2

Does the Codeignited cleans and secures the form input (for DB injection and XSS etc )automatically and I can use like following?

$this->input->post('name')

or do i need to secure it by myself? What would be the better way to do that? Thanks.

2
  • Secure it in what context? Against XSS? Against SQL injection?
    – alex
    Jun 14, 2011 at 5:13
  • @alex, yeah in both, for SQL injection and XSS etc.
    – Roman
    Jun 14, 2011 at 5:15

2 Answers 2

3

In "config.php" in your application's "config" folder, there's a settings for you to enable global XSS filtering:

$config['global_xss_filtering'] = FALSE;

The second parameter of the post() function specifies whether or not to apply the XSS filter to that line:

$this->input->post('name', TRUE);

Finally, you can use the form validation class to validate the data:

$this->form_validation->set_rules('name', 'Name', 'xss_clean');

You should avoid using the global XSS filtering as it's quite resource intensive.

3
  • Thanks for answer. Is it true that enabling global XSS filtering uses is resources costly? Also, if it is it is enavled globally in config file, wont it automatically apply? Do i still need to pass TRUE parameter? (eg. $this->input->post('name', TRUE); .
    – Roman
    Jun 14, 2011 at 5:22
  • @Roman if you apply it globally, you won't need to do it locally Jun 14, 2011 at 5:24
  • @Roman as @Damien said, you won't have to the , TRUE bit to the $this->input->port('name') but it is definitely costly and should be avoided because everything will go through it including cookies, GET and POST parameters, even the ones you don't want to go throughout the filter. Jun 14, 2011 at 5:27
2

NO, it doesn't give you 100% security.

Especially because it dependes on where the input goes. If you're concerned about XSS attacks, you could pass a TRUE as second paramether and have the XSS filter be applied to that input (but beware as the operation is quite costrly in term of resources, so don't use wildly)

$this->input->post('name', TRUE)

Read more on Input class on the USer Manual.

If the input is going into the database, than you either escape it manually with $this->db->escape() (and its other cousins), or you use query bindings or, for the sake of speed and simplicity, you can rely to the Active Record Class which automatically escapes all dats entering the query.
(this if you don't want to use your custom escaping, with mysql_real_escape_string, or the mysqli_ and PDO prepared statements)

Edit:

Yes, the XSS filter can be loaded in configs, but it's a very deep and thorough process, which takes up a lot of resources. As they say:

Note: This function should only be used to deal with data upon submission.
It's not something that should be used for general runtime processing since it requires
a fair amount of processing overhead.

Note that you also has Cross Site Request Forgery protection (CSRF) , more here.

If you're worried about performances, you could as well use php native htmlentities($str, ENT_QUOTES); before outputting $str on the html page.

4
  • Thanks, in the manual theres mentioned that the XSS filtering can be enabled by $config['global_xss_filtering'] = TRUE;. Did you mean this should be avoided because of resources?
    – Roman
    Jun 14, 2011 at 5:18
  • @Roman take a look at its code, it does a lot of checks and controlling, so yes, its quite a overheat, you should use it wisely and according to the case. Jun 14, 2011 at 5:25
  • Thanks man. is there any issue in enabling $config['csrf_protection'] = TRUE;, as they have not given any warning about it.
    – Roman
    Jun 14, 2011 at 5:32
  • @Roman, no, don't worry about that. But if you enable it, you have to use form helper to have the hidden field with the CSRF token added automatically Jun 14, 2011 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.