vb.org Archive - Using the vBulletin Input Cleaner

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vBulletin 3 Articles (https://vborg.vbsupport.ru/forumdisplay.php?f=187)

- - Using the vBulletin Input Cleaner (https://vborg.vbsupport.ru/showthread.php?t=119372)

Using the vBulletin Input Cleaner

Note: This article assumes that you are familier with PHP, and will introduce you to input filtering using vBulletin

Using the vBulletin Input Cleaner Class

Introduction

Most scripts will require data from a user at some point. When using this data, you should never assume that it is "clean" data. With XSS (Cross-Site Scripting) and SQL exploits being identified in scripts on a daily basis, you should do everything you can to ensure that all data coming from the user has been cleaned ("sanatized").

vBulletin provides us with the vB_Input_Cleaner class to do just this.
The vBulletin Input Cleaner class is setup when the page loads, and can be accessed as $vbulletin->input,

Data Types

When you accept data from the user, you should know what type of data you are expecting to receive. the vBulletin Input Cleaner allows the following types of data to be cleaned:

TYPE_NOCLEAN
Will not be cleaned
TYPE_BOOL
Will check it is either true or false
TYPE_INT
Will check that it is an integer
TYPE_UINT
Will check that it is an unsigned integer
TYPE_NUM
Will check that it is a number
TYPE_UNUM
Will check that it is an unsigned number
TYPE_UNIXTIME
Will check that it is a unix-style timestamp (unsigned int)
TYPE_STR
Will check that it is a string, and runs trim() on it
TYPE_NOTRIM
Will check that it is a string and will not run trim() on it
TYPE_NOHTML
WIll check that it is a string and run htmlspecialchars_uni() and trim() on it
TYPE_ARRAY
WIll check that it is an array
TYPE_FILE
Will check that it is a file (ie, uploaded by the user)

You can also clean arrays of these types by using TYPE_ARRAY_<type>. For example, if you had an array of numbers, you could use TYPE_ARRAY_INT, or TYPE_ARRAY_NUM.

Cleaning Functions

The input cleaner class provides a number of useful functions that we can use to clean our data, depending on what data you wish to clean.

Cleaning Superglobal Arrays

By Superglobal, I mean $_POST, $_GET, $_REQUEST and so on. These arrays are created automaticly by PHP and contain the user-sent input. They are referenced in the vBulletin Input Cleaner by nice short single letter names. These are:

p - $_POST
g - $_GET
r - $_REQUEST
s - $_SERVER
e - $_ENV
c - $_COOKIE
f - $_FILES

The vBulletin Input Cleaner class provides the clean_array_gpc() function which allows us to clean data in these Superglobal arrays in one hit, without having to clean every individual variable in them.

Example:

PHP Code:


		
			
$vbulletin->input->clean_array_gpc('p', array(
'name' => TYPE_NOHTML,
'age' => TYPE_UINT,
'usepm' => TYPE_BOOL
));

As you can see from this example, clean_array_gpc() takes 2 paramaters. The first paramater specifies which Superglobal array you wish to clean, and the second is an array of variables and their types.

So, in the example above, we are telling clean_array_gpc() that we wish to clean the $_POST array, and that $_POST contains 3 variables, 'name', 'age', and 'usepm', and that we wish to clean them as TYPE_NOHTML, TYPE_UINT and TYPE_BOOL respectivly.

Once cleaned, the new (clean) variables will be available in the $vbulletin->GPC array. So, to follow on from our previous example, we would use something like:

PHP Code:


		
			
echo 'Your name is ' . $vbulletin->GPC['name'] . '<br />';
echo 'Your age is ' . $vbulletin->GPC['age'] . '<br />;
// etc...

Cleaning a Single Superglobal Variable

If you have a single variable that you wish to clean, use the clean_gpc() function. This function allows you to specify a single variable in any of the Superglobal arrays, and it's type.

Example:

PHP Code:


		
			
$vbulletin->input->clean_gpc('g', 'age', TYPE_UINT);
echo 'Your age is: ' . $vbulletin->GPC['age'];

In this example, the 'age' variable in the $_GET Superglobal array will be cleaned to make sure it is an unsigned integer.

