Is this xss, sql injection, buffer overflow safe?
Development and Programming
14 years ago
I am currently using the following php code to protect against xss and sql injections. dbh is the connection to the db.
// Delete Hexadecimal Characters
function cleanHex($input)
{
$clean = preg_replace("![\][xX]([A-Fa-f0-9]{1,3})!", "",$input);
return $clean;
}
$var1 = strip_tags($_POST["id"]);
$var1 = substr($var1,0,7);
$var1 = cleanHex($var1);
$var1 = $this->EE->security->xss_clean($var1);
$insert-var1 = $dbh->prepare("INSERT INTO table-name (pid) VALUES (:pid)");
$insert-var1->bindParam(':pid', $var1);
$insert-var1->execute();
echo var1;Is this secure enough? am I being redundant? What recommendations do you have besides adding a token for form spoofing? Is there a better way at going at this? Thanks, Dave