Filtering input data

Question

I created a function that filters data and I want to know if it's fully secure to filter user input data.

function user_input_data($data,$options) {
    $output = null;
    $error_msg = "";
    $check_length = false;
    $options_fetch = array(
    @$length_max = $options["length_max"],
    @$length_min = $options["length_min"],
    $data_type = $options["data_type"],
    );

    if($length_min && $length_max) {
        $check_length = true;
    }

    if($data_type == "only_letters") {

        if (preg_match('/^[\p{Arabic}a-zA-Z]+\h?[\p{Arabic}a-zA-Z]*$/u', $data)) {
             $output = $data;
        }else{
            $output = false;
        }
    }

    if($data_type == "only_letters_numbers") {

        if (preg_match('/^[\p{Arabic}a-zA-Z0-9]+\h?[\p{Arabic}a-zA-Z0-9]*$/u', $data)) {                    
            $output = $data;     
        }else{
            $output = false;
        }
    }          

    if($data_type == "string") {
        $output = htmlspecialchars($data,ENT_QUOTES,"UTF-8",true);
    }
    if($data_type == "text") {
        $output = strip_tags($data);
    }
    if($data_type == "integer") {
        if(filter_var($data,FILTER_VALIDATE_INT)) {
            $output = $data;
        }
    }
    if($data_type == "float") {
        if(filter_var($data,FILTER_VALIDATE_FLOAT)) {
            $output = $data;
        }
    }
    if($data_type == "boolean") {
        if(filter_var($data,FILTER_VALIDATE_BOOLEAN)) {
            $output = $data;
        }
    }
    if($data_type == "email") {
        if(filter_var($data,FILTER_VALIDATE_EMAIL)) {
            $output = $data;
        }
    }
    if($data_type == "url") {
        if(filter_var($data,FILTER_VALIDATE_URL)) {
            $output = $data;
        }
    }
    if($data_type == "ip") {
        if(filter_var($data,FILTER_VALIDATE_IP)) {
            $output = $data;
        }
    }
    if($data_type == "array") {
        if(is_array($data)) {
            $data = array_map("htmlspecialchars",$data);
            $output = $data;
        }
    }
    if($data_type == "file_directory") {
        if(file_exists($data)) {
            $output = basename($data);
        }
    }
    if($output) {

    if($check_length) {

        if( ( ( mb_strlen($output) >= $length_min ) && ( mb_strlen($output) <= $length_max ) ) === false) {
            $output = false;
        }
    }
    return $output;

    }
}

// call function 
$password = user_input_data(
    $_POST["password"],
    array(
        "length_min" => 8, "length_max" => 24 ,"data_type" => "string"
    )
);

Frankly, this function has very little to do with security and by no means should be relied upon. — Your Common Sense
– Your Common Sense, Commented Feb 16, 2018 at 7:48
@YourCommonSense I created this function for filter user input data only. In my question I ask if it is completely safe in filtering user input data just no less and no more. — Mourad Karoudi
– Mourad Karoudi, Commented Feb 16, 2018 at 14:09
@YourCommonSense thank you. but really I don't way if I want to know if user input just contain letters I call function like this $var = user_input_data($POST['var'],array("data_type" => "only_letters")) so if user input data contain numbers or characters it return false — Mourad Karoudi
– Mourad Karoudi, Commented Feb 16, 2018 at 14:54

TimSparrow · Accepted Answer · 2018-02-16 12:49:11Z

1

I suggest you should use a configuration array like this:

 $config = [
      ip => FILTER_VALIDATE_IP,
      email=> FILTER_VALIDATE_EMAIL
 ]

and simplify the code like this:

if(in_array($config, $data_type)) {
     if($filter_VAR($data, $config[$data_type]) {
          $output = $data;
     }
}

In your code, length is checked only if both min and max are set. Is it the expected behavior? In some cases, only min or max checks are required.
Generally, you should avoid repeating code, in favor of calling functions. This makes it more readable. Plus, you can create test cases for small functions with predictable results, rather that a big complicated thing.
With security I have no idea what this function is designed to protect against.

answered Feb 16, 2018 at 12:49

TimSparrow

2961 silver badge8 bronze badges

\$\begingroup\$ thank you so much for your answer. I think all of you understood me wrong. I designed this function for only filter user input data to avoid repeating. and I ask if it's good and I think they need some Improvements \$\endgroup\$

Mourad Karoudi
– Mourad Karoudi

2018-02-16 14:16:45 +00:00
Commented Feb 16, 2018 at 14:16
\$\begingroup\$ @MouradKaroudi there you are. I suggested 3 areas where you can improve your code. Still, it is unclear what did you want to achieve in security area. \$\endgroup\$

TimSparrow
– TimSparrow

2018-02-16 17:32:22 +00:00
Commented Feb 16, 2018 at 17:32
\$\begingroup\$ thank you so much for your reply and your time. I use this function in my website to filter form inputs data like a Register form had input called full_name so I want this input accept only letters english and arabic so I use this function to do that for me. what I want is to know if this function good to filter user input and secure my forms data \$\endgroup\$

Mourad Karoudi
– Mourad Karoudi

2018-02-16 19:12:56 +00:00
Commented Feb 16, 2018 at 19:12
\$\begingroup\$ and look to my question I wrote ** it's fully secure to filter user input ** \$\endgroup\$

Mourad Karoudi
– Mourad Karoudi

2018-02-16 19:14:56 +00:00
Commented Feb 16, 2018 at 19:14

Add a comment |

Stack Exchange Network

Filtering input data

1 Answer 1

You must log in to answer this question.

Hot Network Questions

Filtering input data

1 Answer 1

You must log in to answer this question.

Related

Hot Network Questions