Techno World Inc - The Best Technical Encyclopedia Online!

To get started, head over to the PHP Classes page for the Input Filter Class by Daniel Morris and download the class file. (http://www.phpclasses.org/browse/package/2189.html)

Once you get the class file, here's how you can go about cleaning up your input variables.

<?php $before = $_REQUEST['before']; $myFilter = new InputFilter(); $after = $myFilter->process($before); echo $after; ?>

So if you pass the string "<script>alert('xss');</script> to the code above, the input filter changes this to alert('xss'); after removing the script tags. All you have to do is to instantiate the InputFilter class with the following line: $myFilter = new InputFilter();

and run your string to be processed using the process class:

$after = $myFilter->process($before);

You can also send entire arrays to be processed by the InputFilter class:

$_POST = $myFilter->process($_POST); This class can also be used to remove specific HTML tags from your input string. Let's say for example, you want to remove all the bold tags < b> and < strong> from your HTML string, all you need to do is :

<?php include 'class.inputfilter.php'; $before = $_REQUEST['before']; $tags = array("b","strong"); $myFilter = new InputFilter($tags, array(),1, 1); $after = $myFilter->process($before); echo $after; ?>

If we pass the string "<strong> test</strong> hello world" the output of the script will be "test < em>hello world < /em>"

If you'd like to retain only the < b> and <strong> tags in the above example, change line 4 to read

$myFilter = new InputFilter($tags, array(),0, 1);

This will change the output to < strong>test < /strong> hello world Let's break up the constructor for the InputFilter class :

InputFilter($tagsArray, $attrArray, $tagsMethod , $attrMethod);

$tagsArray is an array of user defined tags $arrtArray is an array of user defined attributes $tagsMethod = 0 or 1 where 0 is used when only user defined tags should be allowed. 1 is used to strip the user defined tags. Similarly $attrMethod is used to retain user defined attributes is it's set as 0 and to strip user defined attributes if set to 1.

Let's see the attribute filtering provided by this class in action. Let's take the following HTML string as an example:

<img src="test.jpg" target="_blank" onclick="dosomething();" onmouseover="dosomethingelse();">

Let's make an filter to just retain the src and target attributes in the HTML above

$tags = array("img","b"); $attr = array("src","target"); $myFilter = new InputFilter($tags, $attr,0, 0); $after = $myFilter->process($before);

The output should show

<img src="test.jpg" target="_blank>

It's as simple as that.

Articles Source - Free Articles