note 77556 deleted from function.htmlentities by danbrown

Note Submitter: halocastle at yahoo dot com ---- Okay, so maybe this SHOULD be posted under Urlencode, but there's more talk of foiling XSS attacks here than there, so… Be VERY careful validating submitted data not to miss something. By that I mean EVERYTHING passed in the $_POST array, including keys (the names of the form fields themselves) is susceptible to XSS attacks. Any hack can add whatever they want to your form and submit it to your script: <input type="hidden" name="<script>alert('…the form_fields_NAMES can get you, too!');</script>" value="We all validate form_field_VALUES, but…"> Step one of course is to adopt a sensible naming convention for your form fields, to whit: name="always_lower_case" (underscores do NOT get encoded because they are valid URL characters). So, you should never find a "%" in one of your form field NAMES. Here's what I do: foreach($_POST as $key => $val) { // scrubbing the field NAME... if(preg_match('/%/', urlencode($key)*)) die('FATAL::XSS hack attempt detected. Your IP has been logged.'); // okay, got here, now scrubbing the field VALUE... [ scrub $val here by using htmlentities or a custom replacement function ]; ...; } * %3Cscript%3Ealert%28%27%85the+form_fields_NAMES+can+get+you%... P.S. Yes, remove the asterisk!