Solved

Form validation using RE

Posted on 2006-11-09
12
249 Views
Last Modified: 2008-03-06
hello,
      I want to validate a php form using Regular expression. I want to restrict users to not enter any html tags and prevent from sql injection.. if you think there can be more security implemented use RE then please write that as well.

Thanks
0
Comment
Question by:frontpor
12 Comments
 
LVL 14

Expert Comment

by:Aamir Saeed
ID: 17909039
If you wish to detect each and every possible SQL Injection attack, then you simply need to watch out for any occurrence of SQL meta-characters such as the single-quote, semi-colon or double-dash. Similarly, a paranoid way of checking for CSS attacks would be to simply watch out for the angled brackets that signify an HTML tag. But these signatures may result in a high number of false positives. To avoid this, the signatures can be modified to be made accurate, yet still not yield too many false positives

strip_tags() removes any PHP or HTML tags from a string. This prevents the HTML display problems, the JavaScript execution (the <script> tag will no longer be present) and a variety of problems where there is a chance that PHP code could be executed.

mysql_escape_string() // for sql injection upto some extent.
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17910944
Like i_m_aamir says, but use mysql_real_escap_string() instead now, because it replaces the now-deprecated mysql_escape_string.

The PHP user manual recommends that you create SQL query strings using sprintf() and mysql_real_escape_string(), for instance:

$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
           mysql_real_escape_string($user),
           mysql_real_escape_string($password));

That's a very tidy way of escaping PHP variables for use in SQL queries.
0
 

Author Comment

by:frontpor
ID: 17912260
I need regular expression.. to check this and display error..
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 16

Expert Comment

by:HackneyCab
ID: 17913970
To check what? A regular expression can only be crafted to suit a particular need. There's no such thing as a one-size-fits-all regex.

What data is it you're trying to validate?
0
 
LVL 9

Expert Comment

by:lucki_luke
ID: 17915863
Hey,

these regexes
preg_match_all("/(<([\w]+)[^>\/]*>)(.*)(<\/\\2>)/U", $html, $matches, PREG_SET_ORDER);
preg_match_all("/(<([\w]+)[^>]*\/>)/U", $html2, $matches2, PREG_SET_ORDER);
match all (html) tags (ungreedy).
As for preventing sql injections, I'd just use mysql_real_escape_string(); as mentioned above because using REs for such a general issue is hardly possible.

Lukas
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17919019
The best way to remove HTML from user input is to use PHP's strip_tags() function.

http://www.php.net/manual/en/function.strip-tags.php

(Sorry, I didn't see your statement that you wanted to strip out HTML from user input. I'm not good at spotting things that aren't bullet points.)
0
 

Author Comment

by:frontpor
ID: 17924741
hello,
      thanks for the reply, i am using this RE in contact form.. mostly spammer enter this url like this http://url.com, http://www.url.com/ or url.com so all i want to prevent them from entering links.. is  there anyway to do this?
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17925088
Well, if it's automated attacks you're trying to avoid, do some searching for a mechanism called a CAPTCHA system.

The CAPTCHA system forces the visitor to perform a task that computers find difficult, such as read numbers from a colourful graphic. Many big websites use a CAPTCHA system to avoid robots submitting rubbish to their feedback forms.
0
 

Author Comment

by:frontpor
ID: 17925164
i have already captcha.. but still get spam.. need RE for that
0
 

Author Comment

by:frontpor
ID: 17925400
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 18212393
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Popularity Can Be Measured Sometimes we deal with questions of popularity, and we need a way to collect opinions from our clients.  This article shows a simple teaching example of how we might elect a favorite color by letting our clients vote for …
Since pre-biblical times, humans have sought ways to keep secrets, and share the secrets selectively.  This article explores the ways PHP can be used to hide and encrypt information.
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question