Go Back   vb.org Archive > vBulletin Article Depository > Read An Article > vBulletin 3 Articles
Reload this Page Using the vBulletin Input Cleaner
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
Page 3 of 3 12 3
 
Thread Tools
Using the vBulletin Input Cleaner
Alan @ CIT
Join Date: Nov 2004
Posts: 625

 

South UK
Show Printable Version Email this Page Subscription
Alan @ CIT Alan @ CIT is offline 06-21-2006, 10:00 PM
Note: This article assumes that you are familier with PHP, and will introduce you to input filtering using vBulletin

Using the vBulletin Input Cleaner Class

Introduction

Most scripts will require data from a user at some point. When using this data, you should never assume that it is "clean" data. With XSS (Cross-Site Scripting) and SQL exploits being identified in scripts on a daily basis, you should do everything you can to ensure that all data coming from the user has been cleaned ("sanatized").

vBulletin provides us with the vB_Input_Cleaner class to do just this.
The vBulletin Input Cleaner class is setup when the page loads, and can be accessed as $vbulletin->input,

Data Types

When you accept data from the user, you should know what type of data you are expecting to receive. the vBulletin Input Cleaner allows the following types of data to be cleaned:
  • TYPE_NOCLEAN
    Will not be cleaned
  • TYPE_BOOL
    Will check it is either true or false
  • TYPE_INT
    Will check that it is an integer
  • TYPE_UINT
    Will check that it is an unsigned integer
  • TYPE_NUM
    Will check that it is a number
  • TYPE_UNUM
    Will check that it is an unsigned number
  • TYPE_UNIXTIME
    Will check that it is a unix-style timestamp (unsigned int)
  • TYPE_STR
    Will check that it is a string, and runs trim() on it
  • TYPE_NOTRIM
    Will check that it is a string and will not run trim() on it
  • TYPE_NOHTML
    WIll check that it is a string and run htmlspecialchars_uni() and trim() on it
  • TYPE_ARRAY
    WIll check that it is an array
  • TYPE_FILE
    Will check that it is a file (ie, uploaded by the user)
You can also clean arrays of these types by using TYPE_ARRAY_<type>. For example, if you had an array of numbers, you could use TYPE_ARRAY_INT, or TYPE_ARRAY_NUM.

Cleaning Functions

The input cleaner class provides a number of useful functions that we can use to clean our data, depending on what data you wish to clean.

Cleaning Superglobal Arrays

By Superglobal, I mean $_POST, $_GET, $_REQUEST and so on. These arrays are created automaticly by PHP and contain the user-sent input. They are referenced in the vBulletin Input Cleaner by nice short single letter names. These are:
  • p - $_POST
  • g - $_GET
  • r - $_REQUEST
  • s - $_SERVER
  • e - $_ENV
  • c - $_COOKIE
  • f - $_FILES
The vBulletin Input Cleaner class provides the clean_array_gpc() function which allows us to clean data in these Superglobal arrays in one hit, without having to clean every individual variable in them.

Example:
PHP Code:
$vbulletin->input->clean_array_gpc('p', array(
'name' => TYPE_NOHTML,
'age' => TYPE_UINT,
'usepm' => TYPE_BOOL
)); 
As you can see from this example, clean_array_gpc() takes 2 paramaters. The first paramater specifies which Superglobal array you wish to clean, and the second is an array of variables and their types.

So, in the example above, we are telling clean_array_gpc() that we wish to clean the $_POST array, and that $_POST contains 3 variables, 'name', 'age', and 'usepm', and that we wish to clean them as TYPE_NOHTML, TYPE_UINT and TYPE_BOOL respectivly.

Once cleaned, the new (clean) variables will be available in the $vbulletin->GPC array. So, to follow on from our previous example, we would use something like:

PHP Code:
echo 'Your name is ' . $vbulletin->GPC['name'] . '<br />';
echo 'Your age is ' . $vbulletin->GPC['age'] . '<br />;
// etc... 
Cleaning a Single Superglobal Variable

If you have a single variable that you wish to clean, use the clean_gpc() function. This function allows you to specify a single variable in any of the Superglobal arrays, and it's type.

Example:
PHP Code:
$vbulletin->input->clean_gpc('g', 'age', TYPE_UINT);
echo 'Your age is: ' . $vbulletin->GPC['age']; 
In this example, the 'age' variable in the $_GET Superglobal array will be cleaned to make sure it is an unsigned integer.

Cleaning a Single Variable

If you wish to clean a single variable that is not in one of the Superglobal arrays, you should use the clean() function.

