Question

I have a form and as of right now, you can type any javascript, etc. you want. Any XSS, etc.

How do I go about creating a whitelist so you can only post characters.

At some point I would like anything that starts with http:// to be converted to

<a href="http://..."></a>

Thanks

Is this efficient?
http://htmlpurifier.org/

Answer 1

jQuery or Javascript is preferred

Well, no, you can’t do that, you see? Because even if you ‘sanitize’ your data using javascript, noone’s stopping anyone from

• turning off javascript
• using a browser’s developer console to mess with the data
• doing the POST directly, without a browser

In other words, you have to perform the validation/sanitization on the server side. Javascript validation is there to enhance the experience of your users (by providing instant feedback on invalid input, for example).