PHP MySQL - Stilson.net

CHAPTER 13• WORKING WITH HTML FORMSwww.it-ebooks.infofunctions are conveniently available for doing so: escapeshellarg(), escapeshellcmd(),htmlentities(), and strip_tags(). As of PHP 5.2.0 you also have access to the native Filter extension,which offers a wide variety of validation and sanitization filters. The remainder of this section is devotedto an overview of these sanitization features.■ Note Keep in mind that the safeguards described in this section (and throughout the chapter), while effective,offer only a few of the many possible solutions at your disposal. For instance, in addition to the fouraforementioned functions and the Filter extension, you could also typecast incoming data to make sure it meetsthe requisite types as expected by the application. Therefore, although you should pay close attention to what’sdiscussed in this chapter, you should also be sure to read as many other security-minded resources as possible toobtain a comprehensive understanding of the topic.Escaping Shell ArgumentsThe escapeshellarg() function delimits its arguments with single quotes and escapes quotes. Itsprototype follows:string escapeshellarg(string arguments)The effect is such that when arguments is passed to a shell command, it will be considered a singleargument. This is significant because it lessens the possibility that an attacker could masqueradeadditional commands as shell command arguments. Therefore, in the previously described file-deletionscenario, all of the user input would be enclosed in single quotes, like so:/usr/bin/inventory_manager '50XCH67YU' '50; rm -rf *'Attempting to execute this would mean 50; rm -rf * would be treated by inventory_manager as therequested inventory count. Presuming inventory_manager is validating this value to ensure that it’s aninteger, the call will fail and no harm will be done.Escaping Shell MetacharactersThe escapeshellcmd() function operates under the same premise as escapeshellarg(), but it sanitizespotentially dangerous input program names rather than program arguments. Its prototype follows:string escapeshellcmd(string command)This function operates by escaping any shell metacharacters found in the command. Thesemetacharacters include # & ; ` , | * ? ~ < > ^ ( ) [ ] { } $ \ \x0A \xFF.You should use escapeshellcmd() in any case where the user’s input might determine the name of acommand to execute. For instance, suppose the inventory-management application is modified to allowthe user to call one of two available programs, foodinventory_manager or supplyinventory_manager, bypassing along the string food or supply, respectively, together with the SKU and requested amount. Theexec() command might look like this:292