In Which Order Do I Deal With User Inputs To My Webform?

Question

Q1. Do I validate user inputs first then sanitize it or should I vice versa ?

if($_SERVER['REQUEST_METHOD'] == "POST")
    {
        if(ISSET($_POST['domain_email']) && ISSET($_POST['password']))
        {
            //Initialise variables before assigning values.
            $domain_email = $password = $user_id = "";
            $_SESSION['domain_email'] = $_SESSION['user_id'] = '';
            
            $domain_email = $_POST['domain_email'];         
            $password = $_POST['password'];
        
            if(!filter_var($domain_email,FILTER_SANITIZE_EMAIL))
            {
                die("Error 1a: Input the VALID Email Address belonging to your account!");
            }
            if(!filter_var($domain_email,FILTER_VALIDATE_EMAIL))
            {
                die("Error 1b: Input the VALID Email Address belonging to your account!");
            }
            
            if(!filter_var($password,FILTER_SANITIZE_STRING))
            {
                die("Error 1c: Input the correct Password belonging to your account!");
            }
                
            function validate_input($data_input)
            {
                $data_input = trim($data_input);
                $data_input = stripslashes($data_input);
                $data_input = strip_tags($data_input);//I ADDED THIS LINE. IS IT NECESSARY OR IS THE FILLOWING ENOUGH ? : $data_input = stripslashes($data_input);
                
                return $data_input;
            }
            
            $domain_email = validate_input($domain_email);
            $password = validate_input($password);

Q2.

$data_input = strip_tags($data_input);

I added the above line. Is it necessary or is the following enough:

$data_input = stripslashes($data_input);

I need answers to all 3 of my questions. Any further advice welcome.

EDIT: Q3. If password has special chars like:

~
`
@
#
$
%
^
&
*
(
)
_
-
+
=
{
[
}
]
|
\
:
;
'
"
<
,
>
.
?
/

Then can password be considered string in php ? I ask due to this part of my code:

if(!filter_var($password,FILTER_SANITIZE_STRING))
            {
                die("Error 1c: Input the correct Password belonging to your account!");
            }
                
            function validate_input($data_input)
            {
                $data_input = trim($data_input);
                $data_input = stripslashes($data_input);
                $data_input = strip_tags($data_input);//I ADDED THIS LINE. IS IT NECESSARY OR IS THE FILLOWING ENOUGH ? : $data_input = stripslashes($data_input);
                
                return $data_input;
            }
            
            $domain_email = validate_input($domain_email);
            $password = validate_input($password);

Note the $domain_email. Can it be considered string by having the "@"? Strings can only contain alphas and numbers. Right ?

What particular methods of sanitization and/or escaping might be necessary, always depends on the _context_ that you want to bring the data into. You have not told us anything about that so far, so your second question is bascially unanswerable. — CBroe, Dec 01 '20 at 14:08
Stripping _anything_ from a password however is plainly outright nonsense. — CBroe, Dec 01 '20 at 14:11
@CBroe, Sanitizing to prevent Sql and other Injections. I am talking about: 1.Sanitizing "username" (login system). 2.Sanitizing & Validating "Domain", "Email" (login system). 3. Sanitizing Password. — studentprogrammer2020, Dec 01 '20 at 14:18
Use prepared statements, that eliminates the need to do any escaping in regard to database queries yourself. And what would stripping slashes and stripping tags have to do with SQL injection in the first place? `strip_tags` _might_ make sense, to prevent any HTML code contained in any of the values, from interfering with the structure of the page, when you _output_ any of this as HTML later (that has _nothing whatsoever_ to do with the database, so it does not belong into that step of getting the data into the database to begin with!) […] — CBroe, Dec 01 '20 at 14:27
[…] - but that would _remove_ parts of the value the user wanted to use; so _showing_ such characters in a way that they can not do any harm, would perhaps be the preferable alternative. — CBroe, Dec 01 '20 at 14:27

In Which Order Do I Deal With User Inputs To My Webform?

0 Answers0