PECL Input Filter

Thu, 17 Nov 2005 21:02 UTC

Lately, there has been a good deal of discussion on php-general concerning filtering input. Richard Lynch even tossed out a few of his ideas concerning the use of a $_CLEAN superglobal variable that would merely serve as a reminder to programmers (through its constant use in the PHP manual) to filter input as a “best practice” (see here and here). Furthermore, on Chris Shiflett’s blog, Richard comments that ”[s]urely our base solution for minimal Security should be a fundamental part of the PHP language, not some add-on second thought.”

I tend to agree with Richard, and that’s why I’ve been paying attention to the PECL Input Filter extension.

Back in October, Derick Rethans and Rasmus Lerdorf made their initial release of the PECL Input Filter extension. Since then, I’ve taken some time to play around with it, hack around it, and report a few of the bugs I’ve found, which have since been corrected in HEAD. I’m proud to say that they even used some of my patches. Nevertheless, I’m going to continue to tinker around with this extension to see what else I can break because I think it will be a good tool for promoting best practices to PHP programmers, and the more it’s tested, the better it will be.

Now, on to Richard’s point about security tools being “a fundamental part of the PHP language.” The Input Filter extension right now is only just that: an extension. Yet, recently (15 Nov), I noticed that Jani Taskinen (a.k.a. “sniper”) checked in some revisions with the comment “Prepare for including in PHP core.” This got me thinking, so I asked Derick, and Derick confirmed that the Input Filter extension will be a part of the PHP core in versions 5.1.1 and 6.0. So, there’s one of your built-in security tools right there.

So, now, let’s take a look at some code. Let’s assume that we have a form. On that form are four fields: name, age, email, and list. These are fairly self-explanatory. With name, we expect a string; with age, a number; email, an e-mail address; and with list a value of either 1, 0, yes, or no to determine whether you want to be on the mailing list (it’s a radio button, and, for the sake of argument, let’s assume that the values are “yes” and “no,” but they could be 1, 0, true, false, on, or off; any of these will filter as a BOOLEAN value).

Our processing form might start out like this:

<?php
$clean = array();
 
$clean['name']  = input_get(INPUT_POST, 'name',  FL_REGEXP, array('regexp' => '^[\w ]+$'));
$clean['age']   = input_get(INPUT_POST, 'age',   FL_INT);
$clean['email'] = input_get(INPUT_POST, 'email', FL_EMAIL);
$clean['list']  = input_get(INPUT_POST, 'list',  FL_BOOLEAN);
?>

The constants passed to the function determine the type of filtering, and if the input variable matches the filter, then it returns the raw and unchanged value. If it doesn’t match, then it returns NULL. So, at worst, $clean (in this implementation) will contain a NULL value.

You may also filter script variables and even perform some sanitizing. The following example will strip the HTML tags from $name and store the value “Ben Ramsey” to $clean[‘name’].

<?php
$clean = array();
$name = '<b>Ben Ramsey</b>';
$clean['name'] = filter_data($name, FS_STRING);
?>

While I am not a big fan of sanitizing functions (I believe that programmers should use a whitelist approach and simply filter input for valid data and, on invalid data, require the user to enter valid data), I can definitely see the advantages of including these filtering functions in the core to promote best practices. It should be noted that it is just as easy to filter input without these built-in functions, but, perhaps, with the inclusion of these functions, it will encourage others to start properly filtering data.

Finally, I’d like to point out that the Input Filter extension is still in “beta” and should not be used in production environments. There are still some bugs and functionality to work out before it can be safe for production use.

UPDATE (19 Nov): Version 0.9.3, which includes several bug fixes, was released yesterday.

10 Comments »  Permalink  Tags: filter-input, pecl, php, security

Web 2.0 in China?

Tue, 8 Nov 2005 15:47 UTC

Via Planet Web 2.0, I found this post by Richard MacManus about an English blog discussing Web 2.0 in China: the China Web2.0 Review. Looking at the blog, it appears that China will soon host its own blogging conference in Shanghai.

Personally, I find it amazing that bloggers are continuing forward even despite recent news of censorship attempts. What’s more, Web 2.0 seems to be catching on like wildfire in China, and that’s even more astounding in light of what I’ve been discussing about information sharing and collective ownership. One would think that collective ownership would be an ideal of a socialist government, but totalitarian rule and blocking and censorship of services seems more often than not to be the norm.

Needless to say, this is a bold move for the bloggers and technologists of China. I think it’s another step towards opening up China.

From the China Web2.0 Review:

China Web2.0 Review is a blog dedicated to track and review web2.0 development in China. We will profile and review web2.0 applications, products, services and business in China, and track the buzz about web2.0 in China’s internet industry as well.

Though the definition of Web2.0 is still controversial, we believe web2.0 is not only a buzzword or bubble2.0 but an inevitable evolution of the web. And in China, one of the most potential and mysterious internet markets, web2.0 evolution is also on going and exciting us.

No Comments  Permalink  Tags: China, web-2.0

A Fortune Cookie for Web 2.0

Sat, 5 Nov 2005 23:02 UTC

I’ve been giving a lot of thought to Web 2.0 lately. Specifically, I’ve been thinking about tagging and collective ownership (and sharing) of information. While these aren’t necessarily Web 2.0 in and of themselves—indeed, Web 2.0 is merely (depending on your thought-leader of choice) the notion of the Web as a platform—I think they are becoming integral parts of the concept, and I think they compliment one another.

Tagging helps to organize (describe) information in a way in which it is easy for someone other than the “tagger” to find relevant data. There is no obfuscated taxonomy or nomenclature that one must figure out (like with most category- and folder-based systems), and, with the way most tag-based applications now work (i.e. del.icio.us, Flickr), others may add their own tags, so the overall value of the description increases, thus making it easier to find. Flickr even assigns a ranking to this value (which also adds in other attributes such as number of views, etc.) so you can find your “most interesting” photos. All of this works together, making it easier to share information.

So, you can see that I’ve been giving a great deal of thought to this, so it’s no surprise that Web 2.0 was the first thing that sprung to mind when I broke open my fortune cookie tonight after dinner. This was the fortune:

Doing little things well is a step towards doing big things better.

If Web 2.0 has a motto, then this is it. A typical Web 2.0 application is one that picks one thing and does it well. Then, it provides (or should) an open API for others to share in the information available from the one thing done well. As more and more of these applications pop up, there will be mounds and mounds—indeed, there already are—of rich data for all to share. This is the platform. This is the “big thing” that is made better by the “little things” of Web 2.0.

3 Comments »  Permalink  Tags: open-information, tagging, web-2.0