form validation using htmlspecialchars

[dragon52]

hi guys,

I am writing a page to update database. I have being told to always scan every form input with functions trim(), htmlspecialchar s() and stripslashes(). I don't know how to use these functions in javascript code. I have a javascript function 'checkForm'.

In the code below lines 11, 12, 13 don't work. Is it because eg stripslashes() is not a javascript function? What should I do to scan for corrupt input?

Thanks in advance



Here is my code

<form name="forms" method="post" onsubmit="return checkForm();" action="proc.php" id="myForm">

<script language="JavaScript">
function checkForm()
{
  var cName;
  with(window.document.myForm) {
    cName = tbxName;
  }

  cName.value = trim(cName.value);
  cName.value = stripslashes(cName.value);
  cName.value = htmlspecialchars(cName.value);

  if (some test) {
    alert("invalid name");
    cName.focus();
    return false;
  }
}
</script>

<input name="Name" type="text" id="tbxName" style="width:140px" class="textbox" />


</form>

[gits]

the methods you want to use are php-functions. if you want to use such methods clientside for input-modification then you have to reimplement them with the replace() method or using regExp for that purpose. besides that - its not safe to do those modifications clientside if you want to ensure that its always done before updating the DB with the values - you should use those methods in the php-code on the serverside.