sanitizing input/output in php/codeigniter

Question

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output.

Background: Users can submit reviews to the site, and those reviews are displayed in certain views.

1) Posting Data. When posting data (using $this->input->post('review')), I'm concerned about using the XSS filter, because it removes the user data, and it's not possible to retrieve it, so I'm looking for another way to validate the input.

Turns out that for form validation, Codeigniter allows us to "use native PHP functions that permit one parameter." So I can use strip_tags, htmlentities, htmlspecialchars, etc.

Question: Which of these functions would you recommend I use in validating the user input? (or XSS, if you think it's better)

2) Database Queries. I am using CI's Active Record for my queries, so they are automatically escaped (just so you know I thought about and handled this)

3) Data Output. There are several views where output is displayed. I know that I need to escape the output. It usually looks something like this:

<?php echo $review; ?>

Question: Do I simply add a PHP function to the output, like below, or is there something else I should do to prevent any output from executing?

<?php echo htmlentities($review, ENT_QUOTES); ?>

Answer 1

I recommend reading through the resources that OWASP has available. This is a totally standard subject, and there's a lot written on it.

Make sure you do the input validation on the server. Don't trust the client to do input validation, since the client can be bypassed.

Input validation: The nature of input validation you do depends upon the type and expected range of possible values for the field. Usually you'll end up constructing a whitelist of allowed characters and checking that the input contains only those characters; or writing a regexp that characterizes valid inputs and checking against the regexp. This will likely be different for each input, because it needs to depend upon the type and expected range of values for that input.

You should combine input validation with output escaping. The proper form of output escaping depends upon where the data is being inserted into the output. For example, if you are interpolating data into a HTML document in between tags, then use htmlspecialchars to escape the data before inserting it into the HTML document (to prevent cross-site scripting). On the other hand, if you are inserting a URL, you also need to check that it uses one of a whitelisted set of protocols (e.g., http:, https:; but not javascript:).

Answer 2

Regarding your #1, you can always get the posted value and apply functions after. There is two possibilities you can use (but there is certainly more) :

1. Using PHP built-in filters, mostly FILTER_SANITIZE_STRING that will protect your string for sure.
2. You can use HTML Purifier. It will protect you agains't XSS without removing your user's data.

Now, it really depends on what you do with those submitted data. If it's just for an ID to be verified as an Integer, the filter_var with a validator flag will suffice. If you don't want your user to submit html for a review, I would go for a htmlspecialchars(), either on the server side (before adding in the database), or on the view side (when showing the string, aka #3).

#2 : You did it correctly. Nothing to add ;)

#3 : As @D.W. answered it perfectly, htmlspecialchars() should be the best for HTML outputting, and adapting what you output regarding where you output it (url, json, xml/html, etc).