Disallowing harmful code

Anon

Hello
I want to restrict entries into a forms text field to only allow text and nothing nasty like php functions, drop_database and the such like or URL's . I want to work it like this:

1.user puts in entry.
- code allowed / dissallowed
2. allowed code enters database.

If anyone can help It would be greatly appreciated.

Many thanks in advance.

John Walker

Anon

It looks as though you do want to allow some types of code and disallow others...
I think you will have to have a clear idea of what you do not want and simple do a find and replace or regex on the code based on that.

for example:

Submited Code: = <script>alert("something bad")</script>

you would use this :
$search = array ("<script>",
"</script>")
$replace = array ("")
for ($i = 0; $i<2; $i++)
{
$savecode = str_replace($search[$i], $replace[$i], $outcode);
}
echo $savecode;

HTH's

Anon

Hello Stuart
Thanks for the prompt response, I'll give that a whirl I'm new to PHP tho I grasp that its looking for the <script> tag and replacing any <script> tags with <!---<script> captioning it out, I'll have a go at working with this, is the code flexible to add anything to the search array? <?php ?> tage etc.

Cheers John

Anon

yes, you mat need to escape cetain characters for example " or \ you would use \" or \.

There is an easire way to use arrays to do search and replace, but this way should work with more versions of php.

you will have to update the number in the while loop to match the elements in your array.

you could do this:

for ($i = 0; $i < count($search); $i++)
or
$acount = count($search);
for ($i = 0; $i < $acount $i++)

Anon

Hello Scott
This is what I've come up with from my limited knowledge of PHP , which at the moment comes up with PARSE errors , can you point me in the right direction on how to call the script from the form:

<?php if ($test) {

$search = array ("<script>","</script>")

$replace = array ("")

for ($i = 0; $i<2; $i++)

{ $savecode = str_replace($search[$i], $replace[$i], $outcode);
}
echo $savecode; ?>
<?php } ?>

<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body bgcolor="#FFFFFF">
<form name="test" action="<? $PHP_SELF ?>?test=1" method="post" >
<textarea name="test" rows="8"></textarea>
<input type="submit" name="Submit" value="Submit">
</form>
</body>

Any additional help you can give would be great!

John

Anon

Suggestion: Why not do a simple replace by NULL of all "<" and ">" characters? That way no html or javascript code would be interpreted?

Anon

Hello
I've been trying to do that but I get many and varied syntax errors, till I work ou how to insert it correctly....but if you know where and how it should be inserted, don't keep it to yourself ;-}

John