Form security for database

[Mark Renton]

Hi,
I don't find anywhere the answer to my question so I try to ask here.
I have in my pages different form fields ("find", "password", "message").
I know that is easy for an hacker to have information about my database
creating an error, or to enter in the secret zone...

So, what kind of contol or what I have to strip/erase from the input to have
a security (or almost)?
Is it a different control for different fields?

Thank you, and sorry for my english mistakes (I'm italian!:) )
Mark

[Barton]

Re: Form security for database

Here ya go:

// add slashes so that special characters are not interpreted
$message = addslashes($mes sage);

//get rid of ALL html tags
$message = strip_tags($mes sage);

//convert the tag leftovers to non-html
$message = htmlspecialchar s($message, ENT_QUOTES);

Be carefull with the order of these functions. Double check on php.net

Greetz,

Barton

On Mon, 27 Oct 2003 11:04:46 +0100, "Mark Renton" <mark@hotmaille .com>
wrote:
[color=blue]
>Hi,
>I don't find anywhere the answer to my question so I try to ask here.
>I have in my pages different form fields ("find", "password", "message").
>I know that is easy for an hacker to have information about my database
>creating an error, or to enter in the secret zone...
>
>So, what kind of contol or what I have to strip/erase from the input to have
>a security (or almost)?
>Is it a different control for different fields?
>
>Thank you, and sorry for my english mistakes (I'm italian!:) )
> Mark
>[/color]

[Steve]

Re: Form security for database

Good suggestions and here is one more that incorporates it all on one
line and adds a little somethin extra

$message = addslashes(html specialchars(st rip_tags(trim(c hop($message))) ,ENT_QUOTES));

This removes the white space from the begin and end, in addition to
all the other stuff he said.

Barton <bc173@NOSPAMMM hotmail.com> wrote in message news:<bnsppv83m 2ejirb14ack8vhe f0ld0g8it4@4ax. com>...[color=blue]
> Here ya go:
>
> // add slashes so that special characters are not interpreted
> $message = addslashes($mes sage);
>
> //get rid of ALL html tags
> $message = strip_tags($mes sage);
>
> //convert the tag leftovers to non-html
> $message = htmlspecialchar s($message, ENT_QUOTES);
>
> Be carefull with the order of these functions. Double check on php.net
>
> Greetz,
>
> Barton
>
> On Mon, 27 Oct 2003 11:04:46 +0100, "Mark Renton" <mark@hotmaille .com>
> wrote:
>[color=green]
> >Hi,
> >I don't find anywhere the answer to my question so I try to ask here.
> >I have in my pages different form fields ("find", "password", "message").
> >I know that is easy for an hacker to have information about my database
> >creating an error, or to enter in the secret zone...
> >
> >So, what kind of contol or what I have to strip/erase from the input to have
> >a security (or almost)?
> >Is it a different control for different fields?
> >
> >Thank you, and sorry for my english mistakes (I'm italian!:) )
> > Mark
> >[/color][/color]

[Mark Renton]

Re: Form security for database

Thank you 2!
A question: is there any risk with this function if someone insert a
"SELECT" or other SQL command inside?
for example: someone say there could be a risk if in the password field you
write "OR a=a".

thks!! :)