How to secure a form

[jbearnolimits]

I know it's basic... but I've been looking all over and I only see <form action="<php echo htmlspecialchars($_SERVER["PHP_SELF"]);?>" being talked about. But what if you aren't reloading it on the same page? Like what if you wanted to do <form action="action.php"

Where and what code do you use to secure a simple form that posts to a new page that handles the input?

[jbearnolimits]

So just to give more information....Here is my code:

if ($_SERVER["REQUEST_METHOD"] == "POST") {
  // collect value of input field
  $ListName = test_input($_POST['ListName']);
  $Task1 = test_input($_POST['Task1']);
  $Task2 = test_input($_POST['Task2']);
  $Task3 = test_input($_POST['Task3']);
  $Task4 = test_input($_POST['Task4']);
  $Task5 = test_input($_POST['Task5']);
  $Task6 = test_input($_POST['Task6']);
  $Task7 = test_input($_POST['Task7']);
  $Task8 = test_input($_POST['Task8']);
  $Task9 = test_input($_POST['Task9']);
  $Task10 = test_input($_POST['Task10']);
  
}

function test_input($data) {
 $data = trim($data);
 $data = stripslashes($data);
 $data = htmlspecialchars($data);
 return $data;
}



$sql = "INSERT INTO AutoPilotTaskLists (ListName, Task1, Task2, Task3, Task4, Task5, Task6, Task7, Task8, Task9, Task10) VALUES ('$ListName', '$Task1', '$Task2', '$Task3', '$Task4', '$Task5', '$Task6', '$Task7', '$Task8', '$Task9', '$Task10')";

if ($conn->query($sql) === TRUE) {
 echo "New List Created";
} else {
 echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();


?>

The form is on a different page and sends the information to this page via POST. What I find is that it submits to the database fine UNLESS I use an apostrophe or type in a paragraph, then hit enter to type a second one in the same box. With the apostrophe it throws an error saying the syntax is wrong. So I can't use apostrophe's like I did in that word just now. As for the paragraph issue it simply doesn't save it to the database. It runs everything together. How do I fix this?

[Dimitri]

When you insert, or update fields, which contain text , you need to "escape" the value : [php.net...] or again better "prepare the statement" : [php.net...] like I mentioned it here : [webmasterworld.com...]

[jbearnolimits]

I get that. I'm just having trouble applying it. As you can see in the code above I tried to put in the htmlspecialchars function. But it is not working. I don't know why. I'm the kind of person that learns best by deconstruction. So can you provide an example using the code above so I can see how it works in this type of situation?

[Dimitri]

$stmt = $conn->prepare("INSERT INTO AutoPilotTaskLists (ListName, Task1, Task2, Task3, Task4, Task5, Task6, Task7, Task8, Task9, Task10) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");

$stmt->bind_param("sssssssssss", $ListName, $Task1, $Task2, $Task3, $Task4, $Task5, $Task6, $Task7, $Task8, $Task9, $Task10);

$stmt->execute();

[jbearnolimits]

Thanks. So from what I see, and correct me if I am wrong, the first part "prepares" the input by removing all the values. Then the second part puts them back in? I guess I have two questions about the code you gave that may help the lightbulb go off. What does the ssssss part mean and where does the code actually remove the apostrophe? Right now it just looks like it removes the values and then puts them back to me. So I am obviously missing something.

[Dimitri]

[php.net...]

[jbearnolimits]

Ooooh...I had read that a few times but didn't catch it until just now. In the example I was reading I kept thinking when it said "is" mean id is an integer and label is a string it was saying it "is" as in the word is. I didn't understand it meant "i" "s".

[jbearnolimits]

After lots of research and many questions (thanks for being kind enough to answer) I have finally got it! It's now working for me. I can use those characters without an issue. The only problem left to solve is how to get it to record the new paragraphs written in the text area as right now they still don't have a line break. **EDIT: The answer to the paragraph issue is that it DOES save it to the database as a couple of paragraphs, but it doesn't display on the browser when output unless you add white-space: pre-wrap; to your css. So add that.**

For those interested the answer to the apostrophe question is know what syntax to use! If I remember back in the day (which I may not remember correctly) there was only one syntax with MySql. Now there is MySQLi (object-oriented) , MySQLi (procedural), and PDO. I got very confused and have been mixing them. I didn't realize what was going on till now. So the first step is KNOW WHAT SYNTAX version to use. Then the tutorials and answers others give will make sense. Here is what I ended up with:

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
 die("Connection failed: " . $conn->connect_error);
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
 // collect value of input field
 $ListName = mysqli_real_escape_string($conn, $_POST['ListName']);
 $Task1 = mysqli_real_escape_string($conn, $_POST['Task1']);
 $Task2 = mysqli_real_escape_string($conn, $_POST['Task2']);
 $Task3 = mysqli_real_escape_string($conn, $_POST['Task3']);
 $Task4 = mysqli_real_escape_string($conn, $_POST['Task4']);
 $Task5 = mysqli_real_escape_string($conn, $_POST['Task5']);
 $Task6 = mysqli_real_escape_string($conn, $_POST['Task6']);
 $Task7 = mysqli_real_escape_string($conn, $_POST['Task7']);
 $Task8 = mysqli_real_escape_string($conn, $_POST['Task8']);
 $Task9 = mysqli_real_escape_string($conn, $_POST['Task9']);
 $Task10 = mysqli_real_escape_string($conn, $_POST['Task10']);
 
}

$sql= "INSERT INTO AutoPilotTaskLists (ListName, Task1, Task2, Task3, Task4, Task5, Task6, Task7, Task8, Task9, Task10) VALUES ('$ListName', '$Task1', '$Task2', '$Task3', '$Task4', '$Task5', '$Task6', '$Task7', '$Task8', '$Task9', '$Task10')";


if ($conn->query($sql) === TRUE) {
 echo "New List Created";
} else {
 echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();


?>