Prevent javascript code being submitted in a form

[rhodoscoder]

i have a form that posts to a database and i was testing code that prevents any javascript or othe client-side scripting from being submitted to the database.All javascript code i submitted ended up in the database, i figure this is bad.How can i prevent this?

[Alibi Ghazi]

The easiest solution is to create a verification test (in js) on the form .

[decade]

use the PHP code

strip_tags()

on your PHP page.
example:

$variablename = strip_tags($_POST['myvalue']);

[cereal]

Consider to use HTML Purifier in your application: http://htmlpurifier.org/

It will give you the ability to whitelist the tags that you want to allow and, most important, it will validate the attributes, removing the javascript included.

[rhodoscoder]

thank you@Alibi Ghazi, $decade and @cereal.@cereal I ran into html purifier but haven't tried it yet, i heard it slows down you app.

[cereal]

Yes, when you get heavy traffic it can slow down responses, but you have few options: http://htmlpurifier.org/docs/enduser-slow.html

Bye!