Text area and security

slimjim

I have a form that allows a person to submit html code into a databse.
I also want to be able to display that html so that i can view it on a page.

Question is security, How can make it so that the html changes enough to protect my database, but also so that when i display it, it will display ok without worrying if it is dangerous when going to view it.

I am using textareas for people to add the html.
If someone has an example form or knows how to do this please let me know.

laserlight

Use [man]htmlspecialchars/man, [man]htmlentities/man, or [man]strip_tags/man on output.

Ensure that incoming variables are delimited by single quotes when used as values in a query.
Then escape single quotes within these variables.

Other than that, there are the various other input validation techniques such as checking that numeric values are indeed numeric.

slimjim

htmlspecialchars would work perfect for my form, but i have no clue even after reading that on how to use it.

So when i person adds the html to a textarea and then submits it to my database, it changes things like

<' (less than) becomes '<'

'>' (greater than) becomes '>'

And then when i go to view it on another page in a textarea it will show same thing, at which point i see if it is danerous before i actaully post it, and then i can actually put the html the way it should be.

laserlight

I prefer making the change on output.

It is quite safe to allow clientside code when storing.
Malicious scripting can only be run when you output to the browser (though there are some exceptions).

slimjim

Ok so my output goes into a text area.. Example :

<textarea name="jobs" cols="40" rows="5" class="mytext"><? print $jobs; ?></textarea>

What should i add to that text area to make it safe to view ?

laserlight

<textarea name="jobs" cols="40" rows="5" class="mytext"><?php echo htmlspecialchars($jobs); ?></textarea>

<textarea name="jobs" cols="40" rows="5" class="mytext"><?php echo htmlspecialchars(stripslashes($jobs)); ?></textarea>

slimjim

When i added that, it seems the html doesnt change when veiwing it, i tried both.

mrhappiness

you looked at the generated html-source?

slimjim

Below is the html that is in the database, and when i go to view it in the text area, i see exactly what i put in.

<form action="" method="post">
	    <div align="left"><p><input
	    style="FONT-WEIGHT: bold; FONT-SIZE: 12px; COLOR: #ffffff; FONT-FAMILY: Verdana; BACKGROUND-COLOR: #72a4d2"
	    maxLength="30" size="10"> <input type="submit" value="Submit"> </p>
	    </div><p><br>
	    </p>
	  </form>

slimjim

Now the generated output looks perfect just like i wanted.

Thanks alot 🙂