Security Issues?

Allowing visitors to submit data to a database

[riverstyx]

I'm new to PHP but have read enough to know to ask the experts before implementing anything. I want to allow non-registered visitors to submit data via a form. That data would not be immediately viewable on the website (I would review and edit before adding the data to the rotation). The visitor would get a 'thank you' page upon submission (no posted data displayed back to them). Is there any danger to my database in allowing just text to be inserted? In other words, are there malicious things that malicious people could do with a text form? I'm not allowing image or file uploads or anything else.

Input appreciated.

RS

[Angelis]

You could simply specify a tag in the database with a 1 or a 0 which specifys if you have okay'd the insert and if it is viewable on the site sort of an admin okay idea.

With PHP before anything is inserted into the database you can check the string for any coding which include html, perl, php etc and either remove it or pop up a message saying that only plain text is allowed in the box.

[riverstyx]

Thanks for the quick reply. Can you give me an example of how I would do this?

RS

[Angelis]

Completly Remove PHP Tags

<?php
$varname= eregi_replace( "<?php[^>]*>", "", $_METHOD['NAME']);
?>

Completly Strip ASP Tags

<?php
$varname = eregi_replace( "<%[^>]*>", "", $_METHOD['NAME']);
?>

You can then insert the original text just by using 'echo'...

<?php
echo ('$varname');
?>

If you are inserting into a database of course then you need to specify the $varname field as the input data for the column you need to put it in.

The 'eregi_replace' function can remove anything e.g.

eregi_replace( "<P - Paragraph Tags
eregi_replace( "<IMG - Image's

You will notice in the string there is "" specified, this is what the tag is replace with so you could specify that the PHP, ASP, IMG etc are replace with a comment or something.

[riverstyx]

Thank you thank you :)

RS

[Angelis]

You can use other methods to check if the string is in the text and return an error but thats a different "kettle of fish".

Have a play and see if it works and if not then maybe we can find another way to do it.