Skip to content

filter_input -> filter_var#2

Merged
snipershady merged 1 commit into
snipershady:mainfrom
DamImpr:main
Dec 11, 2025
Merged

filter_input -> filter_var#2
snipershady merged 1 commit into
snipershady:mainfrom
DamImpr:main

Conversation

@DamImpr
Copy link
Copy Markdown
Contributor

@DamImpr DamImpr commented Dec 10, 2025

I reinstated the filter_input methods and added filter_var.
In FastCGI/FPM environments, filter_input is unreliable. Data is read directly from the raw input buffer managed by SAPI. This means that in containerised environments, data reading between the web server and fpm may fail. Alternatively, in some bad practices, where information is overwritten, unexpected results may occur.

@snipershady
Copy link
Copy Markdown
Owner

https://top10proactive.owasp.org/the-top-10/c3-validate-input-and-handle-exceptions/#allowlisting-vs-denylisting

`"Never trust provided data! Screen all data for malicious patterns or, even better, check all data against an allow list."

"Always perform Input validation on the server side for security. While client-side validation is useful for both functional and security purposes, it is easily bypassed."`

@snipershady snipershady reopened this Dec 11, 2025
@DamImpr
Copy link
Copy Markdown
Contributor Author

DamImpr commented Dec 11, 2025

...i don't think I mentioned client-side validation anywhere in my PR 😅....

@snipershady snipershady merged commit fb65948 into snipershady:main Dec 11, 2025
2 checks passed
@DamImpr
Copy link
Copy Markdown
Contributor Author

DamImpr commented Dec 11, 2025

Thanks Nicolas

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants