Protect HTML form from Javascript/Attacks

Question

I have a form and as of right now, you can type any javascript, etc. you want. Any XSS, etc.

How do I go about creating a whitelist so you can only post characters.

At some point I would like anything that starts with http:// to be converted to

<a href="http://..."></a>

Thanks

Is this efficient? http://htmlpurifier.org/

you know you can't use client side code for data validation - your users can just turn off JS. So unless you are running server-side javascript, you are going to have to check server-side in another language for the presence of script tags/bad characters... — tobyodavies
– tobyodavies, Commented Nov 17, 2010 at 8:17
Thanks, I realize that now. Can you recommend any prebuilt solutions? — switz
– switz, Commented Nov 17, 2010 at 8:33
what is the server side script you are using? is it php, .net. perl, ... — sathish
– sathish, Commented Nov 17, 2010 at 8:36

Andy E · Accepted Answer · 2010-11-17 08:46:18Z

7

jQuery or Javascript is preferred

Well, no, you can't do that, you see? Because even if you 'sanitize' your data using javascript, noone's stopping anyone from

turning off javascript
using a browser's developer console to mess with the data
doing the POST directly, without a browser

In other words, you have to perform the validation/sanitization on the server side. Javascript validation is there to enhance the experience of your users (by providing instant feedback on invalid input, for example).

edited Nov 17, 2010 at 8:46

Andy E

346k86 gold badges482 silver badges452 bronze badges

answered Nov 17, 2010 at 8:21

shylent

10.1k6 gold badges41 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

switz Over a year ago

I get it. So do what do you recommend using then? Thanks

acm Over a year ago

??? @Switz, shylent did recomend something: (...) you have to perform the validation/sanitization on the server side.

Andy Marvel · Accepted Answer · 2010-11-17 13:17:37Z

1

But still, in many high-load applications developers use partially client-side verifications (but all inputs have to be prepared for writing to db).

As you will be using PHP, i suggest you to parse your $_POST values with htmlspecialchars(), mysql_real_escape_string() and so on.

You will have to use regular expression to convert anything that starts with "http://" to links (well, you can also use explode('.', $_POST['yourInput']) which can be easier for you).

edited Nov 17, 2010 at 13:17

answered Nov 17, 2010 at 9:12

Andy Marvel

513 bronze badges

1 Comment

Mahdi Jazini Over a year ago

Very useful thank you :) To update your post: mysql_real_escape_string is deprecated in PHP 5.5.0, and it was removed in PHP 7.0.0. Source: php.net/manual/en/function.mysql-real-escape-string.php

Collectives™ on Stack Overflow

Protect HTML form from Javascript/Attacks

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related