Search code examples
phphtmlcsswhitelist

Protect HTML form from Javascript/Attacks

I have a form and as of right now, you can type any javascript, etc. you want. Any XSS, etc.

How do I go about creating a whitelist so you can only post characters.

At some point I would like anything that starts with http:// to be converted to

<a href="http://..."></a>

Thanks

Is this efficient? http://htmlpurifier.org/

Solution

  • jQuery or Javascript is preferred

    Well, no, you can't do that, you see? Because even if you 'sanitize' your data using javascript, noone's stopping anyone from

    • turning off javascript
    • using a browser's developer console to mess with the data
    • doing the POST directly, without a browser

    In other words, you have to perform the validation/sanitization on the server side. Javascript validation is there to enhance the experience of your users (by providing instant feedback on invalid input, for example).