Question

I want to add a textarea field to my website where users can paste a whole script into it and save it.

What I’m worried about is users trying to inject other code into the field.

This is how the script would look … ID and hex would change but nothing else:

<script type="text/javascript">
            var advertvars_vars = {
             pubid: '00000000000', // publisher id
             bgcolor: '804296', // background color (hex)
             text: 'FFFFFF', // font-color (hex)
             test: true 
            };
</script>
<script type="text/javascript" src="http://mysite.com/static/ad.js"></script>

My question is…Is there anyway of validating that the user is pasting valid code as above?

Answer 1

This is calling for trouble. No matter how thoroughly you validate, someone will come up with a way to inject something evil in the textbox. Never, ever, eval() or otherwise run something coming from user input directly. Just add a form where user can type the values for pubid, color, etc, validate them and then assemble the javascript chunk yourself.