special characters in html form

[lholland421]

Hi All,

Sorry to keep posting but i am at a brick wall with a few things and could do with some help

 

i have a html contact form which users fill out.when they submit the form it gets sent as an email and also gets inputted into an SQL table. The problem i have is when ever people use special characters such as ' or " we get a syntax error. as soon as they remove this the form sends.

 

How can i prevent this from happening?

Any sort of validation that swaps the special characters for accepted ones?

 

Thanks All

[unixman_again]

If you've done your forrm with php, try filter_var to sanitise the user input. That's what I do.

[lholland421]

The form itself is html but processed to email and Sql with php. Would I be better recreating the form in php ?

[LosOjos]

Sorry if this comes across as condescending, but I really think you ought to read up on SQL Injection attacks and how to prevent them; if you're not sanitising the input, a savvy student could destroy your SQL DB!

 

PHP: SQL Injection - Manual