filter user input

[android6011]

Basically all I want are alphanumeric and basic symbols allowed. I dont want to allow tags of any sort etc. Right now I have strip_tags() and mysql_real_escape_string to keep safe from rogue user input. Any other suggestions? also, due to other problems i have magic quotes turned off in my config if that changes anything. thanks

[F1Fan]

If you want to verify it before they submit, you will need to write a javascript function. Otherwise, you could create a PHP function that strips out any characters that you don't want.

[android6011]

I just don't want anything html wise or anything that could be injection related, and id prefer to do it on the php end after submission

[F1Fan]

Maybe try this:

 

<?php
function CheckChars($input){
  $chars = array('a','b','c','d',1,2,3...); //list all acceptable characters
  $output = "";
  foreach (explode("",$input) as $char){
    if (in_array($char,$chars)) $output .= $char;
  }
  return $output;
}
?>