10

Possible Duplicate:
What are the best PHP input sanitizing functions?

Is using htmlspecialchars() for input/output HTML sanitization, for MySQL database bad design?

Should you instead just not allow these "dangerous" signs because it still will show b-tags,i-tags and others? And how to do so?

I'm asking because it says on wiki http://en.wikipedia.org/wiki/HTML_sanitization

"HTML sanitization can be used to protect against cross-site scripting and SQL injection attacks by sanitizing any HTML code submitted by a user."

So besides using PDO prepared statements, to prevent SQL-injections, i want to use this htmlspecialchars for all input and output. But maybe I should use something else?

Is this a good way to do an insert statement for instance?:

$type= htmlspecialchars($_POST['animaltype']);
$name= htmlspecialchars($_POST['animalname']);
$age= htmlspecialchars($_POST['animalage']);        
$descr= htmlspecialchars($_POST['animaldescription']);
$foto= htmlspecialchars($_POST['animalfotourl']);
$date=htmlspecialchars($_POST['animalhomelessdate']);



$sqlquery  = "INSERT INTO animals_tbl(animaltype, animalname, animalage, animaldescription, animalfotourl, animalhomelesssince) VALUES (':type',':name',':age',':descr', ':foto', ':date')";


$stmt = $conn->prepare($sqlquery);
$stmt->bindParam(':type',$type, PDO::PARAM_STR);
$stmt->bindParam(':name',$name, PDO::PARAM_STR);
$stmt->bindParam(':age',$age, PDO::PARAM_INT);
$stmt->bindParam(':descr',$descr, PDO::PARAM_STR);
$stmt->bindParam(':foto',$foto, PDO::PARAM_STR);
$stmt->bindParam(':date',$date, PDO::PARAM_STR);

$stmt->execute();
6
  • That quote is wrong and dangerously misleading.
    – SLaks
    Jan 3, 2013 at 23:25
  • 3
    @SLaks I have edited the Wikipedia article to remove the reference to SQL injection, as it's a completely different topic.
    – cdhowie
    Jan 3, 2013 at 23:27
  • You might find this answer useful too: stackoverflow.com/questions/1205889/…
    – el_pup_le
    Jan 3, 2013 at 23:31
  • Sanitize while outputting, not while inserting into database. And Use htmlpurifier. It is written for this purpose.
    – itachi
    Jan 3, 2013 at 23:47
  • @itachi, should be opposite of that. If you didn't sanitize while inputting how would you keep track of what fields need to be sanitized when you do output? Are you going to sanitize every field when outputting, regardless if it was never user supplied?
    – kittycat
    Jan 4, 2013 at 2:22

2 Answers 2

17

htmlspecialchars() is sufficient to escape text for browsers. This will protect other site users from XSS attacks.

However, I would only run this function when displaying data. Storing escaped content in a database seems like poor design to me. The database should store actual content, not munged content. Escape things as necessary at each layer, and no sooner.


To illustrate why this is a bad idea, consider a web site that is working on implementing a JSON-driven API. If they are storing HTML-encoded data in their database, they have two choices: (a) have HTML-encoded data in their JSON responses (which makes no sense), or (b) decode the HTML back to its original form before JSON-encoding it. Both choices are sub-optimal.

Data goes in the database, JSON strings go in JSON documents, and HTML-encoded data goes in HTML documents. Don't mix them!

18
  • So what should i do when storing the data? If i don't use htmlspecialchars when storing the data, i'm vunurable for XSS, or what? Jan 3, 2013 at 23:31
  • @user1938304 When you output the data from the database is when you use it. Read more about what an XSS attack is, and how they are executed and you may understand more.
    – John V.
    Jan 3, 2013 at 23:33
  • 3
    @user1938304 You don't do anything to the data when you store it (aside from SQL-escaping it, if you are not using prepared queries -- and you should really be using prepared queries). The data in the database should be exactly what the user entered. When you render that data into an HTML document, that is when you use htmlspecialchars(). When you render that data into a JSON document, that is when you JSON-encode it.
    – cdhowie
    Jan 3, 2013 at 23:33
  • 1
    Prepared statements do not protect your users from XSS, they protect your database from SQL injection. These are two different topics; dissociate them in your mind.
    – cdhowie
    Jan 3, 2013 at 23:57
  • 2
    @user1938304 Use htmlspecialchars() after you fetch the data from the database. The same thing I've told you at least three times now.
    – cdhowie
    Jan 4, 2013 at 0:05
-1

If you use PDO -- with proper used prepared statements --, you dont have to sanitize your input. But to make sure you wont get XSS attacks, I would use htmlspecialchars before ou put it in your DB.

4
  • 3
    Not before putting it in your database, but when displaying it on your page :)
    – Jeffrey
    Jan 3, 2013 at 23:27
  • Okay so to be clear: PDO prepared statements to prevent SQL-injections, and htmlspecialchars to prevent XSS? I tried to understand what XSS is it, but i'm not really sure? Jan 3, 2013 at 23:28
  • @user1938304 XSS takes advantage of the lack of HTML escaping on sites. For example, your users could submit data that includes <script> tags, and your site will relay that data to other users, where the JavaScript will run. This gives attackers a way to execute programs on other people's computers, and it can be used to steal session cookies or worse.
    – cdhowie
    Jan 3, 2013 at 23:30
  • Okay, but if i'm using prepared staments, is that preventing XSS, because it will do the escaping for me? Or should i also use bindParam()? Jan 3, 2013 at 23:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.