0

hi i just reinstalled all my server for a virus. in my php o ckeck string from users with this function:

function make_safe($variable)
{
    $variable=nl2br($variable);
    $variable=mysql_real_escape_string(trim(strip_tags($variable, '<span><p><b><strong><i><u><br><hr><a><img>')));
    return $variable;
}

is this function safe enuoght? should i have to change something... any problems with images that i link form external websites?

Jk1
  • 11,233
  • 9
  • 54
  • 64
illinois
  • 500
  • 1
  • 4
  • 16
  • Never use `mysql*` functions in new code. – Wooble Jun 05 '13 at 12:41
  • Id say its kinda safe. But you should think about using mysqli instead of mysql. because mysql is too old. – Modestas Stankevičius Jun 05 '13 at 12:42
  • safe in what context actually? If you use that in combination with mysql functions, you should consider switching to prepared statements (PDO/MySqli) –  Jun 05 '13 at 12:43
  • Also, you ought to read the warning regarding strip_tags: "This function does not modify any attributes on the tags that you allow using allowable_tags, including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users." http://php.net/manual/en/function.strip-tags.php – PleaseStand Jun 05 '13 at 13:07

1 Answers1

0

I don't see how an image you don't download on your serveur could possibly damage it. It seems safe to me.

If you still need to check for a faulty code, that's probably somewhere else ;)

captain_torche
  • 1