library/formdata.inc.php

   1 <?php
   2 /**
   3  * Functions to globally validate and prepare data for sql database insertion.
   4  *
   5  * Copyright (C) 2009 Rod Roark <rod@sunsetsystems.com>
   6  *
   7  * LICENSE: This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14  * GNU General Public License for more details.
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
  17  *
  18  * @package OpenEMR
  19  * @author  Rod Roark <rod@sunsetsystems.com>
  20  * @author  Brady Miller <brady@sparmy.com>
  21  * @link    http://www.open-emr.org
  22  */
  23
  24 /**
  25  * Escape a parameter to prepare for a sql query.
  26  *
  27  * @param   string $s  Parameter to be escaped.
  28  * @return  string     Escaped parameter.
  29  */
  30 function add_escape_custom($s) {
  31       //prepare for safe mysql insertion
  32       $s = mysql_real_escape_string($s);
  33       return $s;
  34 }
  35
  36 /**
  37  * Escape a sql limit variable to prepare for a sql query.
  38  *
  39  * This will escape integers within the LIMIT ?, ? part of a sql query.
  40  * Note that there is a maximum value to these numbers, which is why
  41  * should only use for the LIMIT ? , ? part of the sql query and why
  42  * this is centralized to a function (in case need to upgrade this
  43  * function to support larger numbers in the future).
  44  *
  45  * @param   string $s  Limit variable to be escaped.
  46  * @return  string     Escaped limit variable.
  47  */
  48 function escape_limit($s) {
  49       //prepare for safe mysql insertion
  50       $s = (int)$s;
  51       return $s;
  52 }
  53
  54 /**
  55  * Escape/sanitize a sql sort order keyword variable to prepare for a sql query.
  56  *
  57  * This will escape/sanitize the sort order keyword. It is done by whitelisting
  58  * only certain keywords(asc,desc). If the keyword is illegal, then will default
  59  * to asc.
  60  *
  61  * @param   string $s  Sort order keyword variable to be escaped/sanitized.
  62  * @return  string     Escaped sort order keyword variable.
  63  */
  64 function escape_sort_order($s) {
  65       return escape_identifier(strtolower($s),array("asc","desc"));
  66 }
  67
  68 /**
  69  * Escape/sanitize a table sql column name for a sql query..
  70  *
  71  * This will escape/sanitize the sql column name for a sql query. It is done by whitelisting
  72  * all of the current sql column names in the openemr database from a table(s). Note that if
  73  * there is no match, then it will die() and a error message will be sent to the screen and
  74  * the error log. This function should not be used for escaping tables outside the openemr
  75  * database (should use escape_identifier() function below for that scenario)
  76  *
  77  * @param   string        $s       sql column name variable to be escaped/sanitized.
  78  * @param   array         $tables  The table(s) that the sql columns is from (in an array).
  79  * @param   boolean       $long    Use long form (ie. table.colname) vs short form (ie. colname).
  80  * @return  string                 Escaped table name variable.
  81  */
  82 function escape_sql_column_name($s,$tables,$long=FALSE) {
  83
  84       // If the $tables is empty, then process them all
  85       if (empty($tables)) {
  86             $res = sqlStatementNoLog("SHOW TABLES");
  87             $tables = array();
  88             while ($row=sqlFetchArray($res)) {
  89                 $keys_return = array_keys($row);
  90                 $tables[]=$row[$keys_return[0]];
  91             }
  92       }
  93
  94       // First need to escape the $tables
  95       $tables_escaped = array();
  96       foreach ($tables as $table) {
  97             $tables_escaped[] = escape_table_name($table);
  98       }
  99
 100       // Collect all the possible sql columns from the tables
 101       $columns_options = array();
 102       foreach ($tables_escaped as $table_escaped) {
 103             $res = sqlStatementNoLog("SHOW COLUMNS FROM ".$table_escaped);
 104             while ($row=sqlFetchArray($res)) {
 105                   if ($long) {
 106                         $columns_options[]=$table_escaped.".".$row['Field'];
 107                   }
 108                   else {
 109                         $columns_options[]=$row['Field'];
 110                   }
 111             }
 112       }
 113
 114       // Now can escape(via whitelisting) the sql column name
 115       return escape_identifier($s,$columns_options,TRUE);
 116 }
 117
 118 /**
 119  * Escape/sanitize a table name for a sql query..
 120  *
 121  * This will escape/sanitize the table name for a sql query. It is done by whitelisting
 122  * all of the current tables in the openemr database. Note that if there is no match, then
 123  * it will die() and a error message will be sent to the screen and the error log. This
 124  * function should not be used for escaping tables outside the openemr database (should
 125  * use escape_identifier() function below for that scenario)
 126  *
 127  * @param   string $s  sql table name variable to be escaped/sanitized.
 128  * @return  string     Escaped table name variable.
 129  */
 130 function escape_table_name($s) {
 131       $res = sqlStatementNoLog("SHOW TABLES");
 132       $tables_array = array();
 133       while ($row=sqlFetchArray($res)) {
 134             $keys_return = array_keys($row);
 135             $tables_array[]=$row[$keys_return[0]];
 136       }
 137
 138       // Now can escape(via whitelisting) the sql table name
 139       return escape_identifier($s,$tables_array,TRUE);
 140 }
 141
 142 /**
 143  * Escape/sanitize a sql identifier variable to prepare for a sql query.
