Disallow characters in text field

Question

Should I disallow characters like ",',>,<,\ ... to be typed in an upload forms text field? The text will be send through PHP to a blog.

I heared that some characters might cause trouble and could be used to "hack / harm" servers. Which characters should be restricted?

Thanks for your input. Michael

Don't blacklist characters. Whitelist them. – Lightness Races in Orbit Jun 19 '11 at 00:13 — Lightness Races in Orbit, Jun 19 '11 at 00:13
http://en.wikipedia.org/wiki/Whitelist – Lightness Races in Orbit Jun 20 '11 at 08:34 — Lightness Races in Orbit, Jun 20 '11 at 08:34

score 1 · Accepted Answer · edited May 23 '17 at 10:08

There is no need to restrict anything. The problem is that you have to sanitize all user input; for this specific type of data (possible HTML) it is necessary and enough to use htmlspecialchars on all user-provided data before displaying it as part of your page.

For example, if your form has a textarea named post-body, you should receive the user input (e.g. with $_REQUEST['post-body']) and save it to your database as-is (warning: use mysql_real_escape_string or PDO to protect yourself from SQL injection at this stage!). When the time comes to display it, you would retrieve it from the database and print it with something like

echo htmlspecialchars($postBody);

See this question for some more background on data sanitization.

score 0 · Answer 2 · edited May 23 '17 at 11:55

0

Users data should be sanitized by htmlspecialchars function each time when you output users data, to avoid XSS-attacks.

Also, to work with users data in sql-queries, use PDO and prepared statements or mysql_real_escape_string function to avoid SQL-injection. Example.

edited May 23 '17 at 11:55

Community

1
1

answered Jun 18 '11 at 23:33

OZ_

12,492
7
50
68

score 0 · Answer 3 · answered Jan 27 '12 at 06:46

0

  <?    $string = str_replace("\\\"", "\"", $string);
        $string = htmlspecialchars($string);
        $string = preg_replace( "/\r\n|\n|\r/", "<br>", $string );   ?>

<input type = "text" name = "string" id = "string" value = "<?=$string?>">

answered Jan 27 '12 at 06:46

me_an

489
4
11

Disallow characters in text field

3 Answers3