e107 alternative for this old way of sanitize input data

[Jimmi08]

I have old code that I would like to replace with e107 stuff.
What is e107 functionality similar to this?
At first strip_tags is used, this is clear.
descript(strip_tags($_POST['title'], $allowed_tags))

Thanks

    function descript($text)
    {
        // Convert problematic ascii characters to their true values
        $search = array(
            "40", "41", "58", "65", "66", "67", "68", "69", "70",
            "71", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81",
            "82", "83", "84", "85", "86", "87", "88", "89", "90", "97", "98",
            "99", "100", "101", "102", "103", "104", "105", "106", "107",
            "108", "109", "110", "111", "112", "113", "114", "115", "116",
            "117", "118", "119", "120", "121", "122"
        );

        $replace = array(
            "(", ")", ":", "a", "b", "c", "d", "e", "f", "g", "h",
            "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u",
            "v", "w", "x", "y", "z", "a", "b", "c", "d", "e", "f", "g", "h",
            "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u",
            "v", "w", "x", "y", "z"
        );

        $entities = count($search);

        for ($i = 0; $i < $entities; $i++) $text = preg_replace("#(&\#)(0*" . $search[$i] . "+);*#si", $replace[$i], $text);

        // the following is based on code from bitflux (http://blog.bitflux.ch/wiki/)	
        // Kill hexadecimal characters completely
        $text = preg_replace('#(&\#x)([0-9A-F]+);*#si', "", $text);

        // remove any attribute starting with "on" or xmlns

        $text = preg_replace('#(<[^>]+[\\"\'\s])(onmouseover|onmousedown|onmouseup|onmouseout|onmousemove|onclick|ondblclick|onload|xmlns)[^>]*>#iU', ">", $text);

        // remove javascript: and vbscript: protocol

        $text = preg_replace('#([a-z]*)=([\`\'\"]*)script:#iU', '$1=$2nojscript...', $text);
        $text = preg_replace('#([a-z]*)=([\`\'\"]*)javascript:#iU', '$1=$2nojavascript...', $text);
        $text = preg_replace('#([a-z]*)=([\'\"]*)vbscript:#iU', '$1=$2novbscript...', $text);

        //<span style="width: expression(alert('Ping!'));"></span> (only affects ie...)
        $text = preg_replace('#(<[^>]+)style=([\`\'\"]*).*expression\([^>]*>#iU', "$1>", $text);
        $text = preg_replace('#(<[^>]+)style=([\`\'\"]*).*behaviour\([^>]*>#iU', "$1>", $text);
        return $text;
    }

[Deltik]

The implementation depends on your goal. What are you guarding against?

Your example seems to involve what ends up in <title>…</title>, perhaps. In this case, htmlentities() in the template would prevent cross-site scripting (XSS) attacks, even if malicious input were saved.

Possibly helpful resources:

• Cross Site Scripting Prevention Cheat Sheet
• Input Validation Cheat Sheet
• SQL Injection Prevention Cheat Sheet

Don't try to combine these three concepts or else you'll end up with an unusable mess like e_parse::toJS().

[Jimmi08]

Thank you!

The problem is that I can only try to detect from the code what was the original purpose of this. I am moving efiction script/functionality to e107 plugins. Not the first time attempt but the first time I was able to solve frontend editing. Their community will not help me to answer those questions.

The only and main condition is:

• output by efiction and by e107 version has to be the same (I know about need of [html][/html])

As a result of this is that I can't use the tinymce4 plugin for editing content on the front end.

So I created a new plugin for Tinymce with their original settings (Inspired by simpleMDE plugin by lonalore) and everything works nicely. it should be used only for some fields.

So I have:

• frontend editing only for users (so there is a first check)
• bbarea fields (e_form is used, standard core solution)
• e_parse addon
• toDb() method is used, actual state:

	function toDB($text, $param = array())
	{
		$type = varset($param['type'], '');
		$field = varset($param['field'], '');


        $allowed_tags = e107::getPlugPref("efiction_tinymce", 'allowed_tags');
 
        if($type == 'bbarea') {
            $text = (strip_tags($text, $allowed_tags));
            $text = $this->descript($text);
            return '[html]' . $text . '[/html]';
        }
        else return $text;
 	 
	}

from their docs: If tinyMCE is enabled, tinyMCE's cleanup function will run before tags are stripped using the allowed tags below. This means, for instance, that <b> tags will be converted to <strong> tags. See TinyMCE's documentation for information on how it cleans input.

So:

1. tinymce cleanup is running
2. striptags is applied
3. and then some checks before inserting to the database.

striptags works nicely, for example, if I don't allow <span> tag, coloring is not saved

I think if I let that code there, it can't hurt. Lately, I will look at tinymce4 and how this is managed.