Welcome to WebmasterWorld Guest from

Forum Moderators: coopster & jatar k

Message Too Old, No Replies

RegEx Form Security Patterns

Is there a silver bullet?

10:10 am on May 16, 2012 (gmt 0)

Preferred Member

10+ Year Member

joined:Aug 20, 2004
posts: 615
votes: 0

Hello All -

I'm writing a script that does the following:

1. takes $_POST vars from a guestbook and contact form
2. if any of the data contains URLs, "javascript:", HTML tags
3. all field data gets run through htmlentities and is quarantined pending admin authorization

I'm using preg_replace (not preg_match) to highlight the above characters via span pairs.

The regex patterns I'm using are catching anchor tags, http/https/ftp, the word "javascript:" and a few others.

while I guess this is a good start, would anyone be willing to share a comprehensive pattern that would catch most of the "bad stuff" thrown at html forms?

Thanks to all in advance

PS: some of the "bad" test strings I'm using contain: urls and links surrounded by square brackets.

What are these items?
3:40 pm on May 16, 2012 (gmt 0)

Senior Member

WebmasterWorld Senior Member rocknbil is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Nov 28, 2004
votes: 0

Short answer to topic: no, there isn't.

Longer but simple place to start: accept only what you want and throw everything else away.

Here's one of many [webmasterworld.com] discussions on the topic that will help. (Die on patterns found.) The array mentioned there is an easy way to filter out what you decide you need to keep.

A better one [webmasterworld.com] (second to last post) that I use regularly, which includes some cool bits on email address validation and more importantly logging the input data. This is more useful than you can ever imagine it, it reveals "what they are up to." To use this you'll have to understand functions, and how to pass parameters to them and evaluate the result. It also refers to other functions you'll need to write (exit_prog_error([message]), for example.)
1:35 am on May 17, 2012 (gmt 0)

Preferred Member

10+ Year Member

joined:Aug 20, 2004
posts: 615
votes: 0

Rockinbil -

Cool man, thanks very very much for the links!

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members