[php]regex: most effective validation?

[soma]

Does using regex for all form and URL variables insure the maximum security for a website? I'm about to implement some form/url validation and regex is the most secure thing I am aware of in php...

Any thoughts or advice would be great.

Thanks.

[ratbastid]

Well, look.... Using regular expressions doesn't magically make your input secure. That would be like saying, I want to make a pie. I have apples. Do apples make a good pie? Like, yes, but there's a whole lot more to it than that.

Anything you could do with a regular expression you could do with a whole bunch of strpos() calls. WAY less efficiently, but... preg_match() is a powerful tool, but it's really just another tool.

There are LOTS of php snippets out there that sanitize inputs. I recommend you google a little bit and see what you find. You really don't want to be rolling your own, when it comes to security. Especially if you're at the stage where you're asking questions like this--no offense, but the question tells me you don't have a huge amount of experience with this. Go find a script written by an expert; it's not smart to take chances with security.

[Silvy]

Regular expressions are, like ratbastid said, a very powerful tool. And yes, it can help you sanitize the input.
Main question is: what do you plan on using the input for? Make sure that the input values cannot break any place you're using it at.

At least I'd check for:
- length (make sure everyplace you use the input value, that it is not too big, for example: database)
- type (expecting a number? use is_numeric() to find out wether it is one)
- special characters (This is the most important part. use html_entities() to prevent javascript injection for example. But also look out for SQL injections...)

There are many examples found around the 'net to sanitze input. There are also alot more functions avaible to help you.

[soma]

What other funcitons should I be aware of. Right now, I sanitize my variables by sending them through the following homemade function:

function make_safe($variable) {
$variable = htmlspecialchars(trim(mysql_escape_string($variable)));
return $variable;
}

And now I'm trying to use regex functions to die(); whatever is running if any unwanted characters show up. I'm also going to make different database users instead of using one super user.

That's about the extent of my PHP security knowledge. I know I'm not experienced in this area but am devoting a lot of time to learn more about it. I know not having a super secure site will cause much trouble down the road.

[kofspades]

I've never written in PHP, but another good security tip is to always use bind variables in your sql statements. I do not know if PHP supports this.

[ratbastid]

Why die()? Usually die() results in a partial page or a server error message being displayed. I doubt that's what you mean to do. Probably you'd like to put the form back out and ask the user to clean up their input. Maybe if you're super anal and the input you caught was an obvious assualt, you log their IP and don't let them see the form again.

[soma]

Yeah, die(); is a bit inconvenient at times. Whenever I have die(); in a function, what I usually do is have an includes footer.php right afterwards. It works, but I don't think it's too terribly ... great. I'll try what you have suggested. I like the idea of logging the IP of potentially malicious users.

[trache]

I think you should make some hard and fast rules about your input. Say, length or only numbers and test your input against them. Then start with your regular expressions.

If you receive any errors, push an error string onto an array. When you go and display your page after the user hits submit and the form starts to process the input, if the array is not empty, display the errors, don't die().

If you are a good webmaster (and we know that you are!), you will fill the partial form out with the users input from the submission, as we know that no one likes to input anything twice. :-)

Log the bad submissions because then you can decide whether or not to add more checks into your code.

Also, it is good to use the (add|strip)slashes when handling data from your database.

#1 rule? Don't trust the user to do anything you ask. That includes adding things like if ($admin == 1) with things like register_globals. I can easily add ?admin=1 to the form and have superuser access to your website. Remember to turn register_globals off and use _GET, _POST etc with the _SERVER["REQUEST_METHOD"] variable.

Check things like referrers (not always accurate or should be taken into consideration).

Put a hidden variable on your form and put that variable into a database. When the user submits the form, make sure that variable is in the database (for a short time). That will cut down on spoofing.