Newsgroup: it.comp.www.php
Titolo: evitare il form injection

dal un form mail utilizzano $_POST in questo modo:
$name1 = $_POST['name'];
$from1 = $_POST['from'];
$oggetto1 = $_POST['oggetto'];
$feedback1= $_POST['feedback'];
Si elimina il rischio di form injection ?


Assolutamente no!
Cerca nell'archivio del NG: vi sono diversi post in merito.
Per evitare form injection devi *validare* l'informazione inviata 
dall'utente: ovvero se mi aspetto un numero compreso tra 1 e 10 devo 
verificare che il valore immesso dall'utente sia un numero compreso tra 
1 e 10, altrimenti non accetto l'input; per quanto riguarda le stringhe 
devi escapare eventuali caratteri "pericolosi" e verificare sempre se 
ciò che ti inviano è ciò che ti aspettavi.
Ovviamente il form injection deve essere valutato nel suo step 
successivo: cosa ci fai con i dati inviati? Una query sql? Bene, allora 
verifica che non ci siano valori che disturbano la query (sql 
injection). Invii una mail? Ok ci deve essere un *solo* indirizzo, il 
subject non *deve* contenere eventuali header immessi di proposito 
dall'utente etc...
Con il php 5.2 è stato introdotto un modulo per il controllo dei dati in 
input (finalmente) utile per alcuni controlli, inutile per altri: 
http://it.php.net/manual/en/book.filter.php
	Francesco

 ha scritto nel messaggio 
news:g15uq2$f6k$1...@tdi.cu.mi.it...

