我应该XSS过滤所有输入数据吗？

Question

I have a script that returns POST data if it exists, like this:

public function post($key){
    if(isset($_POST[$key])){
            return $_POST[$key];
        }else{
            return false;
    }
}

// Will return false if index doesn't exist
echo $this->class->post("key");

I was wondering if it is recommended to filter everything in that function (using a XSS library such as htmlpurifier) if the index exists? I have a function which does the exact same for get requests too.

Thanks,

Peter

Answer 1

It should work for making your application very secure, as no user input (besides the user editable $_FILE, $_SERVER) would be susceptible to XSS unless there was a glitch in your library. However, it may adversely affect your servers performance if many people are attempting to access your application. I would write a better function like this:

public function post($key, $validate = true){
    if(isset($_POST[$key])){
            if($validate===true) {
            return validate($_POST[$key]);
            } else {
            return $_POST[$key]
        }else{
            return false;
    }
}

That way you can choose which post variables you want to validate. It reduces the overall security of your application, but if you use it correctly, you can minimize the impact.