Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Form validation using RE

Posted on 2006-11-09
12
Medium Priority
?
276 Views
Last Modified: 2008-03-06
hello,
      I want to validate a php form using Regular expression. I want to restrict users to not enter any html tags and prevent from sql injection.. if you think there can be more security implemented use RE then please write that as well.

Thanks
0
Comment
Question by:frontpor
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
12 Comments
 
LVL 14

Expert Comment

by:Aamir Saeed
ID: 17909039
If you wish to detect each and every possible SQL Injection attack, then you simply need to watch out for any occurrence of SQL meta-characters such as the single-quote, semi-colon or double-dash. Similarly, a paranoid way of checking for CSS attacks would be to simply watch out for the angled brackets that signify an HTML tag. But these signatures may result in a high number of false positives. To avoid this, the signatures can be modified to be made accurate, yet still not yield too many false positives

strip_tags() removes any PHP or HTML tags from a string. This prevents the HTML display problems, the JavaScript execution (the <script> tag will no longer be present) and a variety of problems where there is a chance that PHP code could be executed.

mysql_escape_string() // for sql injection upto some extent.
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17910944
Like i_m_aamir says, but use mysql_real_escap_string() instead now, because it replaces the now-deprecated mysql_escape_string.

The PHP user manual recommends that you create SQL query strings using sprintf() and mysql_real_escape_string(), for instance:

$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
           mysql_real_escape_string($user),
           mysql_real_escape_string($password));

That's a very tidy way of escaping PHP variables for use in SQL queries.
0
 

Author Comment

by:frontpor
ID: 17912260
I need regular expression.. to check this and display error..
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 16

Expert Comment

by:HackneyCab
ID: 17913970
To check what? A regular expression can only be crafted to suit a particular need. There's no such thing as a one-size-fits-all regex.

What data is it you're trying to validate?
0
 
LVL 9

Expert Comment

by:lucki_luke
ID: 17915863
Hey,

these regexes
preg_match_all("/(<([\w]+)[^>\/]*>)(.*)(<\/\\2>)/U", $html, $matches, PREG_SET_ORDER);
preg_match_all("/(<([\w]+)[^>]*\/>)/U", $html2, $matches2, PREG_SET_ORDER);
match all (html) tags (ungreedy).
As for preventing sql injections, I'd just use mysql_real_escape_string(); as mentioned above because using REs for such a general issue is hardly possible.

Lukas
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17919019
The best way to remove HTML from user input is to use PHP's strip_tags() function.

http://www.php.net/manual/en/function.strip-tags.php

(Sorry, I didn't see your statement that you wanted to strip out HTML from user input. I'm not good at spotting things that aren't bullet points.)
0
 

Author Comment

by:frontpor
ID: 17924741
hello,
      thanks for the reply, i am using this RE in contact form.. mostly spammer enter this url like this http://url.com, http://www.url.com/ or url.com so all i want to prevent them from entering links.. is  there anyway to do this?
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17925088
Well, if it's automated attacks you're trying to avoid, do some searching for a mechanism called a CAPTCHA system.

The CAPTCHA system forces the visitor to perform a task that computers find difficult, such as read numbers from a colourful graphic. Many big websites use a CAPTCHA system to avoid robots submitting rubbish to their feedback forms.
0
 

Author Comment

by:frontpor
ID: 17925164
i have already captcha.. but still get spam.. need RE for that
0
 

Author Comment

by:frontpor
ID: 17925400
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 18212393
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I imagine that there are some, like me, who require a way of getting currency exchange rates for implementation in web project from time to time, so I thought I would share a solution that I have developed for this purpose. It turns out that Yaho…
Part of the Global Positioning System A geocode (https://developers.google.com/maps/documentation/geocoding/) is the major subset of a GPS coordinate (http://en.wikipedia.org/wiki/Global_Positioning_System), the other parts being the altitude and t…
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

704 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question