Forum Moderators: coopster
Below is a stripped down version of the code:
I have a calss in a separate file...
class MakeSecure {
function userInput ($string) {
//Removing anything from the filename string that contains the following characters:
$string = str_replace(';', '', $string); //security
$string = str_replace('#', '', $string); //security
$string = str_replace('=', '', $string); //SQL injection
$string = str_replace('<', '', $string); //SQL injection
$string = str_replace('>', '', $string); //SQL injection
$string = str_replace('"', '', $string); //SQL injection
$string = str_replace('\'', '', $string); //SQL injection
$string = str_replace('%', '', $string); //SQL injection
return $string;
} //end function
} //end class
and then this in the main file that calls it:
<?php include("session.php");
//------------------------------
//Security class and functions
//------------------------------
include("makeSecureClassAndFunctions.php");
$security = new MakeSecure;
[other code]
if (!isset($_GET['page'])) {
$current_page = 1;
}
else {
$current_page = $security->userInput($_GET["page"]);
}
etc.
Now it seems to error on the line calling ->userInput but I can't figure out why. Every other page that cals this class works correctly. I am passing it an integer this time instead of a string but this shouldn't make any difference in PHP should it as it will interpret it as an integer anyway?
Thanks
- the include fails (relative path problem?)
- the object instantiation fails for some other reason that does not cause a fatal error
- the $security var is getting reset.
Not sure what your error reporting is set to. A failed include only issues a warning, so if you're only reporting errors, that will be silent. If you use require(), it will cause a fatal error on failure, so at least you'll be sure that step succeeded.