well this line at least looks wrong...at the very least it's incorrect syntax:
$text = strip_tags(addslashes($text, '<p>', '<br>', '<b>');
as far as i know, addslashes only takes one arg. this might work better:
$text = strip_tags(addslashes($text), '<p>', '<br>', '<b>');
Generally speaking, there are a few things you need to worry about when putting user input into a database
1) is magic_quotes on?
magic_quotes is a php feature that (i think) is meant to protect clueless noobs from writing code that is vulnerable to sql injection. it takes single and double quotes and escapes them with a backslash. if magic quotes are on, I remove them like this:
// this fn recursively strips backslashes from an array
function jta_strip_backslashes_recursive($arg) {
if (is_array($arg)) {
$result = Array();
foreach($arg as $key => $value) {
$result[$key] = jta_strip_backslashes_recursive($value);
}
return $result;
} else {
return stripslashes($arg);
}
}
if (get_magic_quotes_gpc()==1) {
// might wanna do $_POST first? I don't recall which var is not defined
// in later versions of php... think later versions no longer define $HTTP_POST_VARS
$HTTP_POST_VARS = jta_strip_backslashes_recursive($HTTP_POST_VARS);
$_POST = $HTTP_POST_VARS;
$HTTP_GET_VARS = jta_strip_backslashes_recursive($HTTP_GET_VARS);
$_GET = $HTTP_GET_VARS;
$_REQUEST = jta_strip_backslashes_recursive($_REQUEST);
}
2) use of register globals
Most people think that if you POST or GET a form input named 'my_var' to a php page that the variable $my_var will automatically be defined within that php page. This is not always the case. $my_var will contain the value in that form input if you have 'register globals' on in your PHP ini. If I were you, I would avoid assuming those vars will be defined and instead refer to the long but more secure $POST['my_var'] and/or $GET['my_var'].
Having register globals on means that your code can be vulnerable to malicious users who take advantage of vars that you don't explicitly initialize. more here:
http://us2.php.net/register_globals
3) escaping data before doing an INSERT query
why do we addslashes? so when we take user input and stick it in a query, the query is still valid if the user input has quotes in it. eg.
INVALID SQL - see how the single quote breaks your sql:
INSERT INTO TABLE_X SET client_name='Jerry O'Malley';
VALID SQL - escaping that single quote makes everything cool:
INSERT INTO TABLE_X SET client_name='Jerry O\'Malley';
Anyways, addslashes might work on ' and " but maybe not on ` or some foreign language quote mark that your database engine nevertheless recognizes. that's why I use mysql_escape_string():
http://us2.php.net/mysql_escape_string
or maybe
mysql_real_escape_string():
http://us2.php.net/manual/en/function.mysql-real-escape-string.php
If you're not using mysql, there's probably an equivalent function for your database technology.
4) SCREEN THE USER INPUT
You can bet that evil hackers will take advantage of your site if you don't screen user input properly. Generally speaking i will do the following
a) for all numeric values, make sure data is actually a number using is_numeric() or some similar function
b) for all text values, remove the magic quotes and then use a proper database escape function like mysql_escape_string()
Hope that's helpful.
As for removing the tags, hmm.....apparently strip_tags doesn't work so well. You might try some pattern matching stuff like preg_replace. google around and you can probably find some.
