Text sanitization Issue

Question

I added this code to my site to have text sanitization:

var re = /(<([^>]+)>)/gi;
        for (i=0; i < arguments.length; i++){
        arguments[i].value=arguments[i].value.replace(re, "");
        }

But somehow people are able to use the tag and still be able to post pics on my website through the text area. Please let me know if i have the code wrong.

PS: Users were also getting away with tags as well.

They can probably circumvent the JavaScript side .. you also need to sanitize on the server side — Explosion Pills, Apr 09 '13 at 05:45
What do you mean? Honestly when I looked at the inputs the user put through mysql database, I only saw the html tags. — Karthik, Apr 09 '13 at 05:47
@Karthik Since you haven't defined `i` with `var`, it's become a sort of global variable. This may confuse you if you do the same thing with a loop in a different function. — Waleed Khan, Apr 09 '13 at 05:49
@ExplosionPills how can i prevent them from circumventing through the server side? — Karthik, Apr 09 '13 at 05:56
@Karthik just check the inputs with php in a similar fashion before storing them in the DB — Explosion Pills, Apr 09 '13 at 05:59
http://stackoverflow.com/questions/8780436/user-input-validation-client-side-or-server-side-php-js — akonsu, Apr 09 '13 at 06:24

score 0 · Answer 1 · answered Apr 09 '13 at 07:41

Never trust the input data. User can simply use curl or something else and send HTTP POST request with any data in body that he want to your server. Therefore have a rule to validate all data at server side before saving it to the database.

You can introduce client-side validation though to improve user experience but anyway you have to validate that input at server side when request is received.

Update:

I see that you tagged your question with php tag, so if your server-side application is written in PHP, you can use a HTML Purifier to sanitize input data and avoid XSS, etc. Also if you use some PHP framework it probably could have an own wrapper for HTML Purifier. For example Yii framework has it.

score 0 · Answer 2 · answered Apr 09 '13 at 07:45

0

maybe nothing wrong ,user just disable javascript before submit.

check in server side like

 $_POST['name'] = preg_replace('/<[^>]*>/', '', $_POST['name']);

OR

 $_POST['name'] = strip_tags($_POST['name']);

answered Apr 09 '13 at 07:45

JOE LEE

1,058
1
6
6

Text sanitization Issue

2 Answers2