Programming PHP, 2nd Edition

Filter Input

One of the most fundamental things to realize when developing a secure application is that any information not generated within the application itself is potentially tainted. This idea can be reduced to considering all input tainted, because input is the data you receive from outside sources.

When data is described as being tainted, this doesn’t mean it’s necessarily malicious. It means it might be malicious, because you can’t trust the source, so you should inspect it to make sure it’s valid. This inspection process is called filtering, and you only want to allow valid data to enter your application.

There are a few best practices regarding the filtering process:

• Use a whitelist approach. This means you err on the side of caution and assume data to be invalid unless you can prove it to be valid.

• Never correct invalid data. History has proven that attempts to correct invalid data often result in security vulnerabilities due to errors.

• Use a naming convention to help distinguish between filtered and tainted data. Filtering is useless if you can’t reliably determine whether something has been filtered.

In order to solidify these concepts, consider a simple HTML form that allows a user to select between three colors:

<form action="process.php" method="POST">
Please select a color:
<select name="color">
  <option value="red">red</option>
  <option value="green">green</option>
  <option value="blue">blue</option>
</select>
<input type="submit" />
</form>

It’s easy to appreciate the ...