I've searched of 21000 messages in this list and I don't quite understand how
to best protect user input.
Let's say you have a form that posts to itself just do see how messed up data
can get:
>>>>>>>>>>>>>>>>>>>>>>
if(get_magic_quotes_gpc()) {
$_POST=array_map('stripslashes',$_POST);
}
$_POST=array_map('trim',$_POST);
$fname=$_POST["fname"];
<input name="fname" value="<? echo htmlentities($fname); ?>">
<<<<<<<<<<<<<<<<<<<<<<
htmlentities() does a good job to protecting quotes and allows for pretty
flexible data entry characters.
I found another function on the internet called "cleanconvertaccents" which I
can run through array_map. However it's not perfect.
If you enter an ALT-151 charcter, the value of the input keeps getting longer
and longer as it double encodes on each submission.
newegg.com does a good job to maintaining extended characters (presenting them
back to the user) and keeps them from getting out of hand.
How do other do this?
thanks,
-Eric Wood
