我想添加一个自定义中间件来检查POST请求中的任何脚本，该怎么做？

Question

I want to check whether the POST request coming from various user input forms in my application contains any MALICIOUS CODE script or HTML tags if any found I want to redirect back to the form page and display a message that these script characters are not allowed. I can check for this functionality in the controller but I want to do this with middleware, how to do that, can anyone help me??

Please note, I am just a beginner, not that expert, so please forgive me for any errors in question or logic.

The expected result is that, I want to check on form submit that any input field contains any script tags or not? and I want to achieve this via MIDDLEWARE so that I can just include this middleware on requests i want to check.

Answer 1

You can use something like the following to check input coming from POST or GET.

public function handle($request, Closure $next)
{
    $this->checkRequest($request);

    $response = $next($request);

    return $response;
}

private function checkRequest($request)
{
    print_r($request->all());

    // you can check for request method here as well
    // $request->isMethod('POST') etc
    // ofcourse i am not checking for malicious code you can do that much better or loop through request parameters thats upto you 

    if ($request->has('some') && $this->isMalicious($request->get('some'))) {
        return redirect()->route('go/home')->with(['message' => 'found some in request']);
    }
}

private function isMalicious($input)
{
     if ($input == 'something') return true;

     return false;
}

How to make a middleware and how to assign it to certain routes or groups or globally can be found here https://laravel.com/docs/5.8/middleware#global-middleware