Re: Preventing Cross Site Scripting Vulnerbilities

comex wrote:

Similarly is there a library function for escaping database content for inclusion in HTML pages?

http://php.net/htmlspecialchars http://php.net/htmlentities Or roll your own and replace the eregi regex with data that is valid to your application:

function chk_input( $string ) { if( eregi( "^[0-9a-z_ -]$", $string ) ) { return 0; } else { return 1; } } if( chk_input( $string ) == 0 ) { echo "valid"; } else { echo "invalid"; } -- Jason Gerfen "Oh I have seen alot of what the world can do, and its breaking my heart in two..." ~ Wild World, Cat Stevens