Can anyone provide guidance on my issue? I am attempting to sanitize and validate user input from a form using PHP filters. The input will be stored in a MySQL database and displayed on an HTML page, so it is essential to remove all HTML tags and ensure security for MySQL.
Thank you in advance.
/*
* BEGIN Sanitize and validate
*/
// Define fields to be sanitized.
$filters = array(
'author' => FILTER_SANITIZE_SPECIAL_CHARS,
'title' => FILTER_SANITIZE_SPECIAL_CHARS,
'description' => FILTER_SANITIZE_SPECIAL_CHARS,
);
/*** Apply the filters to the POST array ***/
$filtered = filter_input_array(INPUT_POST, $filters);
// Filter out anything that is not an email address
$sanitized_email = filter_var(($_POST["email"]), FILTER_SANITIZE_EMAIL);
if (filter_var($sanitized_email, FILTER_VALIDATE_EMAIL) == TRUE) {
echo '';
} else {
echo 'Invalid Email Address. Please go back.';
exit;
}
/*
* BEGIN sanitize and validate
*/
I have made some updates to the code, but it is still not functioning correctly. The data is still showing HTML in the database, and the error handling is not working as intended.
/*
* BEGIN Sanitize and validate
*/
// Define fields to be sanitized.
$filters = array(
'author' => FILTER_SANITIZE_STRING,
'title' => FILTER_SANITIZE_STRING,
'description' => FILTER_SANITIZE_STRING,
);
/*** Apply the filters to the POST array ***/
$filtered = filter_input_array(INPUT_POST, $filters);
$filters = array_map('mysql_real_escape_string',$filters);
$filters = array_map('htmlspecialchars',$filters);
if (filter_var_array($filtered, FILTER_SANITIZE_STRING)) {
echo '';
} else {
echo 'Invalid Input. Please go back.';
exit;
}
// Filter out anything that is not an email address
$sanitized_email = filter_var(($_POST['email']), FILTER_SANITIZE_EMAIL);
if (filter_var($sanitized_email, FILTER_VALIDATE_EMAIL)) {
echo '';
} else {
echo 'Invalid Email Address. Please go back.';
exit;
}
/*
* BEGIN sanitize and validate
*/
2nd Edit below:
To display sanitized data in the database, I included the sanitizing code in the script section that handles data insertion into the database.
$_POST['author'] = mysql_real_escape_string(trim($_POST['author']));
$author=filter_var($_POST['author'], FILTER_SANITIZE_STRING);
$_POST['email'] = mysql_real_escape_string(trim($_POST['email']));
$email=filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
Now, I need to focus on properly validating the email.