Home/ Questions/Q 6882111
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T05:12:46+00:00

My form saves user inputs (inputs+textarea) into a flat file database. I found lots

  • 0

My form saves user inputs (inputs+textarea) into a flat file database.
I found lots of examples Googleing on how to create a flat file database, but no one is properly covering some good basics on how to properly secure form from XSS and other malicious attacks.

I know the best way is to have (Ex:) an SQL database… but that’s not the case.

So far I know (this could be wrong! correct me if it is) :

  • Preferably use .php files to store data (inside <?php ...data... ?>) instead of .txt files
  • If possible drop an .htaccess with a deny from all inside the database folder
  • Validate via php your inputs and textarea before submission. (But how to do that exactly??? I mean… what’s the best way?)
  • validate properly your fields (php) (How exactly… some practices are only for sql databases, not for ffdb…)
  • I’m looking something like mysql_real_escape_string but good enough for ffdb

What are your thoughts?
I appreciate your help

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Dunno where did you get it, but by using

    • .php files to store data (inside ) instead of .txt files

    you can be definitely sure that it will ALLOW anyone whatever attack they wish,

    • drop an .htaccess with a deny from all inside the database folder

    makes absolutely no sense,

    So, it seems the only issue is

    • how to properly secure form from XSS

    and it is solved by using htmlspecialchars()

    here is an example of such a script I wrote long time ago in a galaxy far, far away…
    Feel free to ask if something looks unclear.

    <?php
if ($_SERVER['REQUEST_METHOD']=='POST') { 
  // iterating over POST data
  foreach($_POST as $key => $value) { 
    //first we are doing non-destructive modifications
    //in case we will need to show the data back in the form on error
    $value = trim($value); 
    if (get_magic_quotes_gpc()) $value = stripslashes($value); 
    $value = htmlspecialchars($value,ENT_QUOTES); 
    $_POST[$key] = $value; 
    //here go "destructive" modifications, specific to the storage format
    $value = str_replace("\r","",$value);
    $value = str_replace("\n","<br>",$value);
    $value = str_replace("|","&brvbar;",$value);
    $msg[$key] = $value;
  } 
  //various validations
  $err=''; 
  if (!$msg['name']) $err.="You forgot to introduce yourself<br>"; 
  if (!$msg['notes']) $err.="You forgot to leave a comment!<br>"; 
  //and so on
  //...
  // if no errors - writing to the file
  if (!$err) { 
    $s  = $msg['name']."|".$msg['email']."|".$msg['notes']."|".time()."\n"; 
    $fp = fopen("gbook.txt","a"); 
    fwrite($fp,$s); 
    fclose($fp); 
    //and then redirect
    Header("Location: ".$_SERVER['PHP_SELF']); 
    exit; 
  } 
  //otherwise - show the filled form
} else { 
  //if it was not a POST request
  //we have to fill variables used in form
  $_POST['name'] = $_POST['email'] = $_POST['notes'] =''; 
} 
?> 
<html> 
<head></head> 
<body> 
<? if ($err): ?><font color=red><b><?=$err?></b></font><? endif ?> 
<form method="POST">
Name: <input type="text" name="name" value="<?=$_POST['name']?>"><br> 
Email: <input type="text" name="email" value="<?=$_POST['email']?>"><br> 
Notes: <textarea rows="3" cols="30" name="notes"><?=$_POST['notes']?></textarea><br> 
<input type="submit" name="submit"> 
</form> 
</body> 
</html>

    it will produce a so-called pipe-delimited format like this

    name1|email1|comment
name2|email2|comment

    you can read it using file()+explode()

    • 0