[Deprecated] DMZ 1.5.3 (DataMapper OverZealous Edition)

[eluser]OverZealous[/eluser]
@Poetawd

You basically have it. I use very similar code for verification (the where_related). I verify every single object and every value that is passed back to my apps. My apps, however, are often used by "anyone and their brother", so I have to assume that they are trying to break it.

I'm glad you are catching on. It seems like many web developers do not understand basic security, and HTML-based forms are probably the least secure input method of all. I have found a lot of websites with the exact issue you describe.

In the end, the basic, paranoia rule is:

Never trust anything your user sends you.

This is also why it is so critical to apply htmlspecialchars() to every dynamic string value you output to the browser, especially if a user could have edited it.

(And if you want to accept HTML-formatted text — I don't recommend this unless you can pass it through htmltidy — you have to be even more careful, such as using CI's xss filters, possibly limiting which tags are allowed, and more.)