?
Solved

Form validation using RE

Posted on 2006-11-09
12
Medium Priority
?
285 Views
Last Modified: 2008-03-06
hello,
      I want to validate a php form using Regular expression. I want to restrict users to not enter any html tags and prevent from sql injection.. if you think there can be more security implemented use RE then please write that as well.

Thanks
0
Comment
Question by:frontpor
11 Comments
 
LVL 14

Expert Comment

by:Aamir Saeed
ID: 17909039
If you wish to detect each and every possible SQL Injection attack, then you simply need to watch out for any occurrence of SQL meta-characters such as the single-quote, semi-colon or double-dash. Similarly, a paranoid way of checking for CSS attacks would be to simply watch out for the angled brackets that signify an HTML tag. But these signatures may result in a high number of false positives. To avoid this, the signatures can be modified to be made accurate, yet still not yield too many false positives

strip_tags() removes any PHP or HTML tags from a string. This prevents the HTML display problems, the JavaScript execution (the <script> tag will no longer be present) and a variety of problems where there is a chance that PHP code could be executed.

mysql_escape_string() // for sql injection upto some extent.
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17910944
Like i_m_aamir says, but use mysql_real_escap_string() instead now, because it replaces the now-deprecated mysql_escape_string.

The PHP user manual recommends that you create SQL query strings using sprintf() and mysql_real_escape_string(), for instance:

$query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
           mysql_real_escape_string($user),
           mysql_real_escape_string($password));

That's a very tidy way of escaping PHP variables for use in SQL queries.
0
 

Author Comment

by:frontpor
ID: 17912260
I need regular expression.. to check this and display error..
0
[Webinar] Kill tickets & tabs using PowerShell

Are you tired of cycling through the same browser tabs everyday to close the same repetitive tickets? In this webinar JumpCloud will show how you can leverage RESTful APIs to build your own PowerShell modules to kill tickets & tabs using the PowerShell command Invoke-RestMethod.

 
LVL 16

Expert Comment

by:HackneyCab
ID: 17913970
To check what? A regular expression can only be crafted to suit a particular need. There's no such thing as a one-size-fits-all regex.

What data is it you're trying to validate?
0
 
LVL 9

Expert Comment

by:lucki_luke
ID: 17915863
Hey,

these regexes
preg_match_all("/(<([\w]+)[^>\/]*>)(.*)(<\/\\2>)/U", $html, $matches, PREG_SET_ORDER);
preg_match_all("/(<([\w]+)[^>]*\/>)/U", $html2, $matches2, PREG_SET_ORDER);
match all (html) tags (ungreedy).
As for preventing sql injections, I'd just use mysql_real_escape_string(); as mentioned above because using REs for such a general issue is hardly possible.

Lukas
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17919019
The best way to remove HTML from user input is to use PHP's strip_tags() function.

http://www.php.net/manual/en/function.strip-tags.php

(Sorry, I didn't see your statement that you wanted to strip out HTML from user input. I'm not good at spotting things that aren't bullet points.)
0
 

Author Comment

by:frontpor
ID: 17924741
hello,
      thanks for the reply, i am using this RE in contact form.. mostly spammer enter this url like this http://url.com, http://www.url.com/ or url.com so all i want to prevent them from entering links.. is  there anyway to do this?
0
 
LVL 16

Expert Comment

by:HackneyCab
ID: 17925088
Well, if it's automated attacks you're trying to avoid, do some searching for a mechanism called a CAPTCHA system.

The CAPTCHA system forces the visitor to perform a task that computers find difficult, such as read numbers from a colourful graphic. Many big websites use a CAPTCHA system to avoid robots submitting rubbish to their feedback forms.
0
 

Author Comment

by:frontpor
ID: 17925164
i have already captcha.. but still get spam.. need RE for that
0
 

Author Comment

by:frontpor
ID: 17925400
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 18212393
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article discusses how to create an extensible mechanism for linked drop downs.
Originally, this post was published on Monitis Blog, you can check it here . In business circles, we sometimes hear that today is the “age of the customer.” And so it is. Thanks to the enormous advances over the past few years in consumer techno…
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
Suggested Courses

594 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question