Filter strings before saving them in the database

Question

I just created a script witch fetches mails from IMAP and stores the title and content in the database.

Of course I don't want to save these information without a check; I'm a bit paranoid but I think it would be possible to do a MySQL-Injection-Attack, if I store the title and content of the mail without checking.

Now my question: How can I store these information? Are there any Joomla-On-Board-Methods to check the content?

Thanks in advance :-)

Answer 1

Additionally to quoting the data as Anibal already correctly explained, you can use JFilterInput->clean() to clean the various inputs. That's especially helpful if you expect the data to be of a certain format. So if you expect the title of the mail to be a simple string without any fancy stuff in it, you can use

$filter = JFilterInput::getInstance();
$title  = $filter->clean($title, 'STRING');

Taken from the docblock from the available filters:

INT:       An integer,
UINT:      An unsigned integer,
FLOAT:     A floating point number,
BOOLEAN:   A boolean value,
WORD:      A string containing A-Z or underscores only (not case sensitive),
ALNUM:     A string containing A-Z or 0-9 only (not case sensitive),
CMD:       A string containing A-Z, 0-9, underscores, periods or hyphens (not case sensitive),
BASE64:    A string containing A-Z, 0-9, forward slashes, plus or equals (not case sensitive),
STRING:    A fully decoded and sanitised string (default),
HTML:      A sanitised string,
ARRAY:     An array,
PATH:      A sanitised file path,
TRIM:      A string trimmed from normal, non-breaking and multibyte spaces
USERNAME:  Do not use (use an application specific filter),
RAW:       The raw string is returned with no filtering,
unknown:   An unknown filter will act like STRING. If the input is an array it will return an
           array of fully decoded and sanitised strings.

Answer 2

To avoid MySQL-Injection-Attacks, you can have to properly escape and quote special characters. For example:

$query = 'SELECT * FROM #__table WHERE ' . $db->quoteName( $field-name ) . '=' . $db->quote( $field-value );

Reference: Secure coding guidelines