6 replies to this topic

[krstjern]

Hya, I'm making a comments system for my news page(for my site) and i have added some sequrity, but i want to know if theres something more i should add?

Here is the code i have for checking at the momment:

if($_POST[name]=="") { die("Please insert name."); }
if($_POST[comment]=="") { die("Please insert a comment."); }
if(strlen($_POST[name])>30) { die("Name is too long."); }
if(strlen($_POST[email])>45) { die("Email too long."); }
if(strlen($_POST[comment])>200) { die("Comment is too long."); }
$name=$_POST[name];
$email=$_POST[email];
$comment=$_POST[comment];
$date=date('Y.m.d');
//First layer protection
$name=htmlspecialchars($name);
$email=htmlspecialchars($email);
$comment=htmlspecialchars($comment);
//Second Layer protection
$name = strip_tags($name);
$comment = strip_tags($comment);

I heard hacker could use some kind of code to destroy MYSQL? How can i prevent that?

Edited by krstjern, 18 August 2005 - 01:35 PM.

[rc69]

Well, what are you going to do with all those variables? Send somebody an e-mail, or insert them in to a database of some kind (i.e. MySQL), etc...?

[krstjern]

Well, i told that it was for a comments system, anyway: It's put into a MYSQL DB.

[Jaymz]

use addslashes() on the variables when sticking them in the db, and stripslashes() when pulling it out

[Av-]

what do these strip and add slashes do?

[Jaymz]

what do these strip and add slashes do?

Add slashes turns

"Hello" this "is in quotations"

into

\"Hello\" this \"is in quotations\"

Rendering the quotes harmless (helping prevent SQL commands, etc.

Stripslashes removes them after pulling them back out so your text doesn't look wonky on the page

[rc69]

Note the fact that an answer to this can be found Here also.

In other words, check php.net for answers to what a function does before asking here. Even though Jaymz was right, you can find a little more info at php.net (i.e. what other characters get escaped+example code).

Well, i told that it was for a comments system, anyway: It's put into a MYSQL DB.

I still asked the question because it could have been an "e-mail me your comments about my site" script... or a simple forum-style comment system, there's no way we could've known without more of the script.