Yeah, I always get paranoid about that type of thing... I know I've read things on white hat hacker blogs warning people on just that subject because on some forms you can type MySQL calls and get more information than they should be allowed through that.
I will read up on PHP security and filtering... I hate to admit it but I just want to get the site out right now. I do have any special characters restricted on forms accessible to the public, and there is no log in system... so I'm hoping that is enough for a few weeks until I have time to really crack down on security. Also things submitted require email validation, and then an admin to approve them. So I don't think I'm at risk for SQL injection hacking, can't say much for anything else ATM, I will read up on my security though. Thanks for the tip. On Oct 8, 10:02 am, BrendonKoz <[EMAIL PROTECTED]> wrote: > Data validation in the model is one thing, yes. Depending on your > application and any security, some extra filtering may be necessary > too due to some security implications. However, even I am guilty of > not filtering things when I should so that I can "get things done". I > would strongly suggest you read up on PHP security and filtering when > you have time though. > > Mark Story's TinyMCE suggestion is also a good one. Do keep in mind > that it would require the visitor to have JavaScript enabled (not > usually an issue). > > On Oct 8, 1:52 am, Cody Sortore <[EMAIL PROTECTED]> wrote: > > > Thanks, I like the nl2br solution. > > > When you say processing and filtering you do mean like data validation > > in the model right? If so yes... if you're talking about something > > else... uh probably not. Well I do have some $paginate restrictions > > in the controller (including a function that only displays approved > > comments). > > > On Oct 7, 9:20 pm, BrendonKoz <[EMAIL PROTECTED]> wrote: > > > > Via PHP code, you could also process the data through PHP's nl2br() > > > function, which inserts <br /> tags prior to the newline (the newline > > > is not removed). Hopefully you're already processing and filtering > > > the user data anyway. > > > > On Oct 7, 7:33 pm, Cody Sortore <[EMAIL PROTECTED]> wrote: > > > > > Okay, I know I sound like a complete n00b right now, and that's fine > > > > because I am. I've really only made applications for myself so far so > > > > putting in <br /> tags is no problem... but now that I'm trying to > > > > make something for other people to use how to I make it so that when > > > > they hit "enter" it will automatically put in a <br /> tag for me?- > > > > Hide quoted text - > > > - Show quoted text - --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "CakePHP" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/cake-php?hl=en -~----------~----~----~----~------~----~------~--~---
