.

2

You should encode every html tag, not only 'invalid' ones. This is a hot debate, but basically it boils down to there will always be some invalid HTML combination that you will forget to handle correctly (nested tags, mismatched tags some browsers interpret 'correctly' and so on). So the safest option in my opinion is to store everything as htmlentities and then, on output, print a validated HTML-safe-subset tree (as entities) from the content.

Vinko Vrsalovic
  • 330,807
  • 53
  • 334
  • 373
  • All tags are encoded when stored in a database, but I want some to render in the page so these are decoded when queried, with the exception of some like the script tag. I've amended the question to reflect this. – conmulligan Sep 28 '08 at 22:11
1

Run all server-side validation in a library dedicated to the task so that improvements in one area affect all of your application.

Additionally include work against known attacks, such as directory traversal and attempts to access the shell.

1

This Question/Answer has some good responses that you're looking for
(PHP-oriented, but then again you didn't specify language/platform and some of it applies beyond the php world):

What's the best method for sanitizing user input with PHP?

Community
  • 1
  • 1
micahwittman
  • 12,356
  • 2
  • 32
  • 37
1

You might check out the Filter Extension for data filtering. It won't guarantee that you're completely airtight, but personally I feel a lot better using it because that code has a whole lot of eyeballs looking over it.

Also, consider prepared statements seconded. Escaping data in your SQL queries is a thing of the past.

Bob Somers
  • 7,266
  • 5
  • 42
  • 46