Sanitizing user form input in php

Question

Security threats in mind:

• SQL Injections!!! --- Solutions: Prepared Statements (PDO) and including $bpdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false); in the database connection

• XSS Attacks!!! --- Solutions: htmlspecialchars(), Content-Security Policy (placed in htaccess).

• OS Command Attacks!!! --- Solutions: Striping whitespace.

• DOS Attacks!!! --- Solution: None implemented. I'm unsure if any additional precaution is necessary, since there are no login possibilities on my website.

Is the following script sufficient enough to sanitize user input?

//sanitize user input
$Tmessage = trim(preg_replace('/\s\s+/', ' ', htmlspecialchars($_POST["message"])));
$sanitizedMessage = filter_var($Tmessage, FILTER_SANITIZE_STRING);
            
//prepare info and submit into table
$stmnt = $pdo->prepare("INSERT INTO submissionsTable (message) VALUES (:message)");
$stmnt->execute(['message' => $sanitizedMessage]);
header("Location: success.html");
exit (0);

Answer 1

I am concerned that you are not digesting the advice given in previous reviews, because you are ONLY to call htmlspecialchars() just before you print to an html document (print to screen).

Effectively, you only need to handle whitespace related characters. Since you seem to be concerned with handling multibyte characters, the unicode flag should be used on your regex patterns. See this relevant SO page: Multibyte trim in PHP?

$stmt->execute([
    'message' => filter_var(
        preg_replace(
            ['/^\s+|\s+$/u', '/\s{2,}/u'],
            ['', ' '],
            $_POST["message"]
        ),
        FILTER_SANITIZE_STRING
    )
]);

If you are using FILTER_SANITIZE_STRING to strip tags, please see some potentially buggy behavior in the comments at https://www.php.net/manual/en/filter.filters.sanitize.php

P.s. I'd probably not use a named parameter in the prepared statement; there is only one bound parameter so there is no chance of confusion.