Web Hosting Talk : Web Hosting Main Forums : Programming Discussion : code to block/prevent JavaScript Injection

[sdhost1964]

greetings,
I need html code or script ...etc to stop/block or prevent hacker to inject my html page

regards
bob

[onel0ve]

install Mod security in your server it will help you

[FocusKieran]

A white list of characters is probably the best way to go about it if you're allowing user input. So simply encode the characters you don't want and leave the others as they are, or vice versa encode it all and decode the ones you want...

[khunj]

You need to find/patch the vulnerability and your problem will be solved.

[ScottAN]

I agree with the above. You should not think to be adding code to solve a script injection problem. You should think about fixing the code that you already have that allowed for script injection.

Remember to strictly validate all input received from the client in your scripts.

[babygekko]

You mean you're trying to prevent XSS?

This is just one way ... I'm sure there are other ways ..

PHP Code:

        function cleanInput($value)
      {
        $value = preg_replace("/[\'\")(;|`,<>]/", "", $value); 
        return $value;
      } 


e.g:

PHP Code:

$_GET['the_input'] = cleanInput($_GET['the_input']); 


[topgun]

Encode all user input to html entities before it is displayed.

<script>
 alert('xss');
</script>

would become:

<script>
 alert('xss');
</script>