Question

Should I disallow characters like “,’,>,<,\ … to be typed in an upload forms text field? The text will be send through PHP to a blog.

I heared that some characters might cause trouble and could be used to “hack / harm” servers. Which characters should be restricted?

Thanks for your input.
Michael

Answer 1

There is no need to restrict anything. The problem is that you have to sanitize all user input; for this specific type of data (possible HTML) it is necessary and enough to use htmlspecialchars on all user-provided data before displaying it as part of your page.

For example, if your form has a textarea named post-body, you should receive the user input (e.g. with $_REQUEST['post-body']) and save it to your database as-is (warning: use mysql_real_escape_string or PDO to protect yourself from SQL injection at this stage!). When the time comes to display it, you would retrieve it from the database and print it with something like

echo htmlspecialchars($postBody);

See this question for some more background on data sanitization.