php - SOAP query variable, to escape or not to escape?
I'm building a bridge script in PHP to connect through SOAP to a local web services framework. This script is the only public access to the web services, and it takes values via GET, composes the query, sends it to the web services and returns the result via JSON. The variables the script takes should all be strings. (Any arrays get converted into strings).
My question is, since the only public access to the web services is through this script, is grabbing the parameters via $_GET['...'] and outputting them directly into the SOAP format for querying the safest method? Should I be performing some kind of escape on the GET values to compliment the SOAP native escaping?
(I'm outlining the process below for clarity. The ** is where the question applies.)
- HTTP GET to script
- script stores GET value into variable **
- compose variable into format for SOAP query
- send composed query to SOAP server
- receive response from SOAP server
- output response as JSON
Thanks!
Answer
Solution:
It's really hard to understand from your question what you would want to escape, but let's walk through it.
Typically, you want to Filter-In, Escape-Out. What that means, is when you accept input from anywhere outside your application, you want to filter it.
But what does filter mean?
It means ensure that it's valid. If you're expecting an alpha-numeric user-name, and someone passes in one with symbols, reject it. That's filtering...
Then, when you go to output data, you want to escape it specifically for the context you're outputting.
So if you're writing it in an HTML body, you'd use something like
html_special_chars. If you're sending to a database, you'd either use a prepared statement or escape it using a db-specific escaping algorithm.So where does that leave us in your situation?
Well, you're sending it to a library for a SOAP request. That library should handle escaping for the SOAP request.
And considering you don't know what the remote service is going to do with it (contextually), escaping it is the job of the remote application.
So no, you shouldn't be doing any escaping.
But be sure to filter the input to make sure it is valid in the domain you're expecting...