php validating output with htmlspecialchars

Question

I set a php cookie

setcookie('pr','gulfstream',time()...etc...)

My validation page has arrays and statements as below.

$planes = array('gulfstream','Piper','Citation');

$abc = isset($_COOKIE['pr']) && in_array($_COOKIE['pr'],$planes) ? $_COOKIE['pr']:0;

My visitor pages use:

echo $abc;

Question: is the above safe to output to the page or should I further validate the statement with:

$abc = isset($_COOKIE['pr']) && in_array($_COOKIE['pr'],$planes) ? htmlspecialchars($_COOKIE['pr']):0;

Jakub Matczak · Accepted Answer · 2014-03-30 16:15:46Z

1

I don't think there's a way to exploit this code in this example.

Anyway I think you have to be aware that it's is to make it exploitable by possibility of type juggling (usually cast to integer 0). That's why I suggest you to use strict mode of in_array like

in_array($_COOKIE['pr'],$planes, true); //third parameter enforces type checking

edited Mar 30, 2014 at 16:15

answered Mar 30, 2014 at 16:07

Jakub Matczak

15.7k5 gold badges52 silver badges68 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

AllThisOnAnACER Over a year ago

Right, that's good advice. I'll set that. Are you also saying I don't need htmlspecialchars() in the statement?

Jakub Matczak Over a year ago

You don't need it since when it is actually a string-to-string comparison, you know what values will be accepted.

AllThisOnAnACER Over a year ago

Thanks dragoste, that's a wrap.

JW. · Accepted Answer · 2014-03-30 16:20:14Z

1

Even if you've validated the cookie, it's still meant to contain text, and not HTML code. You should always use htmlspecialchars before outputting text in an HTML document.

answered Mar 30, 2014 at 16:20

JW.

51.9k39 gold badges125 silver badges152 bronze badges

3 Comments

AllThisOnAnACER Over a year ago

#JW Ok, wait, so you are saying I should go ahead and put that in the location I indicated in the original post?

JW. Over a year ago

I would keep variables un-encoded, and just encode them when you output them in your HTML. That way you can do other things with the variables, like check their length, without the encoding affecting the results.

AllThisOnAnACER Over a year ago

Understood, but there are just too many of them in too many pages, I need to do this at this central point on the validation page. That being the case, in my original post, is the location of the htmlspecialchars() correct, in your estimation?

Collectives™ on Stack Overflow

php validating output with htmlspecialchars

2 Answers 2

3 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related