Topic: Tractor Pulling Database

[Farmgirl]

I've just finished a little project which I started in order to help me understand PHP & MySQL better. It's been a steep learning curve, but I feel now that I have grasped the basics. So with this in mind, please feel free to comment on my efforts.

T.P.Org.Uk - Tractor Pulling Database

[Adam]

Do you mean to critique the functionality (better suited to the BETA test forums) or the look of it?

[neil.johnson]

Be sure to santitize the input to any form before using in code. Put the following into your search field and see what happens (won't do any damage):

Code: [Select]

// put this into your search box
<script language="javascript">alert('xss attack');</script>


[Farmgirl]

Be sure to santitize the input to any form before using in code. Put the following into your search field and see what happens (won't do any damage):

Code: [Select]

// put this into your search box
<script language="javascript">alert('xss attack');</script>


Thanks for your input Neil, but how do I 'sanitize' the input?  It's not an area I am familiar with.  If you could point me in the right direction, I would be most grateful.

[neil.johnson]

Data from a form post or url parameters is held in the $_POST or $_GET array (in the case of a form decided by the form method <form method="post>)
You should clean this data prior to placing in any function or database query. Some simple functions:

Code: [Select]

<?php
// data from form is in post array
$searchString = $_POST['searchterm'];
// check that the value is not balnk
if(strlen(trim($searchString))) {
 // remove any injected html
 $searchString = strip_tags(trim($searchString));
 // perform search query and escape variable
 $result = mysql_query("SELECT * FROM tablename WHERE x LIKE '".mysql_real_escape_string($searchString)."%'");
 print "Your search for: ".$searchString." returned ".mysql_num_rows($searchString)." results"; 
}
else {
 print "Please enter a valid search term";
}
?>


[Farmgirl]

Thank for that! I'll try it out.

Cheers

[Farmgirl]

Well I think I've FIXED the problems...at least I HOPE I have!