Andrew R Posted January 26, 2007 Share Posted January 26, 2007 Hi I’m a few problems in that people are inserting HTML into my database and then it being displaying on my site, for example on user profiles.How do I stop html being display so for example if a user inserts this, <strong>Andrew</strong> that it wouldn’t display in the format Andrew and rather output like this <strong>Andrew</strong>? I’m also thinking that if people can insert html they there’s nothing stopping them inserting php and getting private information of the database.Cheers. Link to comment https://forums.phpfreaks.com/topic/35811-stopping-html-being-displayed-from-a-database/ Share on other sites More sharing options...
Jessica Posted January 26, 2007 Share Posted January 26, 2007 They can't insert PHP, but they can insert HTML and Javascript, and this is called XSS (Google it.)Run any user input through strip_tags() and htmlentities() Link to comment https://forums.phpfreaks.com/topic/35811-stopping-html-being-displayed-from-a-database/#findComment-169756 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.