Why Filter Input?
5
• Input comes from everywhere
• You cannot control the origin of input
• They’re sending all kinds of input
• Thus, you can’t trust the data
• You don’t want to accept bad or incorrect
data
Slide 6
Slide 6 text
What Is Filtering?
• Data inspection process
• By which you validate input according to
your data model
• You can choose to accept or reject the
input if it doesn’t match your model
6
Slide 7
Slide 7 text
Where To Filter?
• Client-side?
• All client-side filtering can be circumvented
• Server-side?
• Best place to filter; not so user-friendly
• Both?
• Client-side provides good user experience
• Server-side ensures good data
7
Blacklist Filtering
• Negative filtering
• “I know what data I don’t want to allow”
• Block input based on a list of unacceptable
values
• Must continually add to this list as you
discover new unacceptable values
9
Slide 10
Slide 10 text
Whitelist Filtering
• Positive filtering
• “I know what data I do want to allow”
• Accept input based on a list of acceptable
values
• Benefit: you always know what you want to
accept
10
Slide 11
Slide 11 text
Sanitizing
• Lenient “filtering”
• Two approaches:
• Blacklist: “I’ll accept everything and strip out
what I don’t want”
• Whitelist: “I’ll accept everything and extract
only what I do want”
• Though the input is sanitized, it may not
be good data
11
Opt-In Filtering
• All input is unfiltered to begin with
• You choose when you want to filter data
• Nothing to stop you or your development
team from using unfiltered data
• Typical approach is to filter input from
$_GET and $_POST and store it back to
these variables or a new variable
13
Slide 14
Slide 14 text
Opt-Out Filtering
• Everything is filtered by default
• No access to unfiltered data except by
choice
• No accidental usage of $_GET, $_POST, etc.
• You must make a conscious decision to opt-
out of the filtering and get raw data
14
Slide 15
Slide 15 text
Enforce Opt-out Filtering
• Ensures that you and your development
team cannot accidently access unfiltered
input
• Must consciously decide to use raw data
• PHP does not do this by default, nor does
Zend_Filter_Input or ext/filter
• I’ll show you how
15
Slide 16
Slide 16 text
Zend_Filter_Input
16
Slide 17
Slide 17 text
Zend_Filter_Input Philosophy
17
• Filter from the application level
• Opt-out filtering
• Not enforced by default
• Whitelist filtering
• Provides sanitizing methods, if desired
Extended Example
• Typical form that asks for information
• Use Zend_Filter_Input to filter the values
for the following types of data:
• name == alphabetic string
age == integer with min and max
website == valid URL format
e-mail == valid e-mail format
color == one of red, blue, or green
26
Slide 27
Slide 27 text
27
form.html
Slide 28
Slide 28 text
28
FormController.php
Slide 29
Slide 29 text
ext/filter
29
Slide 30
Slide 30 text
ext/filter Philosophy
30
• Filter from the PHP level
• Opt-in filtering
• Does provide a default filter setting, though
• Whitelist and sanitizing filters
Slide 31
Slide 31 text
Quick Example
31
Slide 32
Slide 32 text
Configuration
• Two php.ini settings for ext/filter
• filter.default = unsafe_raw
• filter.default_flags =
• My personal wish: a third setting for
enforcing an opt-out environment
32
filter_input()
• Basic usage:
• filter_input(type, name, [filter, [options]])
• Type == Location of input
• Name == Name of input variable to get
• Filter == Filter to apply
• Options == Associative array of options
35
Opting Out
• FILTER_UNSAFE_RAW
• FILTER_CALLBACK
40
Slide 41
Slide 41 text
Extended Example
• Same form as earlier
• Use ext/filter to filter the values for the
same type of data as used earlier:
• name == alphabetic string
age == integer with min and max
website == valid URL format
e-mail == valid e-mail format
color == one of red, blue, or green
41
Slide 42
Slide 42 text
42
form.html
Slide 43
Slide 43 text
43
process.php
Slide 44
Slide 44 text
44
process.php
Slide 45
Slide 45 text
45
process.php
Slide 46
Slide 46 text
Filtering Tips
• Use a whitelist approach
• Force the use of your filter (don’t directly
use $_GET, $_POST, $_COOKIE, etc.)
• Implement an opt-out strategy
• Set register_long_arrays = Off in php.ini
46
Slide 47
Slide 47 text
Summary
• Zend_Filter_Input provides an OO interface
and many built-in methods for all types of
data
• ext/filter requires more thought and
planning, but provides filtering directly in
the PHP engine
• Both still need some improvement
47
Slide 48
Slide 48 text
Slides & Further Reading
http://benramsey.com/archives/ipc06-slides/
And on the Conference CD-ROM
48