How to prevent user from entering javascript in textarea

Discussion in 'PHP' started by arvishreef99, Jul 20, 2009.

0
  1. #1
    Hello Guys,

    I have a text area where user can enter anything, but i prevent the user
    from entering javascript in the textarea. (need server side validation/control).

    If anyone have any ideas , let me know..


    Thanx in Advance,
    Arvish
     
    arvishreef99, Jul 20, 2009 IP
  2. php-lover

    php-lover Active Member

    Messages:
    261
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    58
    #2
    try strip_tags function
     
    php-lover, Jul 21, 2009 IP
  3. mioot

    mioot Peon

    Messages:
    169
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    use the textarea readonly property. And it will prevent user from entering the text into the textarea.
     
    mioot, Jul 21, 2009 IP
  4. Martinoes

    Martinoes Peon

    Messages:
    110
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #4
    Simply use htmlspecialchars($_POST[$attribute_name]) and you don't have to bother what users puts in your textarea field. All HTML special characters like < or > will be replaced with HTML codes like &lt; &gt;

    Here you can find more info http://pl.php.net/manual/pl/function.htmlspecialchars.php
     
    Martinoes, Jul 21, 2009 IP
  5. arvishreef99

    arvishreef99 Guest

    Messages:
    3
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Thanx Buddy....
     
    arvishreef99, Jul 21, 2009 IP
  6. ezprint2008

    ezprint2008 Well-Known Member

    Messages:
    611
    Likes Received:
    15
    Best Answers:
    2
    Trophy Points:
    140
    Digital Goods:
    1
    #6
    Look up sanitizing forms etc.
    Learn it for all the different ways you need to protect against.
     
    ezprint2008, Jul 21, 2009 IP
  7. bncplix

    bncplix Banned

    Messages:
    76
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #7
    you can try htmlentities() to also prevent any html tags

    So if they were to type like <b> as a way to bold stuff, running it through htmlentities will actually display the tags

    $mytext = htmlentities($mytext);
     
    bncplix, Jul 21, 2009 IP
  8. BomBas

    BomBas Peon

    Messages:
    6
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #8
    you should use htmlspecialchars function or strip_tags. If you're working with database, use mysql_real_escape_string function as well.
     
    BomBas, Jul 21, 2009 IP
  9. mushu

    mushu Peon

    Messages:
    147
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #9
    use escape tags. or use HTML codes like &lt; &gt;. do the same for your sql queries.
     
    mushu, Jul 21, 2009 IP