 144  *
 145  * This will escape/sanitize a sql identifier. There are two options provided by this
 146  * function.
 147  * The first option is done by whitelisting ($whitelist_items is used) and in this case
 148  * only certain identifiers (listed in the $whitelist_items array) can be used; if
 149  * there is no match, then it will either default to the first item in the $whitelist_items
 150  * (if $die_if_no_match is FALSE) or it will die() and send an error message to the screen
 151  * and log (if $die_if_no_match is TRUE).
 152  * The second option is done by sanitizing ($whitelist_items is not used) and in this case
 153  * only US alphanumeric,'_' and '.' items are kept in the returned string. Note
 154  * the second option is still experimental as we figure out the ideal items to
 155  * filter out of the identifier. The first option is ideal if all the possible identifiers
 156  * are known, however we realize this may not always be the case.
 157  *
 158  * @param   string   $s                Sql identifier variable to be escaped/sanitized.
 159  * @param   array    $whitelist_items  Items used in whitelisting method (See function description for details of whitelisting method).
 160  * @param   boolean  $die_if_no_match  If there is no match in the whitelist, then die and echo an error to screen and log.
 161  * @return  string                     Escaped/sanitized sql identifier variable.
 162  */
 163 function escape_identifier($s,$whitelist_items,$die_if_no_match=FALSE) {
 164       if (is_array($whitelist_items)) {
 165             // Only return an item within the whitelist_items
 166             if ( $die_if_no_match && !(in_array($s,$whitelist_items)) ) {
 167                   // There is no match in the whitelist and the $die_if_no_match flag is set
 168                   // so die() and send error messages to screen and log
 169                   error_Log("ERROR: OpenEMR SQL Escaping ERROR of the following string: ".$s,0);
 170                   die("<br><span style='color:red;font-weight:bold;'>".xlt("There was an OpenEMR SQL Escaping ERROR of the following string")." ".text($s)."</span><br>");
 171             }
 172             $ok = $whitelist_items;
 173             $key = array_search($s,$ok);
 174             return $ok[$key];
 175       }
 176       else {
 177             // Return an item that has been "cleaned" up
 178             // (this is currently experimental and goal is to avoid using this)
 179             return preg_replace('/[^a-zA-Z0-9_.]/','',$s);
 180       }
 181 }
 182
 183 /**
 184  * (Note this function is deprecated for new scripts and is only utilized to support legacy scripts)
 185  * Function to manage POST, GET, and REQUEST variables.
 186  *
 187  * @param string $name name of the variable requested.
 188  * @param string $type 'P', 'G' for post or get data, otherwise uses request.
 189  * @param bool $istrim whether to use trim() on the data.
 190  * @return string variable requested, or empty string
 191  */
 192 function formData($name, $type='P', $isTrim=false) {
 193   if ($type == 'P')
 194     $s = isset($_POST[$name]) ? $_POST[$name] : '';
 195   else if ($type == 'G')
 196     $s = isset($_GET[$name]) ? $_GET[$name] : '';
 197   else
 198     $s = isset($_REQUEST[$name]) ? $_REQUEST[$name] : '';
 199
 200   return formDataCore($s,$isTrim);
 201 }
 202
 203 /**
 204  * (Note this function is deprecated for new scripts and is only utilized to support legacy scripts)
 205  * Core function that will be called by formData.
 206  * Note it can also be called directly if preparing
 207  * normal variables (not GET,POST, or REQUEST)
 208  *
 209  * @param string $s
 210  * @param bool $istrim whether to use trim() on the data.
 211  * @return string
 212  */
 213 function formDataCore($s, $isTrim=false) {
 214       //trim if selected
 215       if ($isTrim) {$s = trim($s);}
 216       //strip escapes
 217       $s = strip_escape_custom($s);
 218       //add escapes for safe database insertion
 219       $s = add_escape_custom($s);
 220       return $s;
 221 }
 222
 223 /**
 224  * (Note this function is deprecated for new scripts and is only utilized to support legacy scripts)
 225  * Will remove escapes if needed (ie magic quotes turned on) from string
 226  * Called by above formDataCore() function to prepare for database insertion.
 227  * Can also be called directly if simply need to remove escaped characters
 228  * from a string before processing.
 229  *
 230  * @param string $s
 231  * @return string
 232  */
 233 function strip_escape_custom($s) {
 234       //strip slashes if magic quotes turned on
 235       if (get_magic_quotes_gpc()) {$s = stripslashes($s);}
 236       return $s;
 237 }
 238
 239 /**
 240  * (Note this function is deprecated for new scripts and is only utilized to support legacy scripts)
 241  * This function is only being kept to support
 242  * previous functionality. If you want to trim
 243  * variables, this should be done using above
 244  * functions.
 245  *
 246  * @param string $s
 247  * @return string
 248  */
 249 function formTrim($s) {
 250   return formDataCore($s,true);
 251 }
 252 ?>