From 196cb8334747d04de28a97c61b91c793fecb70e6 Mon Sep 17 00:00:00 2001
From: Nathan Kinkade <nath@nkinka.de>
Date: Sat, 8 Mar 2008 19:07:01 +0000
Subject: Function to sanitize user input, and search box is now sanitized.

---
 lib/standard.lib.php | 48 ++++++++++++++++++++++++++++++++++--------------
 1 file changed, 34 insertions(+), 14 deletions(-)

(limited to 'lib/standard.lib.php')

diff --git a/lib/standard.lib.php b/lib/standard.lib.php
index 503052e..e338f67 100644
--- a/lib/standard.lib.php
+++ b/lib/standard.lib.php
@@ -1,8 +1,10 @@
 <?php
 
-# this function will simply initialize a variable to
-# an empty string unless it already has a value, in
-# which case it will simply return the existing value
+/**
+ * This function will simply initialize a variable to
+ * an empty string unless it already has a value, in
+ * which case it will simply return the existing value
+ */
 function initVar($var) {
 	
 	$var = empty($var) ? "" : $var;
@@ -10,13 +12,15 @@ function initVar($var) {
 
 }
 
-# this function will initialize a variable to an empty
-# string unless it already has a value, in which case
-# it will simply return the existing value ... the only
-# diff. between this function and initVar() is that this
-# fuction encodes HTML special characters and then echos
-# the variable ... useful for initializing and printing
-# a variable all in one step
+/**
+ * This function will initialize a variable to an empty
+ * string unless it already has a value, in which case
+ * it will simply return the existing value ... the only
+ * diff. between this function and initVar() is that this
+ * fuction encodes HTML special characters and then echos
+ * the variable ... useful for initializing and printing
+ * a variable all in one step
+ */
 function printVar($var) {
 	
 	$var = empty($var) ? "" : htmlspecialchars($var,ENT_QUOTES);
@@ -25,10 +29,12 @@ function printVar($var) {
 
 }
 
-# create pagination, including a page navigation bar.  the
-# output should be fairly generic, enclosed in a div with 
-# a css class of 'paginationNav', and more or less suitable
-# to be dropped into just about any page.
+/**
+ * Create pagination, including a page navigation bar.  the
+ * output should be fairly generic, enclosed in a div with 
+ * css class of 'paginationNav', and more or less suitable
+ * to be dropped into just about any page.
+ */
 function getPagination($page = 1, $pageOffset, $uri , $paginationSql) {
 
 	global $config, $db;
@@ -109,4 +115,18 @@ HTML;
 
 }
 
+/**
+ * Sanitize user form input, which at the moment means:
+ * - trim any leading and trailing whitespace
+ * - convert HTML special chars to HTML entities
+ */
+function sanitizeUserInput($input) {
+
+	$output = trim($input);
+	$output = htmlspecialchars($output);
+
+	return $output;
+
+}
+
 ?>
-- 
cgit v1.2.3