input TYPE_STR , is it safe enough in this case ?

[abualjori]

Hey !


I made a custom profile field , and datamanger was part of the process.


so , here is what I did.

PHP Code:

$vbulletin->input->clean_gpc('p','my_field',TYPE_STR); 


then I used datamangers to set the info

PHP Code:


$test =& datamanager_init('User', $vbulletin, ERRTYPE_STANDARD); 
$test->set_existing($vbulletin->userinfo); 
$test->set('my_field', $vbulletin->GPC['my_field']); 
$test->save(); 


This mod uses bbcode so I need double quotes here,(I missed up every thing when I used TYPE_NOHTML)


does this looks safe enough to be used in my live forums ? and do I have to escape strings etc , or datamanger would take care of it.



Thank you.

[sheppardzwc]

The vBulletin input cleaner will escape anything that would normally be harmful to the boards. So yes, that would work fine.

[kh99]

It looks to me like clean_gpc with TYPE_STR just trims blanks off the ends and removes null characters. So if you don't want to allow html in that field you may need to do something else.

I guess you could try entering some html and see what happens.

[vbenhancer]

TYPE_NOHTML will do your job...

[kh99]

Originally Posted by vbenhancer

TYPE_NOHTML will do your job...

...except that the OP says that TYPE_NOHTML messed things up. Looking at includes/class_core.php it looks like cleaning a TYPE_NOHTML value does this:

PHP Code:

str_replace(
    // replace special html characters
    array('<', '>', '"'),
    array('&lt;', '&gt;', '&quot;'),
    preg_replace(
        // translates all non-unicode entities
        '/&(?!' . ($entities ? '#[0-9]+|shy' : '(#[0-9]+|[a-z]+)') . ';)/si',
        '&amp;',
        $text
    )
); 


so maybe you could leave it as TYPE_STR but clean it yourself using the above code, and take out the part that replaces the quotes.

[abualjori]

Hi !

with a little test.

vbulletin seems to parse bbcode with quotes.



[color="Red"]test[/color]



or even without them.

[color=Red]test[/color]



so I made the same function that kh99 provided but, with stripping every single html char so it replaced it with nothing.




Thank you so much everyone for your input.:up: