Security practices on creating modifications

[Neorics]

so correct me if i'm wrong but this tip is only for mod writers? i mean does SMF have this feature already in it's system?

cause i'm planning to customize the 'edit profile' page to restrict certain fields to be able to be viewed/edited by certain member groups and i'll be using if($context statemets

so is it safe to do that?

[karlbenson]

any fields you add where users can enter information need

-sanitising (eg casting as integer or removing bad characters)
-validating (eg if it was a youtube id, you would validate to check its a-zA-Z0-9- in a preg_match)
-escaping (if being inserted in the database) addslashes___resursive($data);

[Neorics]

any fields you add where users can enter information need

-sanitising (eg casting as integer or removing bad characters)
-validating (eg if it was a youtube id, you would validate to check its a-zA-Z0-9- in a preg_match)
-escaping (if being inserted in the database) addslashes___resursive($data);

ok... i'm totally lost... can you point me to a direction where i can read how to do those you mentioned?

[karlbenson]

Well there isn't any specific smf code functions for doing the above.

You will need to use functions like preg_match, eregi, preg_replace with regex strings.

Santiizing eg if you've got an integer you can make sure its an integer
$string = (int) $string;

If it wasn't a number, it will be 0.

You'll find lots of examples of validating/santizing in mods.
Eg my youtube mod checks if the data being parsed is a valid youtube id (a-zA-Z0-9-)

if (preg_match(\'#^([0-9A-Za-z-_]{11})#i\', trim($data[0]), $matches)) {

More info
http://uk3.php.net/preg_match
http://uk3.php.net/preg_replace

[Neorics]

thanks, omg i didnt realize that SMF have a google ad at the bottom... just saw it after opening it in IE...

[White Girl]

Thank you for it

[BuЯЯЯЯaK]

Great post thx harzem

[Informatics]

wow... cool, thanx for posting.
Modders have to read this

[Kader]

Hi all

Can somebody shed some light on how:
db_query()

can replace:

$link = mysql_connect('host', 'root', 'password')
    or die('Could not connect: ' . mysql_error());

This is to avoid having the password hanging around in a file.

Thanx all

[metallica48423]

have you looked at the function DB entry for db_query? 

db_query will use the SMF connection to make the query in the first parameter of it.  The second and third parameter should be __FILE__ and __LINE__

ie:

Code Select Expand


$id = db_query("
    SELECT ID_MEMBER
    FROM smf_members
    WHERE realName = 'metallica48423'", __FILE__, __LINE__);


will store the result of the query in $id

[Sami Ekici]

teşekkürler Harzem Bey

[Sarge]

teşekkürler Harzem Bey

SA(^_^)Mi, this is an English language board. The Turkish language board is located at: Türkçe (Turkish)

But I understand that you are saying "Thank you, Mr. Harzem"

[Sami Ekici]

teşekkürler Harzem Bey

SA(^_^)Mi, this is an English language board. The Turkish language board is located at: Türkçe (Turkish)

But I understand that you are saying "Thank you, Mr. Harzem"

Thats Oky. I'm Sorry..