[PHP] Removing security-problematic chars from strings

2003-11-21 Thread Troy S
Greetings, What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Troy

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Adam i Agnieszka Gasiorowski FNORD
Troy S wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Do it the other way, allow only characters you know are safe and strip the rest. Use, for

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread John W. Holmes
Troy S wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Why do you need to remove them? So I can't type grin? Is that a security violation? All you need to do is

RE: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Wouter van Vliet
-Oorspronkelijk bericht- Van: John W. Holmes [mailto:[EMAIL PROTECTED] Troy S wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Why do you need to

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread John W. Holmes
Wouter van Vliet wrote: John W. Holmes Troy S wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Why do you need to remove them? So I can't type grin? Is that a security

RE: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Wouter van Vliet
-Oorspronkelijk bericht- Van: John W. Holmes [mailto:[EMAIL PROTECTED] Verzonden: vrijdag 21 november 2003 14:38 Wouter van Vliet wrote: John W. Holmes Troy S wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , ,

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Chris Shiflett
--- Troy S [EMAIL PROTECTED] wrote: What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? As others have mentioned, this is the wrong approach if security is your concern. If someone is

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Curt Zirzow
* Thus wrote Troy S ([EMAIL PROTECTED]): Greetings, What is the best way to remove the characters from strings that may cause security problems? Namely, `, ', , , , \ and all non-printing strings. Did I miss any? Thanks. Cause security problems in what sense? Curt -- My PHP key is

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread CPT John W. Holmes
From: Wouter van Vliet [EMAIL PROTECTED] Let's make this personal: what would be your answer if I would advice the friendly person to do this: Heh.. I hope you're just kidding about making it personal... I was just presenting security problems with various solutions. ?php (..) $Content

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Chris Shiflett
--- CPT John W. Holmes [EMAIL PROTECTED] wrote: Let's make this personal: what would be your answer if I would advice the friendly person to do this: Heh.. I hope you're just kidding about making it personal. I think it might be a language subtlety that wasn't intended to mean what we

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread CPT John W. Holmes
From: Chris Shiflett [EMAIL PROTECTED] --- CPT John W. Holmes [EMAIL PROTECTED] wrote: I'm against letting users enter HTML in their data, also. I'd rather emply a bbcode type solution, turning [b] into b, etc. I disagree with John here, but that's OK. :-) We seem to have different

RE: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Wouter van Vliet
CPT John W. Holmes wrote: From: Wouter van Vliet [EMAIL PROTECTED] Let's make this personal: what would be your answer if I would advice the friendly person to do this: Heh.. I hope you're just kidding about making it personal... I was just presenting security problems with various

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Chris Shiflett
--- CPT John W. Holmes [EMAIL PROTECTED] wrote: Heh... my turn to disagree again. You can do a simple str_replace() to convert lt;bgt; back into b, but you're going to have to do it for each case. Also by doing that blindly, you can end up with orphaned tags affecting the rest of your page

RE: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Wouter van Vliet
Chris Shiflett wrote: --- CPT John W. Holmes [EMAIL PROTECTED] wrote: Heh... my turn to disagree again. You can do a simple str_replace() to convert lt;bgt; back into b, but you're going to have to do it for each case. Also by doing that blindly, you can end up with orphaned tags affecting

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread John W. Holmes
Chris Shiflett wrote: --- CPT John W. Holmes [EMAIL PROTECTED] wrote: Heh... my turn to disagree again. You can do a simple str_replace() to convert lt;bgt; back into b, but you're going to have to do it for each case. Also by doing that blindly, you can end up with orphaned tags affecting the

Re: [PHP] Removing security-problematic chars from strings

2003-11-21 Thread Marek Kilimajer
John W. Holmes wrote: My only point was that I felt you _did_ need to use regular expression to ensure you're only converting paired tags. Just using str_replace() could leave orphaned tags unless you're keeping a count of what's been replaced. :) I would suggest to use xml parsing functions