Cleaning a Single Variable

If you wish to clean a single variable that is not in one of the Superglobal arrays, you should use the clean() function.

Example:

PHP Code:


		
			
$cleaned_var = $vbulletin->input->clean($dirty_var, TYPE_NOHTML);

From this example you can see that clean() takes 2 paramaters. The first is the variable that you wish to clean and the second is its type. Unlike the last 2 functions, clean() returns the variable directly.

Cleaning an Array of Variables

For times when you wish to clean an array of variables of mixed types, vBulletin provides the clean_array() function. The clean_array() function takes 2 paramaters. The first is the array to be cleaned, and the second is an array of variable names, and their types.

This function works exactly the same as clean_array_gpc(), except instead of specifying which Superglobal array to clean, you specify your own array.

Conclusion

So, to sum up - always run all input from the user through the vBulletin Input Cleaner! As well as being a good coding practice, this will drasticly decrease the chances of someone exploiting your script using an XSS or SQL attack.

Good luck using your new found knowledge of the vBulletin Input Cleaner class, and remember: If you get stuck, just ask! Knowledge sharing is what vBulletin.org is all about!

(Note: If you want to reproduce this article anywhere, I have no objections, but I do request that you give me credit for writing it, and a PM letting me know would be appreciated :))

Another fine article. Good work.

very nice. thanks dude

Thanks Alan, i have been trying to use the cleaners as opposed to $_GET, $_POST, etc... this should help me well.

This is great. One question for a novice hack. How do we know there as something wrong? If I wanted a number and the user input a letter how would I know there was an error?

Do I need to further determine the cleaned variable is a number?

Mark

You'd use
if(!is_numeric($vbulletin->GPC['age']))

For reference, when checking numbers, if vBulletin doesn't find a number, it will return 0 instead. (when using TYPE_INT or TYPE_UINT)

The types and what it will return if it can't find what you are asking for is below:

Code:

TYPE_INT and TYPE_UINT: 0



TYPE_NUM and TYPE_UNUM: 0 (if you give it a value of "3 thousand", it will return 3)



TYPE_STR, TYPE_NOTRIM and TYPE_NOHTML: The data represented as a string



TYPE_BOOL: If it finds '1', 'true', 'y', 'yes', it will return 1 - anything else, it will return 0



TYPE_ARRAY: An empty array



TYPE_FILE: An empty files array with the size property set to '4' (indicates that it isn't a file)



TYPE_UNIXTIME: 0

Thanks,
Alan.

Thanks for the information. So I'm thinking I need to check the variables even before it posts with javascript or with php.

You can always do:

PHP Code:


		
			
if ($vbulletin->GPC['foo'] == 0)
{
    // Handle not expected type
}

If the value of 0 isn't a possibility.

how would you go about cleaning $_SESSION arrays? I have been cleaning the vars before placing them into $_SESSION but I wonder if there's some way to clean the $_SESSION afterwards.?

Ohhh just what I was looking for.

Thanks Alan, its all clear now :D

Is there anyway I can use this class for an external script?

How would I approach that?

chad

Does this work on vB 3.0.x?

I can't seem to get it working. :(

Thank you so much for the great useful info, but I need to ask the TYPE_NOHTML does get rid of the <script> entry?

Does this still work?

I put this..

Code:

         $vbulletin->input->clean_array_gpc

         ('g', array(

          'year' => TYPE_UINT,

          'week' => TYPE_UINT,

          'teamid' => TYPE_UNIT,

      'team_ident' => TYPE_UNIT,

          'pid' => TYPE_UINT,

          'page' => TYPE_NOHTML));

$team_ident=$vbulletin->GPC['team_ident'];

And when I pass

Code:

{url}?team_ident=thisisatest

I get a mysql error

Code:

Invalid SQL:

SELECT * FROM table_teams WHERE id=thisisatest

Quote:

Originally Posted by cashpath (Post 1234277)

Does this still work?

I put this..

