Today I release a new php caging class for improved security – Peregrine.
I’ve always been impressed by the idea of a “variable cage” in programming. It’s an additional method of protecting your incoming variables and making sure that you only accept what you’re expecting.
If you’re not familiar with a cage, think of it as a class that copies any (usually incoming) data into an object while destroying the original “unclean” data. At this point you must access this data through the “cage”, which provides a whole bunch of ways to filter out what you don’t want.
So an incoming variable (through a GET/POST request for example) may only need to be a integer. You may use a method that returns or checks for integers, and either removes non-integer characters or returns false.
This provides an excellent wall against any malicious attackers, and really helps you define data validation more accurately within your projects.
There are some others out there, and some are very good. However, none worked as well or were as cleanly coded as I would have liked, so I’ve been working on Peregrine.
It’s hosted at github so you’re welcome to fork it and contribute back any fixes or feature requests you would like.
To learn how to use it, please read the documentation provided with the code and look through the class itself.
http://github.com/botskonet/Peregrine