0

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely.

if(!filter_var($_GET["ip"], FILTER_VALIDATE_IP)) {
    echo "Invalid IP.";
    die();
}

$ip = (string)$_GET["ip"];

Is this secure enough to be able to put $ip in a database or display it on a page? Or are there any vulnerabilities with FILTER_VALIDATE_IP (or perhaps the way the code is structured) that I should worry about?

1 Answer 1

2

There have been issues with filter_var when used with FILTER_VALIDATE_EMAIL in the past, however I cannot find any vulnerabilities with FILTER_VALIDATE_IP.

Even though an IP address does not contain characters that have special meaning within HTML (e.g. <) or have characters that can break out of a database query (e.g. '), I would treat the value like any other string value and use parameterised queries to store this within a DB, or HTML encode when displaying to the page.

This would guard against any future changes such as if it is later changed to a host name from user input - the value would still be safe for both operations.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .