Question

Possible Duplicate:
What are the best practices for avoiding xss attacks in a PHP site

I have a form that user can fill in their personal information. The user submits the form and A web service will process these information and store the information in mysql database.

But what if users enter html tag, php code, or javascript in the input field. I would like to prevent that. I know in javascript there’s a method call escapehtml, in php it’s strip_tags.

I just want to know the correct way of disabling the abilities to type html, php, script from input field. Do I use strip_tags for all input I received?If I use strip_tags, how to disable script? Or there is away to do it in mysql?

Thank you

This is the form:

<div>
    <label class='info-title whitetext' for="name">Full Name: </label>
    <input type="text" name="name" id="name" size='25' maxlength="100" required />
</div>

<div>
    <label class='info-title whitetext' for="phone">Phone: </label>
    <input type='text' pattern='\d+' name='phone' id='phone' size='25' maxlength='12' />
</div>

<div>       
    <label class='info-title' for="email">Email: </label>
    <input type="email" name="email" id="email" size='35' maxlength="60" required />
</div>

<div>       
    <label class='info-title' for="address">Address: </label>
    <input type="text" name="address" id="address" size='45' maxlength="50" required />
</div>

Answer 1

Try htmlspecialchars($string);

That will encode all the HTML tags to character codes (<div> would become <div>, which will be displayed without being parsed as html) This way, script tags cannot be created as well.

Be sure to clean the content before supplying it to a database though, for example by escaping with mysqli_escape_string() (others will probably advice you to use prepare statements).

It is most likely not best practice to put HTML character encoded strings into the database, as it simply increases the string size unnecessarily. (And it doesn’t provide protection against SQL injection on its own)