Input-validation for free text fields
Input-validation for free text fields
I searched a lot about form-validation in PHP. Unfortunately all tutorials about the validation mechanism are about specific fields like names, mails or dates. To check if the user-input in these fields are okay is simple with regex. But what is the best way to check free fields like a contact-us texteara or a comment field? Specifically in a comment field the user should also use "dangerous" chars like "<", ">" or " ' ".
What is the best way to handle the user input? Logically it's a bad idea to store the user data pure in a database. But it's also a bad idea to block characters like "<", ">" or " ' ".
I saw a function called htmlspecialchars() in PHP. A lot of websites say it's sufficient to call this function with the user input. In my eyes this solution is really risky without more checks.
htmlspecialchars()
Does anyone have any tips for me how I can securely validate my user input without reducing the "usability"? Thanks.
Thanks for your comment. In my case I want to store the data from the user in a database and print the database data on another page. The data from the user are written text - like a comment in a forum. If my user is a hacker, the text could contain badly things...
– Waldi
Aug 25 at 22:23
If you want to validate user input you might want to use trim(), to get rid of leading and/or ending spaces. To be save against XSS (which also is discussed in this question), using
htmlspecialchars() is a good idea.– TheKeymaster
Aug 25 at 22:34
htmlspecialchars()
And
htmlspecialchars() is enough for this? So it's a good practise to allow all characters (my user could write code) an save it with htmlspecialchars() in the database? Really secure enough?– Waldi
Aug 26 at 13:04
htmlspecialchars()
htmlspecialchars()
To be save against SQL injection stackoverflow.com/questions/60174/…, might help you as well!
– TheKeymaster
Aug 26 at 13:32
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Well.. your question heavily depends on what are you going to do with this data. So what do you want to do with it and what data do you get?
– TheKeymaster
Aug 25 at 22:13