Databases
StackOverflow2013
Postsdbo
POprevent xss on input fields?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POprevent xss on input fields?
    text
    copied!<p>1-i have a form which has name family email birthday(which is a select) and gender which is two diffrent radio buttons one for male and another one obviously is for female. now please can someone explain me how to prevent xss attacks on this fields in php? my form data is like this</p> <pre><code>&lt;form action="register.php" method="post"&gt; &lt;div&gt; &lt;table&gt; &lt;tr&gt;&lt;td&gt;&lt;?php echo $lang['5']; ?&gt; :&lt;/td&gt;&lt;td&gt; &lt;input type="text" name="name" maxlength="254" class="required" /&gt;&lt;/td&gt;&lt;/tr&gt; &lt;tr&gt;&lt;td&gt;&lt;?php echo $lang['6']; ?&gt; :&lt;/td&gt;&lt;td&gt; &lt;input type="text" name="family" maxlength="254" class="required" /&gt;&lt;/td&gt;&lt;/tr&gt; &lt;tr&gt;&lt;td&gt;&lt;?php echo $lang['59']; ?&gt; :&lt;/td&gt;&lt;td&gt; &lt;input type="text" name="email" maxlength="254" class="required" /&gt;&lt;/td&gt;&lt;/tr&gt; &lt;tr&gt;&lt;td&gt;&lt;?php echo $lang['74']; ?&gt; :&lt;/td&gt;&lt;td&gt; &lt;input type="text" name="repeat" maxlength="254" class="required" /&gt;&lt;/td&gt;&lt;/tr&gt; &lt;tr&gt;&lt;td&gt;&lt;?php echo $lang['60']; ?&gt; :&lt;/td&gt;&lt;td&gt;&lt;input type="password" name="password"/&gt;&lt;/td&gt;&lt;/tr&gt; &lt;tr&gt; &lt;td&gt;&lt;?php echo $lang['8'] ?&gt; :&lt;/td&gt; &lt;td&gt; &lt;select name="day"&gt; &lt;option&gt;&lt;?php echo $lang['9'] ?&gt;&lt;/option&gt; &lt;?php for($i=1;$i&lt;=31;$i++){ echo "&lt;option value=\"{$i}\"&gt;{$i}&lt;/option&gt;\n"; } ?&gt; &lt;/select&gt; &lt;select name="month"&gt; &lt;?php for($i=0;$i&lt;=12;$i++){ $i = str_pad($i,2,"0",STR_PAD_LEFT); echo "&lt;option value=\"{$i}\"&gt;";T(1,$i);echo "&lt;/option&gt;\n"; } ?&gt; &lt;/select&gt; &lt;select name="year"&gt; &lt;option&gt;&lt;?php echo $lang['11'] ?&gt;&lt;/option&gt; &lt;?php for($i=1300;$i&lt;=1373;$i++){ if($i == $birthdate['0']){ echo "&lt;option value=\"{$i}\" selected=\"selected\"&gt;{$i}&lt;/option&gt;\n"; }else{ echo "&lt;option value=\"{$i}\"&gt;{$i}&lt;/option&gt;\n"; } } ?&gt; &lt;/select&gt; &lt;/td&gt; &lt;/tr&gt; &lt;/table&gt; male : &lt;input type="radio" name="gender[]" /&gt;female : &lt;input type="radio" name="gender[]" /&gt;&lt;br /&gt; &lt;input type="submit" name="submit" value="&lt;?php echo $lang['63']; ?&gt;" onclick="formhash(this.form, this.form.password);"/&gt; &lt;/div&gt; &lt;/form&gt; </code></pre> <p>for name and family i did somthing like this for get just html entity with this pattern </p> <pre><code>$name = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $name); $family = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $family); </code></pre> <p>and for email i did like this:</p> <pre><code> $email = preg_replace("^[_a-zA-Z0-9-]+(\.[_a-zA-Z0-9-]+)*@[a-zA-Z0-9-]+(\.[a-zA-Z0-9-]+)*(\.[a-zA-Z]{2,3})$^", "", $email); </code></pre> <p>is this preg_replace secure enough or maybe i need using htmlentity or htmlspecailchars?</p> <p>2-and for second question is it necessary to escape posted data which is from radio buttons or sellect options and if its necessary how should i escape them?</p> <p>3-i just read about htmlpurifier..now if i have status field which user can i update it should i use html purifier for people statuses and this register form maybe?</p> <p>thanks in advance.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload