0

In laravel 8 app when I submit form I need to clear any string input with htmlspecialchars_decode and stripslashes functions. Have I to write middleware and assign it to any post/put request?

Have laravel some plugings for that to be sure that I save in db only valid data?

Thanks in advance !

Petro Gromovo
  • 1,755
  • 5
  • 33
  • 91

1 Answers1

1

I think you can create middleware to modify request value like below

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class RequestModifier
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        $modifiedRequest=collect($request)->map(function ($inputValue,$inputName){
            //apply ur logic here.
           return htmlspecialchars_decode($inputValue);

        });
        $request->replace($modifiedRequest->toArray());

        return $next($request);
    }
}

then register it in kernal.php in protected $routeMiddleware

'requestModifier'=>RequestModifier::class
John Lobo
  • 14,355
  • 2
  • 10
  • 20
  • Thanks!. Could you please write which tests I have to make to protect my server from malicious code in text inputs when filling data? – Petro Gromovo Jun 13 '21 at 11:58
  • 1
    i think this post will help you https://stackoverflow.com/questions/1205889/how-to-prevent-code-injection-attacks-in-php depends on your scenario. – John Lobo Jun 13 '21 at 12:03
  • Thanks! Has laravel some standard plugins/tools for that? Suitable for most common cases when admin in backend area enters data(including ckEditor) and logged user fills in frontend area . Data are saved in dmysql and shows on site pages? – Petro Gromovo Jun 13 '21 at 13:23
  • i havent used any tools.let me check if any think available. – John Lobo Jun 13 '21 at 13:34
  • I found mews/purifier - seems good when outputing data entered in editors like skeditor. mysql_real_escape_string - must be used when insert data into database. But is mysql_real_escape_stringwrapped somewhere ? – Petro Gromovo Jun 14 '21 at 03:39
  • 1
    @PetroGromovo.as query related .laravel will already take care of sql injection.so dont worry about that – John Lobo Jun 14 '21 at 03:46