Changeset 72

Timestamp:

06/21/07 17:28:46 (2 years ago)

Author:

pdingle

Message:

added cleanInitialClaim function to guard against SQL injection and XSS attacks

Files:

• trunk/wp-infocard/pwlib/processing/infocard-post-get-claims.php (modified) (1 diff)
• trunk/wp-infocard/pwlib/processing/infocard-post.php (modified) (1 diff)
• trunk/wp-infocard/pwlib/utils.pwlib.php (modified) (1 diff)

trunk/wp-infocard/pwlib/processing/infocard-post-get-claims.php

@@ -448 +448 @@
-                break;
-            }
-
-
+
+
+
-            $offset++;
-        }

trunk/wp-infocard/pwlib/processing/infocard-post.php

@@ -88 +88 @@
-                if ($claims[$aclaim->handle])
-                {
+                        // note data has already been checked for SQL injection
-                        $aclaim->add_token_value($claims[$aclaim->handle]);
-                }

trunk/wp-infocard/pwlib/utils.pwlib.php

@@ -174 +174 @@
-                echo PW_PLUGINURL . "/pwlib/images/pp-logo-bw-small.png";
-        }
+        // Function: cleanInitialClaim
+        // Description:  to remove the possibility of SQL injection or XSS 
+        //               attacks by properly escaping characters that could
+        //               be used to turn a string into a command.
+        //               Function & explanation found at: (many thanks)
+        // http://simon.net.nz/articles/protecting-mysql-sql-injection-attacks-using-php/
+        // Input:       - claimslist entry for the claim to be cleaned
+        // Output:      cleaned string  
+        // Side-effects: database object is requested from a plugin-specific routine
+        function cleanInitialClaim( $claim )
+        {   
+                // not sure if this covers base-64 encoded data yet
+                // but at least it works for the plain stuff.
+
+                if ( get_magic_quotes_gpc() )
+                {
+                        $claim = stripslashes( $claim );
+                }
+                $output = htmlspecialchars($claim, ENT_QUOTES);
+                if ($output === $claim)
+                {
+                        //nothing exciting happened
+                        return $output;
+                }
+                else
+                {
+                        pw_utils::printDebug('<br/>DATA HAD TO BE CLEANSED: '.$output.'<br/>');
+                        return $output;
+                }
+        }
+
-} // end class pw_utils
-?>