Avoiding Javascript input in forms.

[llebron]

I have a security question.

How can I prevent an user from entering javascript a text area in a form?

thanks,

Luis

[[deleted]]

The simples method is to call htmlentities()
on the input code. This converts all HTML characters, such as the < and > to their HTML code equivalents, the &amp;lt; etc. making the javascript into a useless (and harmless) pile of garbage.

[Anon]

Isn't javascript client side? What kind of security would be breached?

Curts

[llebron]

Thanks. That did the trick.

vincent wrote:

The simples method is to call htmlentities()
on the input code. This converts all HTML characters, such as the < and > to their HTML code equivalents, the &amp;lt; etc. making the javascript into a useless (and harmless) pile of garbage.

[Anon]

e.g. if you have a guestbook and someone posts some very nasty js and a different person visits the guestbook and what happens if the very nasty js is treated as js ? It gets executed ...

hope that gives you the idea ...

cya Rob