PHP Forms

[Daney11]

Hey guys.

 

Im using forms to enter information into my website and im doing all the security measures needed. However when i enter

 

<script type="text/javascript">window.location = "http://www.google.com/"</script>

 

To say

<input class="forminput" name="news_title" type="text" value="<?php if (isset($_POST['news_title'])) echo $_POST['news_title']; ?>" />

 

I get a broken field when the error comes up

Error im using is

 

if (eregi ('^[[:alpha:][:digit:][:blank:]-]{2,60}$', stripslashes(trim($_POST['news_title'])))) {
   $news_title = escape_data($_POST['news_title']);
} else {
   $news_title = FALSE;
   $errors[] = 'Please Enter A News Title';
       }

 

The break of the form field looks like

 

FORM[ <script type=\ ]window.location = \"http://www.google.com/\"" />

 

The [   ] represents the form area. So its breaking it up.

 

Any ideas on how to solve this?

 

Image

 

 

 

 

 

[marcus]

What's the problem, html isn't working?

[Daney11]

No, the enter of the javascript into a form breaks the form up as you can see in the image. It wont go into my database thankfully but when a user enters javascript into my forms i just want the form to be hole and no break.

[marcus]

Make it a textarea, or use htmlentities to prevent them from closing the input box

[Daney11]

Is there not another way to prevent them closing the input box?

[marcus]

or use htmlentities to prevent them from closing the input box

 

and why would you want people to enter javascript as a news title, isn't news for reading; not redirecting?

[Daney11]

People would enter anything in input boxes to try and use SQL injection against your website. Im trying to iron out ALL bugs so that they cannot SQL inject my website.

[marcus]

should have said that

 

mysql_real_escape_string();
strip_tags();
htmlentities();

[Daney11]

my form is now

 

<input class="forminput" name="news_title" type="text" value="<?php if (isset($_POST['news_title'])) echo htmlentities($_POST['news_title']); ?>" />

 

and it works fine. thanks

[marcus]

no problem