php - What is the best way to sanitize user inputs? -

php - What is the best way to sanitize user inputs? -

i need prevent xss attacks much possible , in centralized way don't have explicitly sanitize each input.

my question improve sanitize inputs @ url/request processing level, encode/sanitize inputs before serving, or @ presentation level (output sanitization)? 1 improve , why?

there 2 areas need aware:

anywhere utilize input part of script in language, notably including sql. in particular case of sql, only recommended way of dealing things utilize of parameterized queries (which result in unescaped content beingness in database, strings: that's ideal). involving magic quoting of characters before substituting them straight sql string inferior (because it's easy wrong). can't done parameterized query service secured against sql-injection should never allow user specify.

anywhere nowadays input output. source of input direct (including via cookie) or indirect (via database or file). in case, default approach should create text user sees text input. that's easy implement correctly since characters have quote < , &, , can wrap in <pre> display.

but that's not enough. example, might want allow users sort of formatting. ever easy go wrong. simplest approach in case parse input , observe formatting instructions; else needs quoted properly. should store formatted version additionally in database column don't need much work when returning user, should store original version user input can search on it. do not mix them up! really! audit application create totally sure right (or, improve yet, else audit).

but beingness careful sql still applies, , there many html tags (e.g., <script>, <object>) , attributes (e.g., onclick) never ever safe.

you looking advice specific packages work? need pick language then. above advice totally language-independent. add-on packages/libraries can create many of steps above easy in practice, still absolutely need careful.

php web-applications web tcl xss