Javascript and input forms

[-Karl-]

I have an input form, with an isset for PHP.

 

However, when a user inputs "<script>alert(document.cookie)%3B<%2Fscript>" into the box. It will do as the javascript asks. I was wondering what a good way would be to block this.

[Pikachu2000]

strip_tags()

 

 

[mikesta707]

Alternatively you can use htmlentities()

 

The difference is that strip tags simply removes all tags in a string, while html entities will turn the html into their respective entities (click the link for more info on what exactly entities are.)

 

so if someone put in

<script> // imma h4x0r j00 </script>

strip tags would make it look like

//imma h4xor j00

 

while html entities will make it look like

<script> // imma h4x0r j00 </script>

but that won't execute, it will just output to the page

[-Karl-]

Tried both even before posting this, and the Javascript was still executed.

[kenrbnsn]

If you don't show us your code, we can't tell you what's wrong.

 

Ken

[-Karl-]

It's marked as solved. 

[kenrbnsn]

Tried both even before posting this, and the Javascript was still executed.

You said that and never said how you solved it. Some people mark topics solved by mistake.

 

If it's solved, say how.

 

Ken

[Rustywolf]

htmlspecialchars()

it works for me

 

also, make sure you do it like this:

$msg = htmlspecialchars($msg);