Question

How would I keep javascript and php code from being entered into a form or saved to a database ? I’m still learning about client/server-side security and this seems to be an issue I need to resolve :p Could I do this on php side?

Answer 1

When you are inserting in a database with php, you can use the the strip_tags() function.

eg:

$query="INSERT INTO `DB` (`id`,`data`)
VALUES (".$id.",".mysql_real_escape_string(strip_tags($data)).");";
$mysql_query($query) or die(mysql_error().'<br/><pre>'.$query.'</pre>');//Debug only

The strip_tags function will strip all the html tags from the passed variable including the tag <script> so no JavaScript will be passed. http://php.net/manual/en/function.strip-tags.php

Edit:
Added the mysql_real_escape_string()