Re: PHP filter function against SQL injections

I second that its all to often i see this as an major problem
jeff

Henry Troup wrote:
> It's a serious mistake to assume that the php page will only ever see input 
> from its own page.  An attacker will not use the form on the page, but drive 
> attacks directly into the submit URL.  Client-side javascript can be a user 
> convenience; but it can never be part of your security strategy.
>
> Filtering input for security must be done on the server.  On the server you must treat 
> all input as "evil" until it is proven innocent (passes the filter).
>
> --
> Henry Troup
> htroup@acm.org
>
>  On Sat Feb 10 10:35 , Nic Stevens  sent:
>
> > I would suggest, though, using data filtering on the form using 
> > javascript as your first line of defense. If you're accepting a string, 
> > for example, only allow valid characters to be placed in the form field. 
> > (I don't know the event handler syntax off hand but I know it can be done)