Code:

         $vbulletin->input->clean_array_gpc

         ('g', array(

          'year' => TYPE_UINT,

          'week' => TYPE_UINT,

          'teamid' => TYPE_UNIT,

      'team_ident' => TYPE_UNIT,

          'pid' => TYPE_UINT,

          'page' => TYPE_NOHTML));

$team_ident=$vbulletin->GPC['team_ident'];

And when I pass

Code:

{url}?team_ident=thisisatest

I get a mysql error

Code:

Invalid SQL:

SELECT * FROM table_teams WHERE id=thisisatest

a lil too late :p
yes, works!
try this out:

PHP Code:


		
			
$vbulletin->input->clean_array_gpc('g', array(
      'year' => TYPE_INT,
      'week' => TYPE_INT,
      'teamid' => TYPE_INT,
      'team_ident' => TYPE_INT,
      'pid' => TYPE_INT,
      'page' => TYPE_NOHTML));

$team_ident = $vbulletin->GPC['team_ident'];

HTML Code:

{url}?team_ident=$team_ident

HTML Code:

{url}?team_ident=$vbulletin->GPC['team_ident']

also, escape ur mysql statement:

Code:

SELECT * FROM table_teams WHERE id = " . $db->escape_string($vbulletin->GPC['team_ident']) . "

Can you define the maxes for both int and num?

Im using num for a post
When i enter 9999999999999 it passes -15304950.76
When i enter 999999999999 it passes 2764471.32
When i enter 99999999999 it passes 13161348.12
When i enter 9999999999 it passes -7273800.68
When i enter 999999999 it passes 12157520.92
When i enter 99999999 it passes 14100653.08
When i enter 9999999 it finally passes 9999999

Whats going on here??

NOTE: before it is displayed it is passed thru this. (truncates the number to 2 decimals without rounding.

Quote:

function truncate($number, $places){
return intval($mynumber * pow(10,$places))/pow(10,$places);
}
$vbulletin->GPC['num'] = truncate($vbulletin->GPC['num'], 2);

--------------- Added [DATE]1196465816[/DATE] at [TIME]1196465816[/TIME] ---------------

Seems my Truncate function was causing it, But now it passes numbers like
1.0E+17

How do i restrict it from doing this and just passing the number?

How can I use a cleaned variable in a template

Does TYPE_NOHTML really clean HTML? I mean, take out script tags, etc?

Hello,

I could not understand the full

Options delete:
checkbox = submit OR Delete text link

Code safe deleted for?

PHP Code:


		
			
("DELETE FROM " . TABLE_PREFIX . "table_name
            WHERE xxx_id = '".$_GET['id_delete']."'");

Thanks

Wow, exactly what I was looking for

thanks a lot, buddy

If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?

Quote:

Originally Posted by 1Unreal (Post 1859500)

If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?

Same problem me, I don't understand if I can use this function or I have to use.
I inserted some code into the vbulletin and all the variables, cookies and sessions were deleted.

Quote:

Originally Posted by 1Unreal (Post 1859500)

If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?

isset($vbulletin->GPC['foo']) will only return true if you are using the vbulletin input cleaner to clean your variables.

Does all vb versions use the same Input Cleaner ?
vb3 to vb4 ?

PHP Code:


		
			
$vbulletin->input->clean_array_gpc

PHP Code:


		
			
$vbulletin->input->clean_gpc

Thanks,, Great Article!

Quote:

Originally Posted by stangger5 (Post 2516477)

Does all vb versions use the same Input Cleaner ?
vb3 to vb4 ?

PHP Code:


		
			
$vbulletin->input->clean_array_gpc

PHP Code:


		
			
$vbulletin->input->clean_gpc

Thanks,, Great Article!

Take a look at http://www.vbulletin.com/docs/html/codestandards_gpc
Both will work, depending on what you do and need.

Phrase Groups Available:

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01678 seconds Memory Usage 1,834KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (8)bbcode_code_printable (2)bbcode_html_printable (11)bbcode_php_printable (5)bbcode_quote_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (27)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: