Re: datetime strings and using sanitize-cleanArray()

2006-07-31 Thread kitten

 I then put code to clean the $this-data array in the app_model to try
 to setup automatic cleaning of all saved data. What I found was that
 because cleanArray() cleans everything without mercy, including html
 encoding on everything, it encoded the hyphens in teh datetime format
 (not the colons though).

Sanitze::cleanArray() uses (among others) Sanitze::html() to do the
encoding. Sanitze::html() accepts a second parameter to tell it to
strip_tagas() instead of encoding. This is more appropriate in many cases.

Unfortunately, by calling cleanArray(), you can't trigger this alternative
behaviour.

There are other cases where Sanitize::html() encoding can get in your way,
i.e. when getting an email address from a form. [EMAIL PROTECTED] will
become my#45;[EMAIL PROTECTED] and will consequentely not be considered as a
valid Email address when trying to validate it.

The sanitze class is great, but could certainly be more flexible. In the
meantime, I created a controller-wide method (in app_controller.php) to
unhtml() the eunwanted encoding where necessary.

Hope this helps :)

Heiner
 
 The result was that the DB (MySQL 5.something) didnt want to store it.
 
 My solution was to hack a bit of code into the app_model to reverse
 this so that the full sanitize check looks like this:
 
 http://www.cakephp.org/pastes/show/eb23edaac3bd13381b467669d2bd291a
 
 I am specifically interested in the publishUp and publisDown fields,
 but an obvious 'to do' is to create an array of fieldnames to do this
 to.
 
 But - does anybody have any better solutions?
 
 Thx, ianh
 
 
  



--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups Cake 
PHP group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: datetime strings and using sanitize-cleanArray()

2006-07-31 Thread Chris Lamb

On Mon, 31 Jul 2006 02:34:29 -0700
AD7six [EMAIL PROTECTED] wrote:

 Why use sanitize at all? Data sent to the DB get´s escaped anyway, so
 it´s not exactly necessary. I thought the intention of the sanitize
 class was for example, so you could still escape your custom sql
 queries easily.

Well, cleaning potentially dangerous HTML to combat XSS[1] attacks is
useful.


[1] http://en.wikipedia.org/wiki/Cross-site_scripting


-- 
 Chris Lamb, Cambridgeshire, UK  [EMAIL PROTECTED]
  WWW: www.chris-lamb.co.uk GPG: 0x634F9A20


signature.asc
Description: PGP signature