how to remove html and javascript from input field before sending to server

Question

<form action="process_reg.php" method="post" name="register_form" id="register_form">
        <input class="logbar" id="fname" name="fname" type="text" placeholder="Firstname" onfocus="CheckFname();  return true;" onblur="leaveFname();"  required>
        <span id="fnameMessage"></span>
        <input class="logbar" id="lname" name="lname" type="text" placeholder="Lastname" onfocus="CheckLname();  return true;" onblur="leaveLname();"   required>
        <span id="lnameMessage"></span>
        <input class="logbar" id="email" name="email" type="text" placeholder="Email" onfocus="CheckEmail();" onblur="leaveEmail();" required>
        <span id="emailMessage"></span>
        <input class="logbar" id="password" name="password" type="password" placeholder="Password" keyev="true"  required >
        <input class="logbar" id="password2" name="password2" type="password" placeholder="Confirm Password" onkeyup="checkPass(); return false;" required>
        <span id="confirmMessage" class="confirmMessage"></span>
        <input value="Logga in" type="button" onclick="formhash(this.form, this.form.password);" id="register">
</form>

and the Sanitize/XSS protection that i applied on this form is given

if (empty($_REQUEST) === false)
{
    $regemail1 = filter_input('INPUT_REQUEST', 'email', 'FILTER_SANITIZE_EMAIL');
    $regfirst1 = filter_input('INPUT_REQUEST', 'fname', 'FILTER_SANITIZE_SPECIAL_CHARS');
    $reglast1 = filter_input('INPUT_REQUEST', 'lname',  'FILTER_SANITIZE_SPECIAL_CHARS');

    $regpass = $_POST['p'];

    $regemail = htmlspecialchars($regemail1);
    $reglast = htmlspecialchars($reglast1);
    $regfirst = htmlspecialchars($regfirst1);

    $regemail = 



}

When I enter Hi it is perfect in a way that it stop the function of tag. but I want to send only text to the database and remove all the other things.

user3257937 · Accepted Answer · 2014-01-31 15:54:44Z

1

The only value being send to the server in the sample bellow is what ever is input field, you don't send html to server.

<input class="logbar" id="password" name="password" type="password" placeholder="Password" keyev="true"  required >

you always check what you are getting in the server by printf, echo

answered Jan 31, 2014 at 15:54

user3257937

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

how to remove html and javascript from input field before sending to server

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related