security

[slimjim]

I have a form that people will fill out to submit a url and such. Well I do not want a security hole in the form where people can type some kind of string and opens a can of worms on me.

Can anyone give me advice.

[pjleonhardt]

/me inputs

URL: $opencanofworms . $BITEINTOASLIMJIM

seriously though:

if you wanna check to make sure they arent putting any html code... try strip_tags() .. There are other loop wholes though... you might want to verify that it is either a valid form of a URL, or even try to fopen() it to make sure it exists.

[slimjim]

Well that is alot to consum, Can you give me something to work with as in a form. Not even sure how to implement strip tags and a form.

I want them to put in a url, but use [url]http://[/url] as the form will include that for them. But i would like to make sure that it is actually a url and no javascript in it.

How does one make a clean safe form for people to fill out so that it is safe. Got an example i can go by , maybe a sample to learn from at same time. Maybe more i use the sample, the more i will learn from it. Please 🙂

[pjleonhardt]

you'll prob want to be looking at something along those lines..

<?
$submit = $_POST['submit'];

if($submit == '') //form has not been submitted
{
//display form

print("
	<form method=\"post\" action=\"url.php\">
	Name of Url:<br>
	<input type=\"text\" name=\"urlname\"><br>
	URL To Add: (INCLUDE http://)<br>
	<input type=\"text\" name=\"url\" value=\"http://\"><br>
	<input type=\"submit\" name=\"submit\" value=\"submit\">
	</form>
	");


}
elseif($submit = 'submit') //if formed has been submitted
{
	$nameofurl = $_POST['urlname'];
	$url = $_POST['url'];
                $nameofurl = strip_tags($nameofurl);
                $url = strip_tags($url);
                //here you should make a check to make sure $url includes 'http://' in it.. so they dont do something like c:\whateverfile..

if(fopen($url, "r")) // if file url is accessablie, a.k.a exits:
{
	//add url to database
}
else
{
	//create error message
}
}


?>