0

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely.

if(!filter_var($_GET["ip"], FILTER_VALIDATE_IP)) {
    echo "Invalid IP.";
    die();
}

$ip = (string)$_GET["ip"];

Is this secure enough to be able to put $ip in a database or display it on a page? Or are there any vulnerabilities with FILTER_VALIDATE_IP (or perhaps the way the code is structured) that I should worry about?

2

There have been issues with filter_var when used with FILTER_VALIDATE_EMAIL in the past, however I cannot find any vulnerabilities with FILTER_VALIDATE_IP.

Even though an IP address does not contain characters that have special meaning within HTML (e.g. <) or have characters that can break out of a database query (e.g. '), I would treat the value like any other string value and use parameterised queries to store this within a DB, or HTML encode when displaying to the page.

This would guard against any future changes such as if it is later changed to a host name from user input - the value would still be safe for both operations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.