forms class
| From: | nihilism machine | Date: | Tue, 22 Jan 2008 04:15:13 +0000 |
| Subject: | forms class | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-267811@lists.php.net to get a copy of this message | ||
Why isnt this cleaning my form $_POST's
class forms {
var $UserInputClean;
// Forms to variables
function forms() {
if (count($_POST) > 0) {
foreach($_POST as $curPostKey => $curPostVal) {
$curPostKey = forms::CleanInput($curPostVal);
}
}
// Debug
print_r($_POST);
}
// Clean XSS
function CleanInput($UserInput) {
$allowedtags = "<strong><em><a><ul><li><pre><hr><blockquote><img><span>";
$notallowedattribs = array("@javascript:|onclick|ondblclick|onmousedown|onmouseup"
."|onmouseover|onmousemove|onmouseout|onkeypress|onkeydown|onkeyup@si");
$changexssto = '';
$UserInput = preg_replace($notallowedattribs, $changexssto, $UserInput);
$UserInput = strip_tags($text, $allowedtags);
$UserInput = nl2br($UserInput);
return $this->UserInputClean;
}
}