title: PHP input GET vars sanitizing
body: <p>For my application, written in PHP 5+, I have a <code>common.php</code> which is included from all other pages. Within that I have an <code>include sanitize.php</code> which aims to sanitise any input vars used in the URL. So, targetting <code>$_GET[]</code> values.</p>
  
  <p>This is just to have one place where I can tidy any vars, if used, and use them in the code later.</p>
  
  <p>There seems to be no tidy way, I've seen, to sanitise based on expected/desired inputs. The method I initially looked at was this <code>sanitize.php</code> having a foreach to loop through any vars, lookup the type of sanitization required, and then add the cleaned vars to a separate array for use within my code.</p>
  
  <p>Instead of using PHP sanitization filters, to keep it standard, I thought I'd use regex. Types I want are <strong>alphaonly</strong>, <strong>alphanumeric</strong>, <strong>email</strong>, <strong>password</strong>. Although "password" would allow some special chars, I want to remove or even escape potentially "hazardous" ones like <code>'</code> <code>"</code> to then be included into a mysql DB. We have a european userbase so different locales are possible, but I'm hoping that won't be too much of an issue.</p>
  
  <p>Would this be a "good" solution to start from, or am I trying to reinvent the wheel?</p>
  
  <p><strong>Random Page</strong></p>
  
  <pre><code>/mypage.php?c=userid&amp;p=lkasjdlakjsdlakj&amp;z=....
  (use SANITIZED_SAFE_INPUT_VARS variable only)
  </code></pre>
  
  <p><strong>sanitize.php</strong></p>
  
  <pre><code>var aryAllowedGetParamNames = array(
      "c" =&gt; "alphaonly",         //login
      "p" =&gt; "alphaemail",        //password
      "e" =&gt; "email"              //email
      //...
  );
  
  var sanitizeTypes = array (
      "alphaonly" =&gt; "[a-zA-Z]",
      "alphanumeric" =&gt; "[a-zA-Z0-9]",
      "email" =&gt; "[a-zA-Z0-9]...etc"
  );
  
  var SANITIZED_SAFE_INPUT_VARS = array();
  
  foreach ($_GET as $key =&gt; $value) { 
      //apply regex and add value to SANITIZED_SAFE_INPUT_VARS 
  }
  </code></pre>
  
  <p><strong>EDIT</strong></p>
  
  <p>There seems to be some opinion about the use of passwords in the URL. I'll explain in a little more detail. Instead of using a POST login prompt with username and password, I am using an ajax async call to <code>_db_tryLogin.php</code> with parameters for userid and password. The username is ALWAYS a 6-ALPHA-only text string, and the password is an md5 of what was typed. I'm aware of the opinions on MD5 not being "safe enough". </p>
  
  <p>The JS currently MD5s the password and sends that to the <code>_db_tryLogin.php</code>.</p>
  
  <pre><code>-&gt; async : _db_login.php?c=ABCDEF&amp;p=SLKDauwfLKASFUWPOjkjafkKoAWOIFHF2733287
  </code></pre>
  
  <p>This will return an async response of "1" or "0". Both will cause the page to refresh, but if the <code>_db_tryLogin.php</code> page detects the password and userid matches one DB record, then session variables are set and the site knows the user is logged in.</p>
  
  <p>I used MD5 for the async request just to quickly hash the password so it's not transmitted in plaintext.</p>
  
  <p>The <code>_db_tryLogin.php</code> takes the password, which is <code>md5(plainpass)</code> adds a SALT and MD5s again, and then this is what is compared against the usertable in the DB.</p>
  
  <p><strong>DB password stored = md5(SALT.md5(plainpass))</strong></p>