Safe Config.php files

What to replace - any built-in functions?

[vincevincevince]

It's common for a script to take in some user input, and then write it into a config.php file which will be used for future script executions. This can be a security risk.

Things such as?>, <?, ' and ", as well as HEREDOC syntax can play havoc with the config.php file.

How do you sanitise things so that they only result in the string themselves when placed between ' ' marks in a file?

i.e. if $language is a user supplied variable, and I write into config.php:

$fh=fopen("config.php","w");
fwrite($fh,"\$language='$language');

What steps should I take first to ensure that this is safe? I am painfully aware that <? and?> can be parsed even within a string!

[mcibor]

I usually accept, that config file can only be modified once on install and put into measure only safety regarding the quotes.
But if you require you could use str_replace for such occurences.

Eg change <? to &lt;? etc.

Michal

[vincevincevince]

I could do a list of str_replace() but I'm worried I'd miss some things of which I'm not aware. Can anyone help here?

The reason I am concerned is that I am providing a hosted service which users will be able to configure themselves. To save database use, I want to write the configuration settings to a flat file and include it directly with PHP. I cannot control what the users type in the configuration file - so I want to sanitise it.

Are there better solutions which still avoid having to read the database for configuration with each page load?

[henry0]

Aside PW and UN could you pre-define via DD boxes a bunch of parameters
then using a switch you could verify that the input is the expected one