PHP中的GET表单出现问题

Question

I made a GET form recently.But the problem is that it is highly vulnerable.You can inject your an script as below.

http://mysite.com/processget.phtml?search=<a href="http://google.com">Hacked</a>

I'm able to inject any kind of script into my above URL.I'm actually echoing my GET data using an echo in my BODY,so whenever i enter a malicious script it is being executed in my BODY tag.So now how do i limit this http://mysite.com/processget.phtml?search= to just Number,letters and a few symbols which i want.

For ex.The user should only be able to enter

http://mysite.com/processget.phtml?search=A123123+*$

So can anyof you help me fix this bug.I'm kind of new to PHP,so please explain.

Answer 1

if (!empty($_GET['search'])) {
    $search = htmlentities($_GET['search'],ENT_QUOTES,'UTF-8');
    echo $search;
}

Now it's safe.

But if you want to limit to specific symbols, then you need to use regular expressions.

Answer 2

You can let a user enter whatever you like; the key is to escape the output. Then the string is displayed as desired, rather than included as HTML.

Use a php function like htmlentities

Answer 3

Strip the tags:

echo strip_tags($_GET['search']);

Actually, you may want htmlspecialchars instead, which escapes the tags instead of removing them so they display as intended:

echo htmlspecialchars($_GET['search']);