Posted by Phil Barnes on 01/30/06 18:56

Hello - crossing over from the Dark Side (ASP/Windows) to PHP/NIX.

I have found the PHP Sanitize functions provided by OWASP to be a
useful resource.

First Question:
If I use sanitize_paranoid_string or sanitize_system_string, the output
is enclosed within double quotes.

e.g.
<code>
$string = '"'.preg_replace('/\$/', '\\\$', $string).'"';
//make sure this is only interpretted as ONE argument
</code>

Is there a <em>security</em> reason why this is done? Also, could
someone elaborate on the comment that follows the command, I'm
embarassed to admit, that I'm not sure what it means.

Once, I "sanitize" the data, I don't want it to be enclosed within the
double quotes, so if I do this instead...

<code>
$string = preg_replace('/\$/', '\\\$', $string);
</code>

....is this just as secure? Or should I strip the quotes off afterwards?

T.I.A.

[Back to original message]