Cleaning $_Get Data

[Johnny2]

When I run code just to check if the $_GET is set, can this (possibly malicious) data be harmful in this instance?... Do I only need to clean the data if I'm going to use it in a calculation or something?

 

if (isset($_GET['badGuyData'])

{

}

 

 

Thank you.

[falkencreative]

I am not an expert on PHP security. But as far as I know, security issues primarily come into play when:

 

-- something that a user inputs is used within a database query somehow, potentially leading to SQL injection if it isn't properly escaped

-- something that a user inputs is displayed to the page without being properly escaped

 

As far as I understand it, isset() simply checks if a variable exists -- it doesn't "use" the variable, so it should be fine.

[Johnny2]

I am not an expert on PHP security. But as far as I know, security issues primarily come into play when:

 

-- something that a user inputs is used within a database query somehow, potentially leading to SQL injection if it isn't properly escaped

-- something that a user inputs is displayed to the page without being properly escaped

 

As far as I understand it, isset() simply checks if a variable exists -- it doesn't "use" the variable, so it should be fine.

 

 

Thanks Ben,

 

Do you feel that the incomming data should be rendered harmless if I initially "clean" it with this line of code?:

 

$data_cleaned = preg_replace('#[^A-Za-z]#i', '', $data_dirty);

[falkencreative]

I believe that should work fine. Just make sure to do a little testing and ensure the regular expression is working the way you expect it to.