[PHP] Processing User Input

[FiREFLi]

So I've got my registration form and my login script sorted but now I'm just wondering how much I have to worry aout filtering the data that is input.

I did a little bit of testing myself by trying to input my "username" as a string which was supposed to alter the way the php works slightly but nothing happened.

The username I tried was something like ") .'hello'. some_function(" (no quotes) and the code it was being run through is as follows:

if(  file_exists('users/' . md5($_POST['username']) . '.txt'  )
{
  ...
}

Hopefully you can see the logic behind my choice of "username" - to try and close the md5 function and start writing my own php, as a user. Now, my example didn't actually work but what I'm basically trying to ask is just how possible is it that this can be done? Do I really need to run everything I get through a strict regexp filter?

I'm quite paranoid about this so I'm thinking of a blanket ban on anything other than alpha numerics and some standard punctuation, but will that even work? All you really need is some standard punctuation to get in (I think).

It's not like my site will be attracting hackers or anything but I'm sure there'll be someone along with a bit of know how who will have a little poke around to try and see what's what.

So, I'll ask again, in closing, how much filtering do I need to do? Do I need to do any? Does php automatically deal with any potential problems of this nature that may occur? What should I do?!

[Lucas3677]

As long as you aren't using unsanitized user input in an eval(), MySQL query, or an include() you should be fine. It's not possible to escape out of an md5 function in PHP.

Also, using a function such as htmlentities, htmlspecialchars, addslashes, etc... should be enough.

[david.rothera]

Are you using hard files to store user information in?

I usually use MySQL for that and then query everything from that DB to use on the site.

[FiREFLi]

As long as you aren't using unsanitized user input in an eval(), MySQL query, or an include() you should be fine. It's not possible to escape out of an md5 function in PHP.

Also, using a function such as htmlentities, htmlspecialchars, addslashes, etc... should be enough.

Presumably you can't escape out of any function in php, can you?

Are you using hard files to store user information in?

I usually use MySQL for that and then query everything from that DB to use on the site.

Yeah I'm using hard files. I don't want to use mysql in this case.

[zackk]

Yeah I'm using hard files. I don't want to use mysql in this case.

I guess your hard files are working well with your system. But I prefer using database.

If you use database, then you should look into http://php.net/mysql_real_escape_string