Question

here’s what I’ve got so far – i really need to ban any tags from being entered as it’s like a guestbook, but this doesn’t seem to work:

<?php

$txt = $_POST['txt'];

//the data

$data = "
$txt";

//my attempt to implement a filter

var_dump(filter_var($data,FILTER_SANITIZE_SPECIAL_CHARS));

//open the file and choose the mode

$fh = fopen("users.txt", "a");

fwrite($fh, $data);


//close the file

fclose($fh);

header('Location: http://www.google.com/');
?>

Answer 1

You need to assign the returned value of filter_var

$data = filter_var($data,FILTER_SANITIZE_SPECIAL_CHARS);

filter_var can return FALSE if the filter fails. So, to be complete, you really should do something like:

$filtered_data = filter_var($data,FILTER_SANITIZE_SPECIAL_CHARS);
if($filtered_data !== FALSE) {
  //write $filtered_data
} else {
  //handle error
}