php form validation question

[hariskar]

In this example if I put in the fields: <script>location.href('http://www.hacked.com')</script> , it gives as my input:

 

<script>location.href('http://www.hacked.com')</script>
hariskar@gmail.com
<script>location.href('http://www.hacked.com')</script>
<script>location.href('http://www.hacked.com')</script>

 

Since there is htmlspecialchars() here

function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;

shouldn't it return HTML escaped code?

 

Also since we have htmlspecialchars() in function test_input mentioned above, why do we also have htmlspecialchars() in form action:

action="<?php echohtmlspecialchars($_SERVER["PHP_SELF"]);?>"

?

Couldn't we put something like this as form action:

action="form-page.php"

Thank you!

[davej]

What are you expecting it to print? It replaces special characters with entities such as described here...

 

http://www.w3schools.com/charsets/ref_html_ascii.asp

 

The global PHP_SELF is vulnerable to hacks. If you enter the actual file name then there is no risk.

[dsonesuk]

Check out firebugs 'Net' tab for post then response, the response will show as encoded, such as '< >' as < >

 

If you wish to see this tags from output use $data = htmlentities($data);