CODEWITHSUNDEEP
phpcodeigniter
Kanishka Panamaldeniya
Kanishka Panamaldeniya

Reputation: 17576

How does Codeigniter handle escaping output?

I am using CodeIgniter.

Recently, I read a PHP book and saw some functions to escape output to server to database using 

*_escape_string()

and from server to browser using:

htmlentities()
htmlspecialchars()

In my Codeigniter application, how are these functions handled? Is it internally handled by the framework, or do I have to manually handle it?

In Ccodeigniter form validation I have seen xss_clean

$this->form_validation->set_rules('password', 'Password', 'required|xss_clean|min_length[6]|matches[confirmpassword]' );

Is xss_clean for preventing cross site scripting, or does it deal with the above I have mentioned?

Upvotes: 16

Views: 17914

Answers (5)

joash
joash

Reputation: 2323

You can create a helper function:

function my_escape($str) {
if (get_magic_quotes_gpc()) {
    $str = stripslashes($str);
}
return str_replace("'", "''", $str);
}

Upvotes: 0

ImBhavin95
ImBhavin95

Reputation: 1527

Add This Function in custom helper file

function escape_output($string)
{
    $newString = str_replace('\r\n','<br/>',$string);
    $newString = str_replace('\n\r','<br/>',$newString);
    $newString = str_replace('\r','<br/>',$newString);
    $newString = str_replace('\n','<br/>',$newString);
    $newString = str_replace('\'','',$newString);
    return $newString;
}

Call function in view

<?php echo escape_output("Bhavin\'s \"code"); ?>

Upvotes: 0

Naseer Panhwer
Naseer Panhwer

Reputation: 169

In codeignater if you are not using active record class then just in sql query use 

$this->db->escape($varaiable)

Upvotes: 0

No Results Found
No Results Found

Reputation: 102745

If you're using the Active Record class, you generally don't need to escape anything you send to your database - it's done automatically:

http://codeigniter.com/user_guide/database/active_record.html

"It also allows for safer queries, since the values are escaped automatically by the system."

Manual escaping seems to be becoming a thing of the past, as most people are using PDO now for database interactions, using paramterized queries with placeholders instead of mashing SQL strings together. CI still uses the mysql_* functions internally though.

CI's xss_clean() is, in my opinion, more of a failsafe for those of us who don't know how and when to escape data properly. You normally don't need it. It's been the target of criticism both for it's slow, aggressive approach to sanitizing data, as well as for just "not being good enough".

For escaping HTML output, in most cases htmlspecialchars() is all you need, but you can use the xss_clean() function any time. I don't suggest using it as a form validation rule because it will corrupt your input, inserting [removed] wherever it found something "naughty" in the original string. Instead, you can just call it manually to clean your output.

Summary:

  • Database: CI will (usually) escape the strings you pass to the Active Record class.
    See the user guide for details: http://codeigniter.com/user_guide/database/queries.html

  • HTML output: You need to escape HTML output yourself with htmlspecialchars() or use CI's html_escape() function (as of 2.1.0). This is not done automatically because there's no way to know the context in which you are using the data.

  • xss_clean() - If you know what you're doing, you shouldn't need it. Better to use on output than input.

Upvotes: 16

Jim OHalloran
Jim OHalloran

Reputation: 5908

Default CodeIgniter views are just PHP, so you can use htmlentities() and htmlspecialchars() in your view files.

For escaping data into the database (i.e. preventing SQL injection) CodeIgniter offers parameterised queries. Basically, put a ? in the SQl wherever you want to insert a peice of data, then supply all of the data in an array. See "Query Bindings" at http://codeigniter.com/user_guide/database/queries.html. Also on that page see "Escaping Queries" which describes the CI wrappers for the *_escape_string functions. However, query bindings/parameterised queries are a better approach.

Upvotes: 2

Related Questions