enough checks/validation for url variable passed to php script in url?

Question

I'm creating a script on my main server and will use js/html to call it as an image source, passing the current tumblr page's referrer variable so I can integrate my blog's stats into my main stat-tracking db.

Anyone who looks at the source, of course, will be able to see that this script can accept a url variable via get. I'm not much of a security wonk, but I'm using the following checks on the input to this var, currently:

$previous_referrer = htmlspecialchars($_GET['ref']);
if (filter_var($previous_referrer, FILTER_VALIDATE_URL) && strpos($_SERVER['HTTP_REFERER'], $tumblelog_url)!== FALSE)

I'm guessing it isn't this simple. What other checks should perform to lock it down against injection attacks?

grunk · Accepted Answer · 2011-02-07 10:30:19Z

1

For inserting data safely in a database :

1) Before inserting in DB

Filter data :

Does my data had the expected type/patern (email,url ....)

The main purpose of filtering in first is to avoid processing useless data

Prevent from sql injection :

if inserting a number use function like intval(),floatval()
if inserting string use function like mysql_real_escape_string (for mysql only) or prepared statement.

2) After insertion , before display

Prevent Xss by using function like htmlspecialchars() or htmlentites().

edited Feb 7, 2011 at 10:30

answered Feb 7, 2011 at 8:45

grunk

15k16 gold badges69 silver badges111 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

enough checks/validation for url variable passed to php script in url?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related