Best practices for sanitizing string data with AMPScript

Question

I have a CloudPage with a form consisting of a text field. When the user submits on the form, the text field data is captured within a parameter and posted for processing on another Cloudpage. The purpose of the second page is to upsert the entry into a Data Extension.

All of the above works fine, however, my question relates to the step that is missing just before the data is inserted into a data extension. Does AMPScript have any specific functions for sanitizing string data before it is inserted into a Data Extension.

For example PHP has several functions for string sanitization such as,

filter_var($var, FILTER_SANITIZE_STRING)
stripslashes($var)
htmlspecialchars($var)
strip_tags($var)

Appreciate that frontend validation can also be used, but my query is specifically about in-built AMPScript functions as opposed to having to do the same thing with regex.

Answer 1

I'd focus on answering the question -- what constitutes invalid string data in your case? HTML tags? JavaScript? CR/LF?

Could be as simple as:

%%[

/* escape HTML tags */
set @inputStr= replace(replace(@inputStr,">","&gt;"),"<","&lt;")

/* bleep bad words */
set @inputStr = replaceList(@inputStr, "****", "apple", "macbook", "ipad", "ipod", "iphone")

/* replace line termination, form feed, tab, etc., control chars, */
set @inputStr = replaceList(@inputStr, "" , char(9), char(10), char(11), char(12), char(13))

]%%

You can also replace with matches returned from the RegexMatch() function.

If you don't like the AMPscript options, you can also try your hand at sanitizing in Server-Side JavaScript in your CloudPage. For example:

<script runat="server" language="JavaScript">
  
  Platform.Load("core", "1");
  
  var inputStr = bleepBadWords(inputStr);

  function bleepBadWords(s) {
    var BADWORDS = /\b(apple|macbook|ipad|ipod|iphone)\b/gi;
    return s.replace(BADWORDS, "****");
  }

</script>

Reference

• Replace()
• ReplaceList()
• RegexMatch()

Answer 2

According to this answer, data is sanitized before it is inserted into a data extension (stored in DB). Please also consider adding headers to your cloud pages as described here.

<script runat=server>
   Platform.Response.SetResponseHeader("Strict-Transport-Security","max-age=200");
   Platform.Response.SetResponseHeader("X-XSS-Protection","1; mode=block");
   Platform.Response.SetResponseHeader("X-Frame-Options","Deny");
   Platform.Response.SetResponseHeader("X-Content-Type-Options","nosniff");
   Platform.Response.SetResponseHeader("Referrer-Policy","strict-origin-when-cross-origin");
   Platform.Response.SetResponseHeader("Content-Security-Policy","default-src 'self'");
</script>