PhpRiot
News Archive
PhpRiot Newsletter
Your Email Address:

More information

DevShed: Sanitizing Input with PHP

Note: This article was originally published at PHPDeveloper on 14 December 2011.
PHPDeveloper

DevShed.com has a new tutorial posted today looking at how to sanitize data in your application, specifically data coming from the user, when calling shell commands.

Neglecting to sanitize user input that may subsequently be passed to system-level functions could allow attackers to do massive internal damage to your information store and operating system, deface or delete Web files, and otherwise gain unrestricted access to your server. And that's only the beginning.

He starts with a "real world" example of non-filtered data that could pass through a "rm" command and erase your entire drive. He offers two solutions for preventing this sort of hack using the escapeshellcmd and escapeshellarg functions.