Hi all. I'm learning PHP purely as a hobby, but I intend to write scripts such as a guestbook and tagboard and a basic blog. The problem is, if someone enters some malicious code in their guestbook entry. I know its possible to strip HTML tags out of the text in PHP, but is there anything more that can be done to eliminate someone trying to do such a thing? I imagine that it would involve regular expressions?
Obviously, BBcodes are the best technique for allowing people to format text in a guestbook, and I'm able to do a simple version using str_replace() which is great for converting [b] to <b> but not so good for say, anchor tags, where the content is variable.
I would apprecaite any help, pointers etc

Many thanks

Dunc

Hello Dunc,

There are 2 basic 'rules' you should always remember with user input data

• mysql_escape_string( $input ); when inserting input data into a db table
• htmlentities( $row['stored_input'] ); before displaying the user supplied data onto a web page

__________________
J de Silva
Learning Journal | GIDForums™ | GIDNetwork™ | GIDWebhosts™ | GIDSearch™

Thanks J. I'm currently writing a 'tag board' script as a starter and will use this code in that.
This is a very useful forum; keep up the good work