Block PHP Tag

[Jack Franklin]

In the comments form on my blog, it allows any text to be displayed. Now, there must be a way to say 'If the text contains any PHP code, dont allow it'. Otherwise, people can enter PHP code which is not great!

[karinne]

Look into the addslashes() function

[Jack Franklin]

That wont block PHP code though?

[alexgeek]

And they can't really execute and PHP code unless your are stupid enough to use eval() on the comment string. They can however try to print out variables such as DB passwords and also use malicious HTML and JS. addslashes() and htmlentities() can counter this.

[saltedm8]

i have no idea, but i did do this, might work

PHP: Select all

<?php $forbiden="<";
if($_POST['submit'] && $_POST['<?php']);
{
if(strpos($forbiden, $_POST['<?php'])==$forbiden);
{
echo 'php not allowed'; ?>

my attempt at forbidding a certain word or text, maybe someone could improve on the idea

[RohanShenoy]

If you want, you may use regular expressions.

PHP: Select all

<?php
$string="967<php?PHPknn";
if((ereg('^[^.]+<[?][^.]+$',$string)) || (ereg('^<[?][^.]+$',$string)))
{echo "TAG FOUND";}else{echo "TAG NOT FOUND";}
?>

I have written a more exhaustive tutorial at http://www.w3hobbyist.com/index.php?...field-PHP.html