* Function to secure input strings
*
* @param $str The unsecured string
+ * @param $strip Strip tags
* @return $str A (hopefully) secured string against XSS and other bad things
*/
-function secureString ($str) {
- $str = trim(strip_tags($str));
+function secureString ($str, $strip=true) {
+ // Shall we strip HTML code?
+ if ($strip) $str = strip_tags($str);
+
+ // Trim string
+ $str = trim($str);
+
+ // Encode in entities
$str = htmlentities($str, ENT_QUOTES);
return $str;
}
// Overworked security part:
if (is_array($_GET)) {
- foreach ($_GET as $seckey=>$secvalue) {
+ foreach ($_GET as $seckey => $secvalue) {
if (is_array($secvalue)) {
// Throw arrays away...
unset($_GET[$seckey]);
} else {
// Only variables are allowed (non-array) but we secure them all!
- foreach ($SEC_CHARS['from'] as $key=>$char) {
+ foreach ($SEC_CHARS['from'] as $key => $char) {
// Pass all through
$_GET[$seckey] = str_replace($char , $SEC_CHARS['to'][$key], $_GET[$seckey]);
}
if (basename($_SERVER['PHP_SELF']) != "install.php") {
// And POST data
- foreach ($_POST as $seckey=>$secvalue) {
+ foreach ($_POST as $seckey => $secvalue) {
if (!is_array($secvalue)) {
// Only variables are allowed (non-array) to be secured...
- foreach ($SEC_CHARS['from'] as $key=>$char) {
+ foreach ($SEC_CHARS['from'] as $key => $char) {
// Pass all through
$_POST[$seckey] = str_replace($char , $SEC_CHARS['to'][$key], $_POST[$seckey]);
}
}
// ... and finally cookies
- foreach ($_COOKIE as $seckey=>$secvalue) {
+ foreach ($_COOKIE as $seckey => $secvalue) {
if (is_array($secvalue)) {
// Throw arrays away...
unset($_COOKIE[$seckey]);
} else {
// Only variables are allowed (non-array) but we secure them all!
- foreach ($SEC_CHARS['from'] as $key=>$char) {
+ foreach ($SEC_CHARS['from'] as $key => $char) {
// Pass all through
$_COOKIE[$seckey] = str_replace($char , $SEC_CHARS['to'][$key], $_COOKIE[$seckey]);
}