PHP input security question

[JonD]

Im running user input through the following function before its inputted into the database and then outputting it back into the textarea for editing:

function formatStringInput($string)
{
	
	// Trim whitespace
	$string = trim($string);
	
	// Escape naughty characters
	$string = mysql_real_escape_string($string);
	
	// Return string
	return $string;

}

function formatStringOutputOntoForm($string)
{

	// Strip slashes
	$string = stripslashes($string);
	
	// Return string
	return $string;

}

However if I enter this onto the form:

<?php echo $test; ?>

The input is accepted.

If this is outputted onto a webpage sumwhere, then nothing is printed. However it does print onto the source (view->source).

Is there any way I can stop someone trying to enter php code?

Or is there additional checks I need to make on the input?

Thx
jd

 

[JonD]

Use htmlentities on input or output?

So which functions (and the right order) are needed on inputting stuff to a database, displaying it to edit and displaying it on a webpage?

yes i have a mysql connection open

 

[JonD]

Ok I trying to enter this string:

Hello "JonD". It's such a nice day today!

New line!

<?php echo $test; ?>

This sumbits fine and is entered back onto the textarea as:

Hello \"JonD\". It\'s such a nice day today!<br />
<br />
New line!<br />
<br />
<?php echo $test; ?>

In the database it is stored like this:

Hello \"JonD\". It\'s such a nice day today!

New line!

<?php echo $test; ?>

This is not what I want. This edit form should not be showing any slashes and the <br /> should not be visable.

Here are the functions:

function formatStringInput($string)
{	
	// Escape naughty characters
	$string = mysql_real_escape_string($string);
	
	// Return string
	return $string;
}

function formatStringOutputOntoForm($string)
{
	// Strip html type tags
	$string = htmlentities($string);
	
	// new line to breaks
	$string = nl2br($string);

	// Return string
	return $string;
}

Thx
jd

 

[JonD]

Ok seems to be working fine.

So should the datebase be storing '<' as '<' or '&lt' etc?

if the latter then I need to run htmlentities on input too?