Question

So James Patterson keeps trying to hack my website! Okay, not really, but he has written quite a few books that have titles starting with “Kill” which triggers a HTTP 501/HTTP 505 from our server side firewall.

Here’s the situation, our Library Software generates a weekly email report all of the new books added to the collection in the last week. I’ve made a form (using php/html) where we can C&P this data in and it will transform it into a nice little page showing off our new titles. Once the form is submitted I sanitize the data before it’s added to a MySQL database. The “Kill” trigger happens before the data from the form can be passed and processed. The data comes in the format:

Kill shot : an American assassin thriller / Vince Flynn|Flynn, Vince|2012|9781416595205 (hbk.)|NEWBKSHELF|20120207| 

I think the way to do this would be a little bit of javascript that changed every instance of kill to something innocuous and then change it back when I am inserting it into the MySQL db.

However there can be hundreds of entries like the one above, and I’m not very good with javascript, and I’m not sure the how to accomplish the first half of this (eg changing every instance of kill to kxll and Kill to Kxll.) I am fairly confident that when I save the data I can safely change kxll back.

Answer 1

You should hook into the onSubmit() of the form, then check every field, and then replace the value of the submitted field when it contains kill. Best this is done with JQuery, for example

$(function() {
    $("#formid").bind("submit", function(event) {
        $('input')
        .filter(function(){return $(this).val().indexOf("kill") !== false;})
        .each( function(index,element) {
            $(this).val($(this).val().replace(/kill/i, "kxll"));
        });
    });
});

Demo here: http://jsfiddle.net/49psu/4/

You might want to use $('input[value*="kill"]') and .replace(/kill/ig, "kxll") if you want to catch ‘kill’ anywhere in the inputs.

For more info:

http://api.jquery.com/each/

http://api.jquery.com/bind/

http://api.jquery.com/submit/

http://w3schools.com/jsref/jsref_replace.asp (javascript replace)