I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output.
Background: Users can submit reviews to the site, and those reviews are displayed in certain views.
1) Posting Data. When posting data (using $this->input->post('review')), I'm concerned about using the XSS filter, because it removes the user data, and it's not possible to retrieve it, so I'm looking for another way to validate the input.
Turns out that for form validation, Codeigniter allows us to "use native PHP functions that permit one parameter." So I can use strip_tags, htmlentities, htmlspecialchars, etc.
Question: Which of these functions would you recommend I use in validating the user input? (or XSS, if you think it's better)
2) Database Queries. I am using CI's Active Record for my queries, so they are automatically escaped (just so you know I thought about and handled this)
3) Data Output. There are several views where output is displayed. I know that I need to escape the output. It usually looks something like this:
<?php echo $review; ?>
Question: Do I simply add a PHP function to the output, like below, or is there something else I should do to prevent any output from executing?
<?php echo htmlentities($review, ENT_QUOTES); ?>