title: sanitizing data before mysql injection and xss - am i doing it right with pdo and htmlpurifier
body: <p>I am still working with securing my web app. I decided to use PDO library to prevent mysql injection and html purifier to prevent xss attacks. Because all the data that comes from input goes to database I perform such steps in order to work with data:</p>
  
  <ol>
  <li>get data from input field</li>
  <li>start pdo, prepare query</li>
  <li>bind each variable (POST variable) to query, with sanitizing it using html purifier</li>
  <li>execute query (save to database).</li>
  </ol>
  
  <p>In code it looks like this:</p>
  
  <pre><code>// start htmlpurifier
  require_once '/path/to/htmlpurifier/library/HTMLPurifier.auto.php';
  
  $config = HTMLPurifier_Config::createDefault();
  $purifier = new HTMLPurifier($config);
  
  // start pdo
  $pdo = new PDO('mysql:host=host;dbname=dbname', 'login', 'pass');
  $pdo -&gt; setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
  
  // prepare and bind
  $stmt = $pdo -&gt; prepare('INSERT INTO `table` (`field1`) VALUES ( :field1 )');
  // purify data and bind it.
  $stmt -&gt; bindValue(':field1',   $purifier-&gt;purify($_POST['field1']), PDO::PARAM_INT); 
  // execute (save to database)
  $stmt -&gt; execute();
  </code></pre>
  
  <p>Here are the questions: </p>
  
  <ol>
  <li><p>Is that all I have to do to prevent XSS and mysql injection? I am aware that i cant be 100% sure but in most cases should it work fine and is it enough?</p></li>
  <li><p>Should I sanitize the data once again when grabing it from db and putting to browser or filtering before saving is just enough?</p></li>
  <li><p>I was reading on wiki that it's smart to turn of magic_quotes. Ofocurse if magic quotes puts unnecessery slahes it can be annoying but if I don't care about those slashes isn't turning it of just losing another line of defense? </p></li>
  </ol>
  
  <p><strong>Answer:</strong></p>
  
  <p>Please note that code I have written in this example is just an example. There is a lot of inputs and query to DB is much more complicated. Unfortunately I can't agree with you that if PDO type of variable should be int I do not have to filter it with XSS attacks. Correct me if I am wrong:</p>
  
  <p>If the input should be an integer, and it is then it's ok - I can put it to DB. But remember that any input can be changed and we have to expect the worse. So if everything is alright than it is alright, but if a malicious user would input XSS code than I have multiple lines of defense:</p>
  
  <ol>
  <li>client side defense - check if it is numeric value. Easy to compromise, but can stop total newbies.</li>
  <li>server side - xss injection test (with html purify or ie htmlspecialchars)</li>
  <li>db side - if somehow somebody puts malicious code that will avoid xss protection than database is going to return error because there should be integer, not any other kind of variable.</li>
  </ol>
  
  <p>I guess it is not doing anything wrong, and it can do a lot of good. Ofcourse we are losing some time to calculate everything, but i guess we have to put on the weight performance and security and determine what is more important for you. My app is going to be used by 2-3 users at a time. Not many. And a security is much more important for me than performance.</p>
  
  <p>Fortunately my whole site is with UTF8 so I do not expect any problems with encoding. </p>
  
  <p>While searching the net i met a lot of opinions about addslashes(), stripslashes(), htmlspecialchars(), htmlentities().. and i've chosen htmlpurity and pdo. Everyone is saying that they are best solutions before xss and mysql injections threats. If you have any other opinion please share. </p>