Sanitize Inputs

Contributed by: Maximiliano Contieri

Difficulty level: Beginner

When you build a website that interacts with user input there’s a risk of unsanitized data. If you allow users to submit raw input without filtering it, you open the door to serious security threats like SQL injection, cross-site scripting, and more.

Problems with Unsanitized Inputs

When you don’t sanitize inputs, you’re handing control over to the user. Unsanitized inputs can lead to:

SQL Injection

Malicious users can craft SQL queries that manipulate your database, steal data, or even destroy it.

Cross-Site Scripting (XSS)

Attackers can inject scripts that run on the browsers of other users, potentially exposing sensitive information.

Even well-meaning users can break your site by submitting unexpected data like strings instead of numbers or empty fields where data is required.

Sanitize Inputs

To protect your sites, you must always sanitize user inputs. You need to ensure that data coming from the user is exactly what you expect it to be.

Imagine you’re building a soccer betting platform where users can place bets on matches. You expect them to enter their bet amount and the team they’re supporting.

Without input sanitation, this is what your code might look like in PHP:

function placeBet(string $team, int $amount) {
    $connection = new mysqli("localhost", "user", "password", "betting");

    $query = "INSERT INTO bets (team, amount) VALUES ('$team', $amount)";
    $connection->query($query);