Re: PHP variable sanitization functions

["Gavin Zuchlinski" <gzuchlinski () pgsit org>]

> Your sanitize_sql_string function allows backslash.
Thanks for pointing that out, it is now fixed.

> Your sanitize_system_string function allows the string to contain
> newlines and quotation marks.  An attacker could close the argument with a
> quotation mark, add a newline, and then run an arbitrary command.

Again thanks, I originally went through a bash reference but horribly
neglected to include quotes.
Some of the changes Liam mentioned were added to the code early this morning
quickly before I headed off to class, so some people might have gotten the
updated code without realizing it was updated.

Also thanks to Jamie Pratt, I created a seperate sanitize_html_string which
is intended to stop xss. Please help me by critiqueing that some more. The
page is http://libox.net/sanitize.php

-Gavin Zuchlinski
http://libox.net/