Gitiles
Code Review Sign In
www.giggi.me / code-igniter-v3-giggi / 09de1854b1ac78f81264ca7a6b9d849ddcd1d159 / . / user_guide / general / security.html
blob: 083be367fe879ee4bfce1d7742879b7d2764c00b [file] [log] [blame]
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]1<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
2<html>
3<head>
4
5<title>Code Igniter User Guide</title>
6
7<style type='text/css' media='all'>@import url('../userguide.css');</style>
8<link rel='stylesheet' type='text/css' media='all' href='../userguide.css' />
9
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]10<script type="text/javascript" src="../nav/nav.js"></script>
admin2296fc32006-09-27 21:07:02 +0000[diff] [blame]11<script type="text/javascript" src="../nav/prototype.lite.js"></script>
admin17a890d2006-09-27 20:42:42 +0000[diff] [blame]12<script type="text/javascript" src="../nav/moo.fx.js"></script>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]13<script type="text/javascript">
14window.onload = function() {
admine334c472006-10-21 19:44:22 +0000[diff] [blame]15 myHeight = new fx.Height('nav', {duration: 400});
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]16 myHeight.hide();
17}
18</script>
19
20<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
21<meta http-equiv='expires' content='-1' />
22<meta http-equiv= 'pragma' content='no-cache' />
23<meta name='robots' content='all' />
24<meta name='author' content='Rick Ellis' />
25<meta name='description' content='Code Igniter User Guide' />
26
27</head>
28<body>
29
30<!-- START NAVIGATION -->
31<div id="nav"><div id="nav_inner"><script type="text/javascript">create_menu('../');</script></div></div>
32<div id="nav2"><a name="top"></a><a href="javascript:void(0);" onclick="myHeight.toggle();"><img src="../images/nav_toggle.jpg" width="153" height="44" border="0" title="Toggle Table of Contents" alt="Toggle Table of Contents" /></a></div>
33<div id="masthead">
34<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
35<tr>
Rick Ellis257651d2006-11-23 18:40:13 +0000[diff] [blame]36<td><h1>Code Igniter User Guide Version 1.5.1</h1></td>
adminc0d5d522006-10-30 19:40:35 +0000[diff] [blame]37<td id="breadcrumb_right"><a href="../toc.html">Table of Contents Page</a></td>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]38</tr>
39</table>
40</div>
41<!-- END NAVIGATION -->
42
43
44<!-- START BREADCRUMB -->
45<table cellpadding="0" cellspacing="0" border="0" style="width:100%">
46<tr>
47<td id="breadcrumb">
48<a href="http://www.codeigniter.com/">Code Igniter Home</a> &nbsp;&#8250;&nbsp;
49<a href="../index.html">User Guide Home</a> &nbsp;&#8250;&nbsp;
50Security
51</td>
52<td id="searchbox"><form method="get" action="http://www.google.com/search"><input type="hidden" name="as_sitesearch" id="as_sitesearch" value="www.codeigniter.com/user_guide/" />Search User Guide&nbsp; <input type="text" class="input" style="width:200px;" name="q" id="q" size="31" maxlength="255" value="" />&nbsp;<input type="submit" class="submit" name="sa" value="Go" /></form></td>
53</tr>
54</table>
55<!-- END BREADCRUMB -->
56
57<br clear="all" />
58
59
60<!-- START CONTENT -->
61<div id="content">
62
63<h1>Security</h1>
64
65<p>This page describes some "best practices" regarding web security, and details
66Code Igniter's internal security features.</p>
67
68
69<h2>URI Security</h2>
70
71<p>Code Igniter is fairly restrictive regarding which characters it allows in your URI strings in order to help
72minimize the possibility that malicious data can be passed to your application. URIs may only contain the following:
73</p>
74
75<ul>
76<li>Alpha-numeric text</li>
77<li>Tilde: ~ </li>
78<li>Period: .</li>
79<li>Colon: :</li>
80<li>Underscore: _</li>
81<li>Dash: -</li>
82</ul>
83
84<h2>GET, POST, and COOKIE Data</h2>
85
86<p>GET data is simply disallowed by Code Igniter since the system utilizes URI segments rather than traditional URL query strings (unless
admine334c472006-10-21 19:44:22 +0000[diff] [blame]87you have the query string option enabled in your config file). The global GET
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]88array is <strong>unset</strong> by the Input class during system initialization.</p>
89
90<h2>Register_globals</h2>
91
92<p>During system initialization all global variables are unset, except those found in the $_POST and $_COOKIE arrays. The unsetting
93routine is effectively the same as register_globals = off.</p>
94
95
96<h2>magic_quotes_runtime</h2>
97
98<p>The magic_quotes_runtime directive is turned off during system initialization so that you don't have to remove slashes when
99retrieving data from your database.</p>
100
admin78ce3cc2006-10-02 02:58:03 +0000[diff] [blame]101<h1>Best Practices</h1>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]102
admine334c472006-10-21 19:44:22 +0000[diff] [blame]103<p>Before accepting any data into your application, whether it be POST data from a form submission, COOKIE data, URI data,
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]104XML-RPC data, or even data from the SERVER array, you are encouraged to practice this three step approach:</p>
105
106<ol>
107
108<li>Filter the data as if it were tainted.</li>
109<li>Validate the data to ensure it conforms to the correct type, length, size, etc. (sometimes this step can replace step one)</li>
110<li>Escape the data before submitting it into your database.</li>
111</ol>
112
113Code Igniter provides the following functions to assist in this process:</p>
114
115<ul>
116
117<li><h2>XSS Filtering</h2>
118
admine334c472006-10-21 19:44:22 +0000[diff] [blame]119<p>Code Igniter comes with a Cross Site Scripting filter. This filter looks for commonly
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]120used techniques to embed malicious Javascript into your data, or other types of code that attempt to hijack cookies
admine334c472006-10-21 19:44:22 +0000[diff] [blame]121or do other malicious things. The XSS Filter is described <a href="../libraries/input.html">here</a>.
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]122</p>
123</li>
124
125<li><h2>Validate the data</h2>
126
admine334c472006-10-21 19:44:22 +0000[diff] [blame]127<p>Code Igniter has a <a href="../libraries/validation.html">Validation Class</a> that assists you in validating, filtering, and prepping
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]128your data.</p>
129</li>
130
131<li><h2>Escape all data before database insertion</h2>
132
133<p>Never insert information into your database without escaping it. Please see the section that discusses
admin58083462006-09-24 17:58:27 +0000[diff] [blame]134<a href="../database/queries.html">queries</a> for more information.</p>
adminb0dd10f2006-08-25 17:25:49 +0000[diff] [blame]135
136</li>
137
138</ul>
139
140
141
142
143</div>
144<!-- END CONTENT -->
145
146
147<div id="footer">
148<p>
149Previous Topic:&nbsp;&nbsp;<a href="alternative_php.html">Alternative PHP</a>
150&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
151<a href="#top">Top of Page</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
152<a href="../index.html">User Guide Home</a>&nbsp;&nbsp;&nbsp;&middot;&nbsp;&nbsp;
153Next Topic:&nbsp;&nbsp;<a href="../libraries/benchmark.html">Benchmarking Class</a>
154<p>
155<p><a href="http://www.codeigniter.com">Code Igniter</a> &nbsp;&middot;&nbsp; Copyright &#169; 2006 &nbsp;&middot;&nbsp; <a href="http://www.pmachine.com">pMachine, Inc.</a></p>
156</div>
157
158</body>
159</html>