PHP Variable
nanoymaster wrote: I believe they mean with like striptags or htmlentities Did you say "they" because you don't know if Larika is male or female? :P
Here is an example of what you're probably looking for, 0rijin4l:
<body>
<form method="POST">
Enter a message: <textarea rows="2" cols="20" name="message" />
</form>
Your message was: <?php echo $_POST["message"]; ?>
</body>
</html>
Note: This file must have the *.php extension because it uses PHP, and the server must have PHP installed.
That is a very basic example, but it should be a good start.
SlimTim10 wrote: [quote]nanoymaster wrote: I believe they mean with like striptags or htmlentities Did you say "they" because you don't know if Larika is male or female? :P
Here is an example of what you're probably looking for, 0rijin4l:
<body>
<form method="POST">
Enter a message: <textarea rows="2" cols="20" name="message" />
</form>
Your message was: <?php echo $_POST["message"]; ?>
</body>
</html>
Note: This file must have the *.php extension because it uses PHP, and the server must have PHP installed.
That is a very basic example, but it should be a good start.[/quote]
Cheers SlimTim, that is the kind of thing i was thinking of. Yeah, i know,i found that the hardway, when i coded like a page of php then saved it as a .html and got really confused why it wosent working :S, lol. :right:
Yeah, i have my home computer configured as a server, so i work directly and test on that……
With securing it, do i need to use add_slashes? But i heard there was something more secure than add_slashes as that is escapable isnt it? :matey:
SlimTim10 wrote:
Here is an example of what you're probably looking for, 0rijin4l:
<body>
<form method="POST">
Enter a message: <textarea rows="2" cols="20" name="message" />
</form>
Your message was: <?php echo $_POST["message"]; ?>
</body>
</html>
Note: This file must have the *.php extension because it uses PHP, and the server must have PHP installed.
That is a very basic example, but it should be a good start.
Cheers SlimTim, that is the kind of thing i was thinking of. Yeah, i know,i found that the hardway, when i coded like a page of php then saved it as a .html and got really confused why it wosent working :S, lol. :right:
Yeah, i have my home computer configured as a server, so i work directly and test on that……
With securing it, do i need to use add_slashes? But i heard there was something more secure than add_slashes as that is escapable isnt it? :matey:
Im not to worried about it being uber secure because it is a charity's site so i don't think it will particularly be a target, plus the area this code is in is htaccess-ed so it should be not to bad.
(Ihad always presumed Larika was male, but now you mention it……..:right:)
my mentor told me to use a array, like this
<?php
$bad=array("'",'"',"<",">","\\" );
$_GET['thing']=str_replace($bad,"",$_GET['thing']);
echo "Your text is " . $_GET['thing'];
?>```
you could also declare the input as a variable and then use the array to secure it..
i will have to be careful with what i disallow as it is a textbox for people to edit news articles so i do not want to take out commonly used characters such as
' or " or even> /(incase someone wants to suggest another website…….
What characters would you recomend be denied?
Edit: Bugger can't try any of those scripts now as i do not have access to a php server at school, and ftp connections are banned, bugger!
<?php
$_GET['thing']=str_replace(""","&!quot;",$_GET['thing']);
?>
like that, it replaces " with the html-entity and would display as a normal quotation mark on the page, but it is secure.. you have to remove the "!" in the str_replace() for it to work..
for common entities and stuff:
http://www.w3schools.com/tags/ref_entities.asp
cheers, Romnous