View Single Post
  #5 (permalink)  
Old 11-07-2007, 10:07 PM
imvain2 imvain2 is offline
WebProWorld Pro
 

Join Date: Apr 2004
Posts: 288
imvain2 RepRank 0
Default Re: Check data before insert database

I agree with niggles, you may want remove the tags, or if you need to detect then I would do a mix of solutions due to the XSS.

Please note that I haven't tested this code out, I just changed around the info from PHP: strpos - Manual.

Code:
$haystack = $_POST["textinput"];
$haystack = str_replace("<", "&lt;", $haystack);
$haystack = str_replace(">", "&gt;", $haystack);

$needle   = '&lt;/&gt;';
$pos = strpos($haystack, $needle);

if ($pos === false) {
    //add to db
} else {
   echo "Please remove those tags and try again";
}
Reply With Quote