what is a good method to sanitize the whole $_POST array in php?

php arrays sanitization
SirG picture SirG · Sep 5, 2010 · Viewed 56.4k times · Source

I have a form with a lot of variables which is then sending an email, rather than sanitizing each $_POST value with filter_var($_POST['var'], FILTER_SANITIZE_STRING); I was after a more simple piece of code. I came up with the below, which seems to work as I believe the default action is FILTER_SANITIZE_STRING, but I was just wondering what peoples opinions are, and if this is not good practice, perhaps you could tell me why? The $_POST values are then individually embedded into new variables, so I would only be using array_map just at the start to sanitize everything...

$_POST = array_map('filter_var', $_POST);

Thank you for your replies, to give you a little more information, basically:

I have 20-30 input fields in a form which are being captured, the data is then displayed to the user to check their input, variables are then sanitized, the user is then sent an email and then finally the details are entered into a db.

currently I am sanitizing using the above array_map function, as well as FILTER_SANITIZE_EMAIL on the email address before sending an email and then escaping the input using mysql_real_escape_string() before the insert into the db. Without getting into prepared statements etc.. do you think I should be doing anything additionally? thanks again!

Answer

johnny.rodgers picture johnny.rodgers · Aug 22, 2011

If the type of each of your input variables is a string and you want to sanitize them all at once, you can use:

// prevent XSS
$_GET   = filter_input_array(INPUT_GET, FILTER_SANITIZE_STRING);
$_POST  = filter_input_array(INPUT_POST, FILTER_SANITIZE_STRING);

This will sanitize your $_GET and $_POST arrays.

Seen here: PHP -Sanitize values of a array

Related questions

PHP -Sanitize values of a array

I have a array, which comes from $_POST[] and can have other arrays in it as values, like: array( 'title' => 'Title', 'data' => array( 'hdr' => 'Header' 'bdy' => 'Body' ), 'foo' => array(1, 23, 65), ... ) How can I sanitize all values …

Read More
Deleting an element from an array in PHP

Is there an easy way to delete an element from an array using PHP, such that foreach ($array) no longer includes that element? I thought that setting it to null would do it, but apparently it does not work.

Read More
"Notice: Undefined variable", "Notice: Undefined index", and "Notice: Undefined offset" using PHP

I'm running a PHP script and continue to receive errors like: Notice: Undefined variable: my_variable_name in C:\wamp\www\mypath\index.php on line 10 Notice: Undefined index: my_index C:\wamp\www\mypath\index.php on line 11 Line 10 …

Read More