Do I need to sanitize the user input Laravel

Question

I am using Laravel 4 with Eloquent. When I get the user input I just use $name=Input::get('name') and then I do $a->name=$name;

I don't know if the function Input::get protect me from SQL Injection and XSS. If it does not, what do I have to do to sanitize the input?

And, when I show the value in my view, shall I use {{$a}} or {{{$a}}}

Greetings and thanks.

In addition to the other answers, in case you decide to use something like new Something(Input::all()) make sure to specify the $fillable fields in the Something model, in order to protect against mass assignment. Not strictly pertaining to your questions, but something to be aware of. — Yasen Slavov, Oct 05 '14 at 13:03

score 17 · Accepted Answer · edited May 23 '17 at 12:25

17

Laravel uses PDO's parameter binding, so SQL injection is not something you should worry about. You should read this though.

Input::get() does not filter anything.

Triple curly braces do the same as e() and HTML::entities(). All of them call htmlentities with UTF-8 support:

htmlentities($your_string, ENT_QUOTES, 'UTF-8', false);

edited May 23 '17 at 12:25

Community

1
1

answered Oct 05 '14 at 12:52

cha-cha

298
3
12

If I use {{{ to show it, should I use also htmlentities when saving the information? – Fylux Oct 05 '14 at 13:08
3

Escape output, not input. – cha-cha Oct 05 '14 at 13:20
2

There's no need to alter data unless you actually use it. Filter input, escape output. – cha-cha Oct 05 '14 at 13:30
It should be pointed out that Laravel provides raw sql query support which isn't protected from injection at all. So there is always the chance that someone may build a site with some raw queries that do need manual cleaning. – AdamJones Feb 11 '20 at 13:33

Marcin Nabiałek · Answer 2 · 2014-10-05T13:08:55.247

5

You should use {{{$a}}} because for example Input can has HTML tag. Laravel won't filter it.

To avoid SQL injection you should use bind your parameters running queries like:

$var = 1;
$results = DB::select('select * from users where id = ?', array($var));

and not:

$results = DB::select('select * from users where id = '.$var);

edited Oct 05 '14 at 13:08

answered Oct 05 '14 at 12:47

Marcin Nabiałek

104,635
41
242
277

So I should use htmlentities or something like that? What does Input::get filter? – Fylux Oct 05 '14 at 12:49
@Fylux So far as I know it's interface to getting POST, GET and so on data. It trims data but doesn't filter it, so when displaying you should use triple bracing - this way `htmlentities` function is run on variable value – Marcin Nabiałek Oct 05 '14 at 13:05
If I use {{{ to show it, should I use also htmlentities when saving the information? – Fylux Oct 05 '14 at 13:07
@Fylux No, using `{{{` Laravel will do it for you – Marcin Nabiałek Oct 05 '14 at 13:07
But is there any problem if I have a corrupted input saved in my db? – Fylux Oct 05 '14 at 13:08
@Fylux what do you mean? Always there might be some problem and running htmlentities or {{{ in theory should solve this problem – Marcin Nabiałek Oct 05 '14 at 13:10
I mean, if would be better to do both things, use htmlentities and {{{ – Fylux Oct 05 '14 at 13:13
And about you comment, I guess I won't have problem with binding parameters because I use Eloquent. – Fylux Oct 05 '14 at 13:15

score -1 · Answer 3 · answered Sep 04 '20 at 20:47

Yes Always you need to save clean data in database, for that I was used HTML Purifier:

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications. Tired of using BBCode due to the current landscape of deficient or insecure HTML filters? Have a WYSIWYG editor but never been able to use it? Looking for high-quality, standards-compliant, open-source components for that application you're building? HTML Purifier is for you!

For Laravel projects you can use this service provider https://github.com/mewebstudio/purifier for including the HTMLPurifier in your project.

Do I need to sanitize the user input Laravel

3 Answers3