Question

I want to prevent user from entering ‘>’ and ‘<‘ character. How should i do this? I tried to implement this by ( via javascript) detecting their keycodes but since ‘>’ and ‘.’ have the same keycode, it also prevented ‘.’ from being entered. The same happens for the ‘,’ and ‘<‘ characters. How should i do this?

Below is what i have tried.

    $('#Notes').bind('keydown', function() {
        if (window.event) {

            if ((window.event.keyCode == 190) || (window.event.keyCode == 188)) {
                return false;
            }
            else {
                return true;
            }


        }
    });

Answer 1

Check the input on the server side. This is a necessity. Data from the client side cannot be trusted at all. Imagine what will happen if someone disables your script in their browser. I recommend you to simply replace < with < and > with >, or remove them alltogether. (Alternatively, you could also strip the input from any HTML tags.) This is a safe and simple solution.

Even better than that, you could allow some HTML tags to be posted (basic text formatting, for example), and use an HTML sanitizer to remove disallowed content from it.
I have had much success with NSoup for this purpose.
About the latter, check out this question.