Ho cercato nell'archivio del NG ma non riesco a trovare nulla inserendo le 
parole chiave ( validare ) e ( form injection )
Comunque ho trovato un altro script che allego. E'  più valido ?
<?php
  //
  //===========================================================
  //            Main Settings              //
  //=======================================//
  error_reporting(E_ALL ^ E_NOTICE);
  ini_set('register_globals', 0);
  session_start();
  include("userdat.php");
  include("keyword.php");
  //=======================================//
  //            Main Variables             //
  //=======================================//
  $host = $_SERVER['HTTP_HOST'];
  $ipid = $_SERVER['REMOTE_ADDR'];
  $gurl = $_SERVER['QUERY_STRING'];
  $user = $_SERVER['HTTP_USER_AGENT'];
  $find = $_SERVER['HTTP_ACCEPT_LANGUAGE'];
  $copy = "A71-Mail 4.1 By Alecos &copy; 2004-2008, Alessandro Marinuzzi";
  //=======================================//
  //            Security Numbers           //
  //=======================================//
  function get_rand_value($length) {
    for($i = 1; $i <= $length; $i++) {
      $rand_value .= mt_rand(1,9);
    }
    return $rand_value;
  }
  $nmb1 = get_rand_value(1);
  $nmb2 = get_rand_value(1);
  //=======================================//
  //     Get a pair of random numbers      //
  //=======================================//
  if ((!isset($_SESSION['num1'])) || (empty($_SESSION['num1']))) {
    $_SESSION['num1'] = $nmb1;
    $num1 = $_SESSION['num1'];
  } else {
    $num1 = $_SESSION['num1'];
  }
  if ((!isset($_SESSION['num2'])) || (empty($_SESSION['num2']))) {
    $_SESSION['num2'] = $nmb2;
    $num2 = $_SESSION['num2'];
  } else {
    $num2 = $_SESSION['num2'];
  }
  //======================================//
  //     Get the REFERER from the user    //
  //======================================//
  if ((!isset($_SESSION['refe'])) || (empty($_SESSION['refe']))) {
    $_SESSION['refe'] = $_SERVER['HTTP_REFERER'];
    $refe = $_SESSION['refe'];
  } else {
    $refe = $_SESSION['refe'];
  }
  //=======================================//
  //          Parse Query String           //
  //=======================================//
  parse_str($gurl);
  //=======================================//
  //          Language Detection           //
  //=======================================//
  if (($lang == "it") || ($lang == "fr") || ($lang == "de") || ($lang == 
"es") || ($lang == "en")) {
    $lang = $lang;
  }
  if ((!isset($lang)) || (empty($lang)) || ($lang == "auto")) {
    $lang = substr($find,0,2);
  }
  //=======================================//
  //              Set Path                 //
  //=======================================//
  if ((isset($page)) || (!empty($page))) {
    $wurl = "http://$host";
    $wdir = pathinfo($page);
    $wdir = $wdir['dirname'];
    if ($wurl == $wdir) {
      $path = stripslashes($page);
    } else {
      $path = $wurl;
    }
  }
  if ((!isset($path)) || (empty($path))) {
    $path = "http://$host";
  }
  //=======================================//
  //        Manage URL As Variables        //
  //=======================================//
  if ((isset($fname)) || (!empty($fname))) {
    $_POST['fname'] = stripslashes($fname);
  }
  if ((isset($fmail)) || (!empty($fmail))) {
    $_POST['fmail'] = stripslashes($fmail);
  }
  if ((isset($subject)) || (!empty($subject))) {
    $_POST['subject'] = stripslashes($subject);
  }
  if ((isset($message)) || (!empty($message))) {
    $_POST['message'] = stripslashes($message);
  }
  //=======================================//
  //            Verify Variables           //
  //=======================================//
  if ((!isset($_POST['fname'])) || (!isset($_POST['fmail'])) || 
(!isset($_POST['subject'])) || (!isset($_POST['message']))) {
    if ($lang == "it") {
      include("strg_it.php");
      $formstat = $formstr1;
      include("formail.php");
    } elseif ($lang == "fr") {
      include("strg_fr.php");
      $formstat = $formstr1;
      include("formail.php");
    } elseif ($lang == "de") {
      include("strg_de.php");
      $formstat = $formstr1;
      include("formail.php");
    } elseif ($lang == "es") {
      include("strg_es.php");
      $formstat = $formstr1;
      include("formail.php");
    } else {
      include("strg_en.php");
      $formstat = $formstr1;
      include("formail.php");
    }
  } else {
    //=======================================//
    //      Verify Name And/or Surname       //
    //=======================================//
    if ((!preg_match("/^\w/", stripslashes($_POST['fname']))) || 
(preg_match("/(%0A|%0D|\\n+|\\r+|;|mime-version:|content-type:|content-transfer-encoding:|to:|cc:|bcc:)/i", 
stripslashes($_POST['fname']))) || (preg_match($keys, 
stripslashes($_POST['fname'])))) {
      if ($lang == "it") {
        include("strg_it.php");
        $formstat = $formstr2;
        include("formail.php");
      } elseif ($lang == "fr") {
        include("strg_fr.php");
        $formstat = $formstr2;
        include("formail.php");
      } elseif ($lang == "de") {
        include("strg_de.php");
        $formstat = $formstr2;
        include("formail.php");
      } elseif ($lang == "es") {
        include("strg_es.php");
        $formstat = $formstr2;
        include("formail.php");
      } else {
        include("strg_en.php");
        $formstat = $formstr2;
        include("formail.php");
      }
      exit();
      //=======================================//
      //          Verify Email Address         //
      //=======================================//
    } elseif (!preg_match("/^[a-zA-Z0-9]+([_\\.-][a-zA-Z0-9]+)*". 
"@([a-zA-Z0-9]+([\.-][a-zA-Z0-9]+))+$/", stripslashes($_POST['fmail']))) {
      if ($lang == "it") {
        include("strg_it.php");
        $formstat = $formstr3;
        include("formail.php");
      } elseif ($lang == "fr") {
        include("strg_fr.php");
        $formstat = $formstr3;
        include("formail.php");
      } elseif ($lang == "de") {
        include("strg_de.php");
        $formstat = $formstr3;
        include("formail.php");
      } elseif ($lang == "es") {
        include("strg_es.php");
        $formstat = $formstr3;
        include("formail.php");
      } else {
        include("strg_en.php");
        $formstat = $formstr3;
        include("formail.php");
      }
      exit();
      //=======================================//
      //             Verify Subject            //
      //=======================================//
    } elseif ((!preg_match("/^[^\s]./", stripslashes($_POST['subject']))) || 
(preg_match("/(%0A|%0D|\\n+|\\r+|;|mime-version:|content-type:|content-transfer-encoding:|to:|cc:|bcc:)/i", 
stripslashes($_POST['subject']))) || (preg_match($keys, 
stripslashes($_POST['subject'])))) {
      if ($lang == "it") {
        include("strg_it.php");
        $formstat = $formstr4;
        include("formail.php");
      } elseif ($lang == "fr") {
        include("strg_fr.php");
        $formstat = $formstr4;
        include("formail.php");
      } elseif ($lang == "de") {
        include("strg_de.php");
        $formstat = $formstr4;
        include("formail.php");
