htmlspecialchars and javascript injection

[fohanlon]

Hi Guys

 

I have only realised that it is possible to injection javascript <script> tags in form fields.

 

I read that htmlspecialchars will solve this by encoding < as %lt; etc.

 

However, I cannot get the function to work.  Does utf-8 encoding have an effect on the function?

 

Thanks for the help

 

Fergal.

 

[Adam]

No it won't, show us some code...

[fohanlon]

Hi

 

Just some simply code to test:

 

<?php

$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);

echo $new;

?>

 

and it outputs <a href='test'>Test</a>

 

I thought it would output <a href= ....

 

Thanks

 

Fergal.

 

[PFMaBiSmAd]

Do a "view source" in your browser of the output.

[Adam]

If you look at the source they'll be in their entity form, the browser converts them.

[fohanlon]

Looked at the csource and yes it is in entity form.

 

I was trying to ensure that if a user enters something like <script>alert("test")</script> in a form field that on submission of the form the alert box will not work.  The form will not write anything to a database, variables are jsut gathered and emailed in the mail function.

 

Am I right using htmlspecialchars.  I have spent hours reading forums etc and am confused.

 

Thanks,

 

Fergal.