CODEWITHSUNDEEP
phphtmlvalidation
bzupnick
bzupnick

Reputation: 2814

How to not allow someone to throw HTML into a forum comment

im trying to make a little forum type thing. so how would i do the comments that no can throw html in there?

thanks in advance =)

Upvotes: 1

Views: 78

Answers (5)

jojo
jojo

Reputation: 41

You can use strip_tags to eliminate all the tags.

If you strip just < with &lt; and > with &gt; you'll end with a lot of junk into the stored db entry.

But if you are making a forum maybe you should implement a specific way to let your users personalize a little bit their post, a la stackoverflow..

You can create a special wordlist or just allow some tags. Check this site.

Upvotes: 0

Tom Gullen
Tom Gullen

Reputation: 61755

Simplest way, is to replace < with &lt; and > with &gt; then insert the post into the database.

That's the basic starting point, you can whitelist certain tags and expand on it later but this will protect you against just about every HTML injection.

Alternatively, you can use some kind of HTML encode function to sanitise input.

Upvotes: 2

Hammerite
Hammerite

Reputation: 22340

If you want to prevent them using any HTML at all, you can just use htmlspecialchars(). You have a choice over whether you do that before storing in the database, or before output of the page (most people will recommend sanitising output immediately before it is used, i.e. when you output the page).

Upvotes: 0

asthasr
asthasr

Reputation: 9417

You need to read about input sanitization.

Upvotes: -1

Kavi Siegel
Kavi Siegel

Reputation: 2994

http://php.net/manual/en/function.strip-tags.php

Upvotes: 1

Related Questions