home columns tips news discussion forums php manual shared code lib mail archives jobs/resumes get started links contribute! columns Sending MIME Email With PHP The Big Upgrade Database Normalization and Design Techniques Object Orientation Storing Data in the Client Displaying Formatted User Input PHP Extension Add-on Repository (PEAR) [ Show All ] forums Database Talk General Help Coding Help Install Help help!!! Win2k Pro + MySQL? Session.save_path JavaWebServer Dynamic vs. Static Modules Windows Help search Support Forum PHP Manual All Mail Lists internet.com Linux Today Linux Planet Linux Start Just Linux Linuxnewbie.org Linux Apps All Linux Devices Apache Today Enterprise Linux Linux Central Linux Programming BSDToday SITE DESCRIPTIONS [New Account] [Login]			Displaying Formatted User Input Ying Zhang This document describes how to display safely formatted output from user input. We will discuss the dangers of displaying unfiltered output and then provide a safe means of displaying formatted output. Download ying20000718.zip and extract it into your web documents directory. Dangers of Unfiltered Output If you just took the user's input and displayed it as is, you may break your webpage. For example, someone can maliciously embed javascript in their comment like: This is my comment. <script language="javascript: alert('Do something bad here!')">. Even if the user had no bad intentions, they may accidentally put some HTML that breaks your site layout. For example if you displayed the user's input in a table and they included an improperly nested </table> tag, your page appears broken. Displaying Plain Text Only The easiest solution would be to only display plain text in the comment. Using the htmlspecialchars() function, you convert all the special characters into HTML entites. For example <b> would become &lt;b&gt;, turning it into text instead of an HTML tag. This guarantees that there are no HTML markups in the comment that would produce unwanted output. This is an okay solution if your guests don't mind entering in only plain text, but it would be a lot better if you gave them some formatting abilities. [ Next Page ] Comments: Editing formated code J. Kobinski 08/06/00 15:17 RE: Unclosed Tags? Cédric CHERCHI 08/01/00 12:01 RE: yeah , but i'm slow like turtle Sean Pecor 07/25/00 20:05 RE: yeah , but i'm slow like turtle Adrian Kubala 07/25/00 12:15 RE: str_tags Ying Zhang 07/24/00 05:05 RE: Unclosed Tags? Keita Ito 07/23/00 18:01 RE: instead of custom markup languages... Keita Ito 07/23/00 17:56 RE: instead of custom markup languages... Keita Ito 07/23/00 17:53 RE: instead of custom markup languages... Ben Munoz 07/21/00 14:01 instead of custom markup languages... Ben Munoz 07/21/00 13:56 Unclosed Tags? Brian Mertens 07/21/00 00:44 yeah , but i'm slow like turtle philip olson 07/21/00 00:33 Similar Mike Hall 07/20/00 05:11 RE: An addition Vincent Vollers 07/20/00 04:52 RE: An addition Doug MacDougall 07/20/00 01:18 Just use HTML.. life is complicated enough Doug MacDougall 07/20/00 01:06 RE: str_tags Steve Yelvington 07/19/00 19:45 An addition Vincent Vollers 07/19/00 13:18 str_tags Matt 07/19/00 11:45 this is exactly what i wanted to know philip olson 07/19/00 00:17   Add A Comment: [Not Logged In] Subject: Message: Due to abuse, you must now be [ logged in ] to post
				Columns / Articles | Tips / Quickies | News Linking and RSS Feeds | Shared Code Library | Mail Archives | Support / Discussion Forums | Get Started! Links | Contribute! | Jobs / Resumes | PHP Manual Contact (non support questions) Copyright 2000 internet.com Corp. All Rights Reserved. Legal Notices, Reprints.   Privacy Policy