Gayner Posted November 29, 2009 Share Posted November 29, 2009 I need to like let's say If a user submit's his Prayer and he put's <meta refresh stuff while posting his Prayer, I need to disable that and replace it with some other text... so it doesn't show.. so he can't be using javascript/html crap Quote Link to comment Share on other sites More sharing options...
Alex Posted November 29, 2009 Share Posted November 29, 2009 htmlentities Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 htmlentities Yea but what if people use comma's like i am right now i don't want that to be converted Quote Link to comment Share on other sites More sharing options...
Alex Posted November 29, 2009 Share Posted November 29, 2009 htmlentities() doesn't convert commas.. Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 htmlentities() doesn't convert commas.. Ok but i want to ban the user if he trys to post html character so this is how i would right? if $_POST['prayer'] = htmlentities($_POST['prayer']) mysql_query(BAN USER BLA BLA); that's how i would do it tho right ? Quote Link to comment Share on other sites More sharing options...
Alex Posted November 29, 2009 Share Posted November 29, 2009 Well, no that's not how you would do it. It doesn't matter though, it would extremely unfair to ban a user for posting something that would be converted to an htmlentity by htmlentities().. If someone posts &, <, >, ', ", (or anything else from this list) you would ban them? Doesn't seem very fair to me. Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 Well, no that's not how you would do it. It doesn't matter though, it would extremely unfair to ban a user for posting something that would be converted to an htmlentity by htmlentities().. If someone posts &, <, >, ', ", (or anything else from this list) you would ban them? Doesn't seem very fair to me. Well were I come from, it means there going to spam my site. with kitty porn or whatnot Quote Link to comment Share on other sites More sharing options...
Alex Posted November 29, 2009 Share Posted November 29, 2009 If someone tries to post "Hope you feel better & get well soon" you'd take that as an attack on your website? Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 If someone tries to post "Hope you feel better & get well soon" you'd take that as an attack on your website? It's a Prayer Request form, yes good idea, how do I get & To be unconverted? Can i add a Paremiter to the function htmlentities to not convert the & cause ur right so far i got '". mysql_real_escape_string(htmlentities($text, ENT_NOQUOTES)) ."', bcz i want people to use " and ' but i want people to use & too good idea Quote Link to comment Share on other sites More sharing options...
Alex Posted November 29, 2009 Share Posted November 29, 2009 The point of escaping data isn't really to find out who's trying to hack your website and ban them. It's to protect just in case, someone might typo a < or something, that's no reason to ban them. You could create a black-list of things to ban people based on (like <meta..) that would give a better indication that they were trying to post something malicious, but I don't even think that's necessary. As long as you're correctly escaping user input someone trying to post a meta refresh is no more harmful than someone spamming, which some moderation will solve. Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 The point of escaping data isn't really to find out who's trying to hack your website and ban them. It's to protect just in case, someone might typo a < or something, that's no reason to ban them. You could create a black-list of things to ban people based on (like <meta..) that would give a better indication that they were trying to post something malicious, but I don't even think that's necessary. As long as you're correctly escaping user input someone trying to post a meta refresh is no more harmful than someone spamming, which some moderation will solve. Yea ur right, I think I just want to replace malicious coding.. but i have no idea how, that's why i am here! I wonder fi there a free script on internet just has all those in a function i can just pop in my coding so i don't have to go thru each malicious coding I <meta and some javascript i don't want to be posted... but iuno how to check if people are posting those Quote Link to comment Share on other sites More sharing options...
KevinM1 Posted November 29, 2009 Share Posted November 29, 2009 That's what regular expressions are for. Test the input for whatever you're afraid of first with the proper expression. If the input contains a bad thing, deny/ban as necessary. Otherwise display it, being sure to pass the text through htmlentities just in case. Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 That's what regular expressions are for. Test the input for whatever you're afraid of first with the proper expression. If the input contains a bad thing, deny/ban as necessary. Otherwise display it, being sure to pass the text through htmlentities just in case. huh? Quote Link to comment Share on other sites More sharing options...
Gayner Posted November 29, 2009 Author Share Posted November 29, 2009 I am using function removeUnsafeAttributesAndGivenTags($input, $validTags = '') { $regex = '#\s*<(/?\w+)\s+(?:on\w+\s*=\s*(["\'\s])?.+? \(\1?.+?\1?\);?\1?|style=["\'].+?["\'])\s*>#is'; return preg_replace($regex, '<${1}>',strip_tags($input, $validTags)); } Works fine Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.