Prevent code being executed in an input form

Question

I have been looking around loads for this. But nothing seems to be working. I have this input form for a forum. However, i am aware that you can input code from html to SQL. I was wondering how i can prevent this as obviously this would be devastating for someone to be able to use. Thanks for any help and suggestions.

<form id="form1" name="form1" method="post" action="add_topic.php">
<table>
<tr>
<td><strong>Create New Topic</strong></td>
</tr>
<tr>
<td><strong>Topic</strong></td>
<td><textarea maxlength="140" name="topic" type="text" id="topic" size="50" required/></textarea></td>
</tr>
<tr>
<td><strong>Detail</strong></td>
<td><textarea maxlength="655" name="detail" cols="50" rows="3" id="detail" required></textarea></td>
</tr>
<tr style="display: none;">
<td><strong>Name</strong></td>
<td><input name="name" type="text" id="name" size="50" value="<?php echo $_SESSION['username'];?>" readonly/></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input class="submit" type="submit" name="Submit" value="Submit" /> <input class="submit2" type="reset" style="float: right;" name="Submit2" value="Delete All" /></td>
</tr>
</table>
</td>
</form>

How can i implement something to this code to prevent code being submitted in my form that can affect my website. Thanks.

Answer 1

From user interface anything is possible, you should treat the code on server with some formatters (preg_replace,hashing etc).

and finish it with some ORM to do some “prepared statements” on sql. it will format and prepare your input to avoid something like

"select x from y where $filter"

ll come with

"select x from y where col01 = :val1 and col02 = :val2"

an example with php:

<?php
 $pdo = new PDO('mysql:host=localhost;dbname=crud', 'root', '');
 $stmt = $pdo->prepare('select * from agenda where nome = :nome');
 $stmt->bindValue(':nome', 'kalil');
 $run = $stmt->execute();
 $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
var_dump($result);
?>

to HTML5 you can format to a better visual:

<form action="/action_page.php">
Country code: <input type="text" name="country_code" 
pattern="[A-Za-z]{3}" title="Three letter country code">
<input type="submit">
</form>

In Ajax, Jquery :

i think you can see A simple jQuery form validation script, its very good

Answer 2

Ideally you should make changes in the server side not the client side ie HTML.

so you should use prepared statements to build the sql query that will automatically escape the input so that it will not execute the sql commands that is given by the user. for PHP you can do somthing like with mysqli

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', $name); // 's' specifies the variable type => 'string'

$stmt->execute();

Update for XSS

The above Code is to prevent Sql Injection. If you are displaying the content from Db to front-end (Browser), You can escape HTML chars and store in Db so that it will prevent XSS also

$stmt = $dbConnection->prepare('SELECT * FROM employees WHERE name = ?');
$stmt->bind_param('s', htmlspecialchars($name) ); // 's' specifies the variable type => 'string'

$stmt->execute();

Happy coding