Re: Dealing With User Entering a Script

On 16-07-22 02:42 PM, Ashley Sheridan wrote:

On Fri, 2016-07-22 at 14:19 -0400, Stephen wrote:

I dug back to see where I git the idea of using htmlentities() on user input. This came from the book Modern PHP and deals with a user entering in a text box something like: <script>window.location.href='http://example.com';</script> Is there a better way of dealing with this? For context, I am creating a user registration field and there is a textarea field for their bio. Thank you! -- Stephen

That script tag is not a problem if you're putting that data into a database. The DB doesn't need to be protected against anything other than SQL injection, which a <script> tag is not. You only use htmlentities (now you might be better using filter_var - look up the manual for usage) when outputting that content onto a page that is HTML (or XML). If you're not outputting it, or outputting it as PDF or text, then you won't need to run that (you'll need other things possibly instead, particularly for PDF) It's typically a bad idea to alter data in this way, as it cannot be undone, and it isn't applicable to the DB anyway.

To learn, I push back. Why has BBcode become the norm on most bulletin board like web sites? -- Stephen