Does using the converting input from HTML forms into htmlentities protect attacks invoving JavaScrip

Posted by racl101 on Stack Overflow See other posts from Stack Overflow or by racl101
Published on 2010-04-13T22:57:59Z Indexed on 2010/04/13 23:13 UTC
Read the original article Hit count: 372

Filed under:

php

|

form

|

validation

|

attack

|

filtering

Hi everyone,

I was wondering if converting POST input from an HTML form into html entities, (via the PHP function htmlentities() or using the FILTER_SANITIZE_SPECIAL_CHARS constant in tandem with the filter_input() PHP function ), will help defend against any attacks where a user attempts to insert any JavaScript code inside the form field or if there's any other PHP based function or tactic I should employ to create a safe HTML form experience?

Sorry for the loaded run-on sentence question but that's the best I could word it in a hurry.

Any responses would be greatly appreciated and thanks to all in advance.

racl101

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about form

Spring Framework 3 and session attributes

as seen on Stack Overflow - Search for 'Stack Overflow'
I have form object that I set to request in GET request handler in my Spring controller. First time user enters to page, a new form object should be made and set to request. If user sends form, then form object is populated from request and now form object has all user givern attributes. Then form… >>> More
Zend_Form : Adding fields in sub-forms on user's click

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm having a zend form - comprised of a number of zend - sub forms, where the user is creating a new question (its a content management system). In one of the subforms, the user can click on a button to add more textfields, like this: [----------] [----------] [click to add more] which should give [----------] [----------] [----------] [click… >>> More
Zend Framework, Zend_Form_Element how to set custom name?

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I have form, where some fields are looks like rows, so I can add/delete them using JS. For example: Field with ID=1 (existing row) <input id="id[1]" type="text" name="id[1]" value="1" /> <input id="name[1]" type="text" name="name[1]" value="100" /> Field with ID=2 (existing… >>> More
how to create subforms and displaygroup without legend on zend forms?

as seen on Stack Overflow - Search for 'Stack Overflow'
hello all whats the easy way to create subforms and displaygroups without legend on zend forms? thanks >>> More
is it possible to create subform and displaygroup without fieldset on zend forms?

as seen on Stack Overflow - Search for 'Stack Overflow'
is it possible to create subform and displaygroup without fieldset on zend forms? >>> More