防止将javascript输入表单或保存到数据库中

Question

How would I keep javascript and php code from being entered into a form or saved to a database ? I'm still learning about client/server-side security and this seems to be an issue I need to resolve :p Could I do this on php side?

Answer 1

When you are inserting in a database with php, you can use the the strip_tags() function.

eg:

$query="INSERT INTO `DB` (`id`,`data`)
VALUES (".$id.",".mysql_real_escape_string(strip_tags($data)).");";
$mysql_query($query) or die(mysql_error().'<br/><pre>'.$query.'</pre>');//Debug only

The strip_tags function will strip all the html tags from the passed variable including the tag <script> so no JavaScript will be passed. http://php.net/manual/en/function.strip-tags.php

Edit:
Added the mysql_real_escape_string()

Answer 2

Blockquote Could I do this on php side?

You have to - never (ever!) trust incoming data or clientside security checks via Javascript. Javascript can secure some content and take some workload off your server, but it is useless when bypassed or deactivated.

Use the Internet Search Engine of your choice, look-up and learn more about SQL-injection / Cross Site Scripting (XSS) .