PHP MySQL - Stilson.net

CHAPTER 13• WORKING WITH HTML FORMSwww.it-ebooks.infoStripping Tags from User InputSometimes it is best to completely strip user input of all HTML input, regardless of intent. For instance,HTML-based input can be particularly problematic when the information is displayed back to thebrowser, as in the case of a message board. The introduction of HTML tags into a message board couldalter the display of the page, causing it to be displayed incorrectly or not at all. This problem can beeliminated by passing the user input through strip_tags(), which removes all HTML tags from a string.Its prototype follows:string strip_tags(string str [, string allowed_tags])The input parameter str is the string that will be examined for tags, while the optional inputparameter allowed_tags specifies any tags that you would like to be allowed in the string. For example,italic tags () might be allowable, but table tags such as could potentially wreak havocon a page. An example follows:Validating and Sanitizing Data with the Filter ExtensionBecause data validation is such a commonplace task, the PHP development team added nativevalidation features to the language in version 5.2. Known as the Filter extension, you can use these newfeatures to not only validate data such as an e-mail addresses so it meets stringent requirements, butalso to sanitize data, altering it to fit specific criteria without requiring the user to take further actions.To validate data using the Filter extension, you’ll choose from one of seven available filter types,passing the type and target data to the filter_var() function. For instance, to validate an e-mail addressyou’ll pass the FILTER_VALIDATE_EMAIL flag as demonstrated here:$email = "john@@example.com";if (! filter_var($email, FILTER_VALIDATE_EMAIL)){echo "INVALID E-MAIL!";}The FILTER_VALIDATE_EMAIL identifier is just one of seven validation filters currently available. Thecurrently supported validation filters are summarized in Table 13-1.Table 13-1. The Filter Extension’s Validation CapabilitiesTarget DataBoolean valuesE-mail addressesIdentifierFILTER_VALIDATE_BOOLEANFILTER_VALIDATE_EMAIL294