form validation

[danilski]

Guys, I have a form on html page, where validate the inputs of the form with javascript, and then post the form to a .php page, where the inputs are received using $_REQUEST method and inserted into MySQL database.

Is there any sequrity issue with that? Or must I use server side validation instead?

Any comments are hightly appreciated.

Yours,

Dan

[Habtom]

Hello,

The following should help you secure your system:

>> When you write into the database:
$message = unhtmlentities (addslashes (trim ($_REQUEST['message'])));

>> When you read from the database:
$message = stripslashes (htmlspecialchars ($_REQUEST['message']));

Habtom

[dreamcatcher]

where validate the inputs of the form with javascript

If all you are using is javascript, then a visitor can easily disable js in their browser and bypass your checking. You should always do a server side check as well.

dc