Andrew R Posted January 26, 2007 Share Posted January 26, 2007 Hi I’m a few problems in that people are inserting HTML into my database and then it being displaying on my site, for example on user profiles.How do I stop html being display so for example if a user inserts this, <strong>Andrew</strong> that it wouldn’t display in the format Andrew and rather output like this <strong>Andrew</strong>? I’m also thinking that if people can insert html they there’s nothing stopping them inserting php and getting private information of the database.Cheers. Quote Link to comment Share on other sites More sharing options...
Jessica Posted January 26, 2007 Share Posted January 26, 2007 They can't insert PHP, but they can insert HTML and Javascript, and this is called XSS (Google it.)Run any user input through strip_tags() and htmlentities() Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.