Question

Hoping this isn’t a duplicate, I couldn’t find an original question on the topic. If you have an area for users to input data, how do you store and retrieve the data without them inserting javascript or html?

As an example, say a user is making a forum post. They decide to write an html list or javascript function that runs when the post is viewed. How do you mitigate this when you receive their input on the server-side? Specifically a server’side of PHP.

• Remove parts of their string data based on patterns?
• Use an html tag around their entry like ?

Thanks

Answer 1

I use HTML Purifier to strip out the bits I don’t want and leave in the bits I do. The default rules are pretty good, but it offers enormous flexibility if you need it.