Re: PHP filter function against SQL injections

[Henry Troup <htroup () acm org>]

It's a serious mistake to assume that the php page will only ever see input from its own page.  An attacker will not 
use the form on the page, but drive attacks directly into the submit URL.  Client-side javascript can be a user 
convenience; but it can never be part of your security strategy.

Filtering input for security must be done on the server.  On the server you must treat all input as "evil" until it is 
proven innocent (passes the filter).

--
Henry Troup
htroup () acm org

 On Sat Feb 10 10:35 , Nic Stevens  sent:

> I would suggest, though, using data filtering on the form using 
> javascript as your first line of defense. If you're accepting a string, 
> for example, only allow valid characters to be placed in the form field. 
> (I don't know the event handler syntax off hand but I know it can be done)