protect a form from hacker

[bangla]

Hi,

i have the below code for form. At one time, when i went to my page i saw some data/link in my site. i guess a hacker entered some script in data field.

someone pls help me how i can protect my page.
-------------------
<form name="myForm"
action="gdform.php"
method="post">
<input type="hidden" name="subject" value="Form Submission" />
<input type="hidden" name="redirect" value="thankyou.html" />

<BR><b>Submit request to add your business:</b> <script language="JavaScript">document.write(findersHTML('CATEGORY'));</script><br>
<p style="margin-top:10px;">

<div style="float:left;">
<b>First Name</b><br><input type="text" name="FNAME" class="textField1" MAXLENGTH = "15" style="width:200px;"><p style="margin-top:6px;">

<b>Last Name</b><br><input name="LNAME" type="text" class="textField1" MAXLENGTH = "15" style="width:200px;"><p style="margin-top:6px;">

<b>Phone No.</b><br><input name="Phone" type="number" class="textField1" MAXLENGTH = "12" style="width:100px;"><p style="margin-top:6px;">

<b>Email</b><br><input name="EMAIL" type="text" class="textField1" MAXLENGTH = "85" style="width:300px;">
<br /><br><b>Business Type:</b><br><input name="business" type="text" class="textField1" MAXLENGTH = "16" style="width:200px;">
<br />
<b>Business Street Address:</b><br><input name="Address" type="text" class="textField1" MAXLENGTH = "35" style="width:300px;">
<br/><b>Business City:</b><br><input name="Address" type="text" class="textField1" MAXLENGTH = "15" style="width:150px;">
<br/><b>Business State:</b><br><input name="Address" type="text" class="textField1" MAXLENGTH = "15"style="width:90px;">
<br/><b>Business ZipCode:</b><br><input name="Address" type="text" class="textField1" MAXLENGTH = "5" style="width:50px;">

<br><b>Your Message</b><br>
<textarea name="message1" wrap="physical" cols="28" rows="5"
onKeyDown="textCounter(document.myForm.message1,document.myForm.remLen1,225)"
onKeyUp="textCounter(document.myForm.message1,document.myForm.remLen1,225)"></textarea>
<br>
<input readonly type="text" name="remLen1" size="3" maxlength="3" value="225">
characters left
<br>

<input type="Submit" name="Submit" value="Submit">
<br>
</form>

THanks.

[smantscheff]

Google for "sql injection". Protect your database (in gdform.php), not your form. You cannot do anything against malicious data coming in. But you can protect against processing it.

mysql_real_escape_string() and html_entities(). Maybe strip_tags too.

[jkon]

A person that entry some script in a form field is not a hacker. Besides the functions that PHP has (and mentioned above) acknowledge that many years know the standard way is prepared statements.

Some people out there (that I must say that they done a great job) implement all of that in PDO for PHP. It will take you a day or two understanding PDO and start using it but then you will look back at code written without it and it will look like it came out Stone Age.

PDO is useful, I admit.