      } elseif ($lang == "es") {
        include("strg_es.php");
        $formstat = $formstr4;
        include("formail.php");
      } else {
        include("strg_en.php");
        $formstat = $formstr4;
        include("formail.php");
      }
      exit();
      //=======================================//
      //              Verify Message           //
      //=======================================//
    } elseif ((!preg_match("/^[^\s]./", stripslashes($_POST['message']))) || 
(preg_match($keys, stripslashes($_POST['message'])))) {
      if ($lang == "it") {
        include("strg_it.php");
        $formstat = $formstr5;
        include("formail.php");
      } elseif ($lang == "fr") {
        include("strg_fr.php");
        $formstat = $formstr5;
        include("formail.php");
      } elseif ($lang == "de") {
        include("strg_de.php");
        $formstat = $formstr5;
        include("formail.php");
      } elseif ($lang == "es") {
        include("strg_es.php");
        $formstat = $formstr5;
        include("formail.php");
      } else {
        include("strg_en.php");
        $formstat = $formstr5;
        include("formail.php");
      }
      exit();
      //====================================//
      //        Verify Security Code        //
      //====================================//
    } elseif (($num1 + $num2) != stripslashes($_POST['security'])) {
      if ($lang == "it") {
        include("strg_it.php");
        $formstat = $formstr6;
        include("formail.php");
      } elseif ($lang == "fr") {
        include("strg_fr.php");
        $formstat = $formstr6;
        include("formail.php");
      } elseif ($lang == "de") {
        include("strg_de.php");
        $formstat = $formstr6;
        include("formail.php");
      } elseif ($lang == "es") {
        include("strg_es.php");
        $formstat = $formstr6;
        include("formail.php");
      } else {
        include("strg_en.php");
        $formstat = $formstr6;
        include("formail.php");
      }
      exit();
    } else {
      //=======================================//
      //              If Submit                //
      //=======================================//
      if ($_POST['cmd_submit']) {
        //=======================================//
        //          Prepare For Mailing          //
        //=======================================//
        $fname = stripslashes($_POST['fname']);
        $fmail = stripslashes($_POST['fmail']);
        $subject = stripslashes($_POST['subject']);
        $message = stripslashes($_POST['message']);
        //=======================================//
        //          Prepare For Sending          //
        //=======================================//
        if (strtoupper(substr(PHP_OS,0,3) == 'WIN')) {
          $eol = "\r\n";
        } elseif (strtoupper(substr(PHP_OS,0,3) == 'MAC')) {
          $eol = "\r";
        } else {
          $eol = "\n";
        }
        //=======================================//
        //             Prepare Headers           //
        //=======================================//
        $message .= $eol . $eol . 
"----------------------------------------------------------" . $eol . 
"LANGUAGE: $lang" . $eol . "IP: $ipid" . $eol . "AGENT: $user" . $eol . 
"WHOIS: $info$ipid" . $eol . "GEOIP: $goip$ipid" . $eol . "REFERER: $refe" . 
$eol;
        $headers = "From: $fname <$fmail>" . $eol . "Reply-To: $fname 
<$fmail>" . $eol . "Return-Path: $fmail" . $eol . "MIME-Version: 1.0" . $eol 
. "Content-Type: text/plain; Charset=UTF-8; Format=Flowed" . $eol . 
"Content-Transfer-Encoding: 8BIT" . $eol . "X-Mailer: A71-Mail 4.1";
        //=======================================//
        //               Send Email              //
        //=======================================//
        if (!@mail($mail, $subject, $message, $headers)) {
          if (!@mail($mail, $subject, $message, $headers, "-f $fmail")) {
            if ($lang == "it") {
              include("strg_it.php");
              $formstat = $formstr7;
              include("formail.php");
            } elseif ($lang == "fr") {
              include("strg_fr.php");
              $formstat = $formstr7;
              include("formail.php");
            } elseif ($lang == "de") {
              include("strg_de.php");
              $formstat = $formstr7;
              include("formail.php");
            } elseif ($lang == "es") {
              include("strg_es.php");
              $formstat = $formstr7;
              include("formail.php");
            } else {
              include("strg_en.php");
              $formstat = $formstr7;
              include("formail.php");
            }
            exit();
          }
        } else {
          //=======================================//
          //             Create Email Log          //
          //=======================================//
          if ($logs == "on") {
            if (!is_dir("logs")) {
              mkdir("logs");
            }
            $tmp1 = fopen("logs/log" . "[" . date('d-m-Y') . "][" . 
date('H.i.s') . "]" . ".txt", "w+");
            $tmp2 .= "Date: " . date('d-m-Y H:i:s') . $eol;
            $tmp2 .= "To: $mail" . $eol;
            $tmp2 .= $headers . $eol;
            $tmp2 .= "Subject: $subject" . $eol;
            $tmp2 .= "Message: $message" . $eol;
            fwrite($tmp1, $tmp2);
            fclose($tmp1);
            unset($tmp1);
            unset($tmp2);
          }
          //=======================================//
          //            Destroy Session            //
          //=======================================//
          session_destroy();
          //=======================================//
          //             Confirm Email             //
          //=======================================//
          if ($lang == "it") {
            include("strg_it.php");
            include("confirm.php");
          } elseif ($lang == "fr") {
            include("strg_fr.php");
            include("confirm.php");
          } elseif ($lang == "de") {
            include("strg_de.php");
            include("confirm.php");
          } elseif ($lang == "es") {
            include("strg_es.php");
            include("confirm.php");
          } else {
            include("strg_en.php");
            include("confirm.php");
          }
          exit();
        }
      } else {
        if ($lang == "it") {
          include("strg_it.php");
          $formstat = $formstr1;
          include("formail.php");
        } elseif ($lang == "fr") {
          include("strg_fr.php");
          $formstat = $formstr1;
          include("formail.php");
        } elseif ($lang == "de") {
          include("strg_de.php");
          $formstat = $formstr1;
          include("formail.php");
        } elseif ($lang == "es") {
          include("strg_es.php");
          $formstat = $formstr1;
          include("formail.php");
        } else {
          include("strg_en.php");
          $formstat = $formstr1;
          include("formail.php");
        }
        exit();
      }
    }
  }
?>

aluigi wrote:

http://php-ids.org/
provate questo
-- 
e ziocan