Re: PHP filter function against SQL injections

[jeffrey rivero <jeffr76 () yahoo com>]

I second that its all to often i see this as an major problem
jeff

Henry Troup wrote:
> It's a serious mistake to assume that the php page will only ever see input from its own page.  An attacker will not 
> use the form on the page, but drive attacks directly into the submit URL.  Client-side javascript can be a user convenience; 
> but it can never be part of your security strategy.
>
> Filtering input for security must be done on the server.  On the server you must treat all input as "evil" until it is 
> proven innocent (passes the filter).
>
> --
> Henry Troup
> htroup () acm org
>
>  On Sat Feb 10 10:35 , Nic Stevens  sent:
>
> > I would suggest, though, using data filtering on the form using 
> > javascript as your first line of defense. If you're accepting a string, 
> > for example, only allow valid characters to be placed in the form field. 
> > (I don't know the event handler syntax off hand but I know it can be done)