Example:
PHP Code:
$cleaned_var = $vbulletin->input->clean($dirty_var, TYPE_NOHTML); 
From this example you can see that clean() takes 2 paramaters. The first is the variable that you wish to clean and the second is its type. Unlike the last 2 functions, clean() returns the variable directly.

Cleaning an Array of Variables

For times when you wish to clean an array of variables of mixed types, vBulletin provides the clean_array() function. The clean_array() function takes 2 paramaters. The first is the array to be cleaned, and the second is an array of variable names, and their types.

This function works exactly the same as clean_array_gpc(), except instead of specifying which Superglobal array to clean, you specify your own array.

Conclusion

So, to sum up - always run all input from the user through the vBulletin Input Cleaner! As well as being a good coding practice, this will drasticly decrease the chances of someone exploiting your script using an XSS or SQL attack.

Good luck using your new found knowledge of the vBulletin Input Cleaner class, and remember: If you get stuck, just ask! Knowledge sharing is what vBulletin.org is all about!

(Note: If you want to reproduce this article anywhere, I have no objections, but I do request that you give me credit for writing it, and a PM letting me know would be appreciated )
Reply With Quote
  #22  
Old 05-22-2009, 07:06 PM
Come2Daddy Come2Daddy is offline
 
Join Date: May 2008
Posts: 128
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Wow, exactly what I was looking for

thanks a lot, buddy
Reply With Quote
  #23  
Old 08-01-2009, 10:50 AM
1Unreal 1Unreal is offline
 
Join Date: Jul 2008
Location: London
Posts: 372
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?
Reply With Quote
  #24  
Old 09-05-2009, 03:36 PM
Sergio68's Avatar
Sergio68 Sergio68 is offline
 
Join Date: Nov 2001
Location: Italy
Posts: 100
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by 1Unreal View Post
If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?
Same problem me, I don't understand if I can use this function or I have to use.
I inserted some code into the vbulletin and all the variables, cookies and sessions were deleted.
Reply With Quote
  #25  
Old 09-06-2009, 03:32 PM
Antivirus's Avatar
Antivirus Antivirus is offline
 
Join Date: Sep 2004
Location: Black Lagoon
Posts: 1,090
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by 1Unreal View Post
If Im using isset($_GET['foo']) will isset($vbulletin->GPC['foo']) work in the same way?
isset($vbulletin->GPC['foo']) will only return true if you are using the vbulletin input cleaner to clean your variables.
Reply With Quote
  #26  
Old 11-23-2012, 06:59 PM
zero477 zero477 is offline
 
Join Date: Jan 2012
Posts: 59
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Excelent article!
Reply With Quote
  #27  
Old 09-25-2014, 03:56 PM
stangger5's Avatar
stangger5 stangger5 is offline
 
Join Date: Jan 2005
Location: Online
Posts: 1,130
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Does all vb versions use the same Input Cleaner ?
vb3 to vb4 ?

PHP Code:
$vbulletin->input->clean_array_gpc 
PHP Code:
$vbulletin->input->clean_gpc 
Thanks,, Great Article!
Reply With Quote
  #28  
Old 09-25-2014, 04:09 PM
Dave Dave is offline
 
Join Date: May 2010
Posts: 2,583
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by stangger5 View Post
Does all vb versions use the same Input Cleaner ?
vb3 to vb4 ?

PHP Code:
$vbulletin->input->clean_array_gpc 
PHP Code:
$vbulletin->input->clean_gpc 
Thanks,, Great Article!

Take a look at http://www.vbulletin.com/docs/html/codestandards_gpc
Both will work, depending on what you do and need.
Reply With Quote
Благодарность от:
stangger5
Reply
Page 3 of 3 12 3

« Previous Thread | Next Thread »
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 08:01 AM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.04905 seconds
  • Memory Usage 2,291KB
  • Queries Executed 22 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (8)bbcode_php
  • (3)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_article
  • (1)navbar
  • (4)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (8)post_thanks_box
  • (8)post_thanks_box_bit
  • (8)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (2)post_thanks_postbit
  • (8)post_thanks_postbit_info
  • (7)postbit
  • (8)postbit_onlinestatus
  • (8)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • fetch_musername
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • post_thanks_function_fetch_thanks_bit_start
  • post_thanks_function_show_thanks_date_start
  • post_thanks_function_show_thanks_date_end
  • post_thanks_function_fetch_thanks_bit_end
  • post_thanks_function_fetch_post_thanks_template_start
  • post_thanks_function_fetch_post_thanks_template_end
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete