Easily prevent HTML injection

		vb.org Archive > vBulletin Article Depository > Read An Article > vBulletin 3 Articles
Easily prevent HTML injection

Thread Tools

Easily prevent HTML injection

filburt1

Join Date: Feb 2002

Posts: 6,144

Maryland, US

filburt1

04-22-2003, 09:00 PM

To easily prevent HTML injection from HTML that happens to be in the results of a database query, do this:

PHP Code:


			while ($bits = $DB_site->fetch_array($result))
{
    foreach ($bits as $key => $value) $bits[$key] = htmlspecialchars($value);
    .
    .
    .
}

That goes through every single element from the fetch_array method and converts all HTML junk to their entities. Then, when you use "$bits[something]" in a template, the user won't be able to inject HTML at all.

07-19-2003, 04:26 PM

bobk

Join Date: Mar 2003

Posts: 1

Благодарил(а): 0 раз(а)

Поблагодарили: 0 раз(а) в 0 сообщениях

This protects if the data is already in the database.... what should check for when inserting data? Or is that in an FAQ that I haven't found yet?

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Forum Rules

Forum Jump

All times are GMT. The time now is 12:59 AM.

The Arcive of vBulletin Modifications Site.