Browsing around on monster.co.uk, I can across this awesome job posting for a PHP developer. In case it’s removed or inaccessible, here it is:
Job ad
Posts Tagged ‘php’
Jul
24
2008
PHP howto – Sanitize database inputs
When accepting data from a user, any data at all, it should be sanitized before making its way to your database.
What does this mean? Well, for one, you’re going to inspect the data and make sure that it doesn’t contain any malicious code such as ill-intentioned javascript. Another is to prepare the data so that when it gets added to your insert/update SQL it doesn’t break the SQL (or do other nasty actions). Otherwise know as a SQL injection attack.
The technical details of the types of attacks we’re protecting against are a bit out of the scope of this post, but there are numerous resources available which will explain far better than I am able to.
After a form has been submitted (via get or post) it gets stored in the global array $_GET or $_POST. Once we have this data, we can and should do a bunch of things to it, such as:
Stripping out malicious code
We’ll scan through the input, searching for anything that shouldn’t be there, like html code, <script> tags, etc.
]*?>.*?@si', // Strip out javascript
'@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@
]*?>.*?
@siU', // Strip style tags properly
'@@' // Strip multi-line comments
);
$output = preg_replace($search, '', $input);
return $output;
}
?>
’slashing
This part can sometimes get tricky, but not to worry, the code’s not too bad. Basically we’re adding a backslash before any of the following: ‘ (single-quote), “ (double quote), \ (backslash) and NULL characters. Depending on your server configuration, there are a bunch of ways of getting this done. PHP has something called magic_quotes, which does this automatically. Note, however, that as of PHP 6 this feature has been deprecated and removed. Another PHP function, addslashes(), is the manual version of magic_quotes. addslashes(“Where’s Wally”); will return “Where\’s Wally”. A better option, if your server supports it, is mysql_real_escape_string(). It performs pretty much the same function, but is apparently better.
$val) {
$output[$var] = sanitize($val);
}
}
else {
if (get_magic_quotes_gpc()) {
$input = stripslashes($input);
}
$input = cleanInput($input);
$output = mysql_real_escape_string($input);
}
return $output;
}
?>
To use, we simply pass any input to the function. The function works on single strings, as well as deep arrays.
It's a good day!";
$_POST = sanitize($_POST);
$_GET = sanitize($_GET);
$good_string = sanitize($bad_string);
// $good_string returns "Hi! It\'s a good day!"
?>
Typecasting
Making sure that the data we’re inserting matches the expected type; i.e, someone’s age should be received as an integer value, and not a string.
This is a very gentle introduction to sanitizing your database input, and I would certainly recommend that you do a lot more research on these methods in order to use them correctly in your given environment.
That’s it for today. If you found this useful, of would like to improve it, comments are always appreciated!
Jun
26
2008
PHP howto – Database paging (pagination)
OK, so it’s not quite the nuclear bomb I promised, but it’s just as much fun 
Database paging, for those of you who are interested, is when you split the number of results returned by a query into smaller chunks, and then show those one page at a time. Think of how Google will display 10 results out of 4 236 735. Same thing.
The basic idea is to:
- Run your query, limited to the number of desired results
- Get the number of results that there would have been, without the limit
- Display the first set of results
- Build and display <prev> and <next> links, which, when clicked…
- Display the prev/next set of results, moved down/up by the desired amount
- Repeat 4 & 5
The following code sample is a very basic implementation of this idea. I have not checked the code, so apologies in advance if there are any bugs.
". $row['id'] ."
". $row['name'] ."
". $row['surname'] ."
A few points worth taking note of:
Row counting
To get the total number of results, I have used
SELECT SQL_CALC_FOUND_ROWS
followed by a second query
SELECT FOUND_ROWS() AS total
As stated in the comments, this will return the number of results that there would have been without a limit clause. There are other ways to achieve this, namely using count() in a second query, but this way is apparently quicker, and also slightly cleaner code.
Building the paging links
In the code I have used
$_GET['rs']
What this does is get the value from the part of the URL that looks something like http://www.yoursite.com/index.php?rs=10
That value then becomes our next starting point, and is injected into the SQL query.
I’ve seen some tutorials where page numbers are used instead of starting records. This is fairly easy to achieve, and involves dividing the number of records returned by the size of the desired result set to get the number of pages, and then multiply again when determining the next starting point for the limit. I’ve not done that in this tutorial for the sake of simplicity. Besides, Google uses the records, and not pages, method. Can’t be that terrible
Extending the functionality
In this example I’m echoing the result to screen. You could instead wrap this up in a function and return the results. Another easy modification would be to alternate the background colours, as shown in my previous howto.
And that’s it for today. If you found this useful, of would like to improve it, comments are always appreciated!
