I have a link adder on my site and people keep scripting it (puting html codes in to make alert boxes)
Is there any way i can stop them puting html into my textboxes?
Is there any way i can stop them puting html into my textboxes?
Stop Scripting
Very simple. If the > symbol is entered, let it be transformed to > and if the < is entered, let it be transformed to <
If you are using PHP, just add htmlspecialchars(). See: http://ca.php.net/manual/en/function.htmlspecialchars.php for more info.
If you're happy to use php you can simply use strip_tags ( http://uk.php.net/strip_tags )
example
example
| Code: |
| //assign input from textbox to variable
$textboxvalue = $_POST['textbox_name']; // remove html tags $textboxvalue = strip_tags($textboxvalue); |
The nice thing about htmlspecialchars is you can log the IP when they enter, then use a simple search to see if it contains any of those tags, and then IP ban.
There's no point in that.
Best thing is to use htmlspecialchars, so if someone wants to write "<I> <am> <cool>", it doesn't get deleted like in strip_tags, and you don't get ip banned, but it just shows up as typed.
Best thing is to use htmlspecialchars, so if someone wants to write "<I> <am> <cool>", it doesn't get deleted like in strip_tags, and you don't get ip banned, but it just shows up as typed.
Yeah, but if people constantly do it it is nice to have their IP logged. I've had it happen before where people completely ruined my site. I figured out I should do that later, and then that made my life so much easier. And a few people got banned.
I don't understand that but i have put a field limiter on each textbox
Problem solved
Problem solved
Not really, if you did it in html.
People can still use their own html pages to post to yours.
What language is it written in?
Last edited by Stubru Freak on Tue Apr 04, 2006 10:16 pm; edited 1 time in total
People can still use their own html pages to post to yours.
What language is it written in?
Last edited by Stubru Freak on Tue Apr 04, 2006 10:16 pm; edited 1 time in total
I suggest you either fix this solidly, or remove the whole thing completely. This is not a good fix. But then again, it's your site of course 
I recommend you to use htmlentities() and maybe (if you want) strip_tags; but with htmlentities you could keep your page valid html/xhtml
i put an ip recorder that records the ip and the name of there link so if they script they will be banned!
Related topics
 |