Security with user-input.

[blr32]

This is a question to all you hackers and semi hackers out there.

How much harm can it do to allow people to eg. enter the code to make a text-field or a button - is it a major security risk? - What can a hacker achieve through such an input field? and if it is a risk - what's the best way to prevent it... sorry for my lack of knowlegde in the black fields of web-usage.

[jariizumi]

The biggest threat with letting people enter HTML into your page is that they can embed JavaScript most likely. Even allowing <INPUT>'s, they can use an onBlur="newWindow=window.open('http://mysite.com/track-who-saw-clicked-the-box.php')" which could not only redirect a user to somewhere the web host has no control over, but could also log exactly who sees the page, how often, etc. Even without INPUT's, <SCRIPT>, <IFRAME>, and <LINK> could produce the biggest problems, since they load every time and people don't even see them. So make sure you filter those out if you don't want these things happening.

[Anon]

Depends on where you send it and how you treat it. Suppose it for a forum, you want to take te htmlcode out because that can seriously damage the layout 🙂

i suggest something along the lines of:
$tekst=eregi_replace( "<([^>]+)>", "", $tekst); to get all html tags out of it.

make sure if you use the field to get or rad somefile that ../ and stuff like that to break out of the directory is parsed out also.

[yelvington]

Use strip_html(), which is explained in the fine manual.

And NEVER allow PHP tags to be entered by users.