From the course: PHP Tips, Tricks, and Techniques

Unlock this course with a free trial

Join today to access over 22,600 courses taught by industry experts.

Prevent cross-site script attacks in forms

Prevent cross-site script attacks in forms

From the course: PHP Tips, Tricks, and Techniques

Start my 1-month free trial Buy for my team

Prevent cross-site script attacks in forms

“

- Hi, I'm David Powers, and welcome to this week's edition of PHP Tips, Tricks and Techniques, designed to help you become a smarter, more productive PHP developer. This week, I'm responding to a query from a member about the danger of cross-site scripting attacks when using the superglobal variable, SERVER PHP_SELF, in an online form. I'll begin by describing the problem, explain why I think the commonly-recommended solutions are unsatisfactory, and then propose what I believe to be a better solution to keep your online forms secure. If you want to follow along, you can download the exercise files for this video. On this page, I've got a simple form that asks the user to input their name and then displays it on the same page when the form is submitted. In the opening form tag, the action attribute tells the browser where to find the script to process the form. In PHP, it's very common to use self-processing forms. In other words, to put the processing script in the same file as the…

Contents