[SOLVED] Disable / and <>

[daveoffy]

I have a form and when someone types /, <, > I want it so when they hit submit those just go away and are replaced with a space or something.

[trq]

$str = str_replace(array('/','<','>'), '', $str);

[daveoffy]

How will I use that. Will I put it in the file with the form, or the file with the proccessing of the form.

[trq]

In the file processing the form. $str represents that value you want cleaned.

[daveoffy]

I want it to clean out the $sitename I have.

 

$sitename = $_POST['sitename'];

 

I will change $str to $sitename?

 

I have this so tell me where to add that code, or what to modify

 

<?php
session_start();
include 'config.php';
$errmsg_arr = array();
$errflag = false;
$sitename = $_POST['sitename'];
$username = $_COOKIE['username'];
if($sitename == ''){
	$errmsg_arr[] = 'Please enter a site name!';
	$errflag = true;
}
if($errflag) {
	$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
	session_write_close();
	header("location: ../editor.php");
	exit();
}
$sql = "SELECT * FROM users WHERE username = '$username'";
$sqlresult = mysql_query ($sql);
while ($row = mysql_fetch_array($sqlresult))
$id = $row['id'];
$qry = "INSERT INTO site (id, site) VALUES('$id', '$sitename')";
$result = @mysql_query($qry);
if($result) {
mkdir('../sites/'.$username.'/'.$sitename);
header("location: ../editor.php");
	$errmsg_arr[] = 'New site added!';
	$errflag = true;
}else {
echo mysql_error();
die("Query failed");
}
if($errflag) {
	$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
	session_write_close();
	header("location: ../editor.php");
	exit();
}
?>

[trq]

Replace....

 

$sitename = $_POST['sitename'];

 

with....

 

$sitename = str_replace(array('/','<','>'), '', $_POST['sitename']);
$sitename = mysql_real_escape_string($sitename);

 

Notice you also need to escape variables before putting them in any sql queries.

 

[daveoffy]

should I make all data that users pick that go into the database have escape string?

[trq]

should I make all data that users pick that go into the database have escape string?

 

Yes. All user inputted data that is to be used within queries should be escaped using mysql_real_escape_string.