# Securing User Input

**URL:** <https://www.phphelp.com/t/securing-user-input/20586>\
**Category:** Security and PHP\
**Created:** [June 29, 2013, 5:50pm UTC](https://www.phphelp.com/t/securing-user-input/20586 "2013-06-29T17:50:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sensimillia](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/57b2e6/32.png) [@Sensimillia](https://www.phphelp.com/u/Sensimillia)\
**Post date:** [June 29, 2013, 5:50pm UTC](https://www.phphelp.com/t/securing-user-input/20586/1 "2013-06-29T17:50:49Z")

</div>

Hello everyone,  
I’m just starting out learning PHP and have programmed a function to filter user input. This will mainly be used in a highly restricted forum type environment or prior to adding data to a MySQL database.

I’m looking for input on how effective (or ineffective) my code really is.

Here is the function:  
[php]\<?php  
//\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
//\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
//\*\* security.php by Sensimillia  
//\*\*  
//\*\* Version 0.2 Alpha  
//\*\*  
//\*\* Supports plain (english) text  
//\*\* and URL input only.  
//\*\*  
//\*\* Returns NULL on failure.  
//\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
//\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
function security\_filter($input, $what) {  
if (is\_array($input)){ $input=NULL; }  
switch ($what){  
case “string”:  
switch (is\_string($input)){  
case true:  
$input = filter\_var($input, FILTER\_SANITIZE\_STRING, FILTER\_NULL\_ON\_FAILURE);  
break;  
default:  
$input = NULL;  
break;  
}  
break;  
case “url”:  
$chk = filter\_var($input, FILTER\_VALIDATE\_URL, FILTER\_NULL\_ON\_FAILURE);  
switch($chk){  
case !NULL:  
$input = filter\_var($input, FILTER\_SANITIZE\_URL, FILTER\_NULL\_ON\_FAILURE);  
break;  
default:  
$input = NULL;  
break;  
}  
break;  
default:  
$input = NULL;  
}  
if ($input == false){  
$input = NULL;  
}  
$input = mysql\_real\_escape\_string($input);  
return $input;  
}  
?\>[/php]

---

<div class="post-metadata">

**Author:** ![scottlpool2003](https://www.phphelp.com/letter_avatar_proxy/v4/letter/s/71e660/32.png) [@scottlpool2003](https://www.phphelp.com/u/scottlpool2003)\
**Post date:** [August 19, 2013, 9:38am UTC](https://www.phphelp.com/t/securing-user-input/20586/2 "2013-08-19T09:38:05Z")

</div>

A lot of work for old rope. If you kept up-to-date with modern standards, you would realize that the mysql\_query function will be completely removed from PHP soon. Putting the query into PDO will secure it for you.