php allows javascript code to run

Asked Dec 12 '17 at 22:51

Active Dec 12 '17 at 22:58

Viewed 27 times

Good nigth guys, I have a problem..

<fieldset class="form-group inline-label">
     <textarea name="historia" class="form-control" maxlength="2000" minlength="700" placeholder="Minimo de 700 caracteres" requiredstyle="width:568px;height:180px;"></textarea>
<label for="formGroupExampleInput2">História:</label>
</fieldset>

I have more than this example but I'm using this one to explain. I have this textarea. I save the value to the database like this : $historia = $_POST['historia'];

$sql = "INSERT INTO pendentes(blabla phistoria,blabla) VALUES (?,?,?,?,?,?,?,?,?,?)";
if($stmt = $ligacao->prepare($sql))
{$stmt->bind_param("blabla", blabla, $historia);
$stmt->execute();                                 
$stmt->close();

And If I insert and for example: ?> alert("Something Something"); it will save on the database and run when the page is open How can I fix it? Thanks in advance

edited Dec 12 '17 at 22:58

asked Dec 12 '17 at 22:51

ShwSvn

3

So what is your question? – Ivonet Dec 12 '17 at 22:52
@Ivonet Sorry, forgot to add, going to edit – ShwSvn Dec 12 '17 at 22:57
No I did not forget to add, I add the rest of the text after the tag " – ShwSvn Dec 12 '17 at 22:58
@CyRossignol I will read it better but yes it looks like it's that, thank you – ShwSvn Dec 12 '17 at 23:16
@user7393973 it's just that is accepting javascript on the textarea and saving it on the database, and after when I do a select of that table it runs the javascript code – ShwSvn Dec 12 '17 at 23:17
Use the htmlentities function when you print – Marcelo Staudt Dec 12 '17 at 23:25

php allows javascript code to run

0 Answers0