Question: Sanitisation of form data before post to DB

[katw]

Does QuForm sanitise data before posting to database to avoid nasty injected code?

I know we can apply STRIPTAGS filter to fields but this is a brute force block.

Much like this forum post area we want users to be able to use “safe” tags in the <textarea> fields.

So they can use hyperlinks and use styling tags to express themselves better. But we don’t want injected code and nasties.

Do you apply HTMLENTITIES() to encode textarea fields? Do you do this also on normal <INPUT> fields?

[Ally]

You don't have permission to view this content. Please log in or register and then verify your purchases to gain access.

[katw]

Okay thanks.

CLOSE TICKET

[Author]

Posts