Home/ Questions/Q 9079585
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-16T19:52:12+00:00

Possible Duplicate: How to properly escape html form input default values in php? I

  • 0

Possible Duplicate:
How to properly escape html form input default values in php?

I am currently using:

if (isset($_GET['b']))
{
  $bb = $_GET['b'];
  echo 'found';
}
else
{
  $bb = 'white';
  echo 'notfound';
}

and

<body bgcolor="<?php echo $bb; ?>">

to allow the users to set the color of the page, what would be the safest method to avoid injection?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Assuming you are expecting a color, you could use a regex for hexadecimal colors:

    ^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$

    and the list of the 17 standard colors: aqua, black, blue, fuchsia, gray, grey, green, lime, maroon, navy, olive, purple, red, silver, teal, white, and yellow:

    $standards = array(
    'aqua',
    'black',
    'blue',
    'fuchsia',
    'gray',
    'grey',
    'green',
    'lime',
    'maroon',
    'navy',
    'olive',
    'purple',
    'red',
    'silver',
    'teal',
    'white',
    'yellow'
);

if (in_array($bb, $standards) or preg_match('/^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/', $bb)) {
    // valid
}
    • 0