What happens if a user enters some php code into input? [duplicate]

Question

This question already has answers here:

Preventing code injection without limiting user input? [closed] (4 answers)

Closed 9 years ago.

Strings can be escaped in php before inserting them into database. But what happens, if an user of my website enters a php code?

For eg. An user submits the following to a form, which escapes the string and inserts the data into my database.

Hello! <?php echo 'this is evil'; ?>'

Then this php line will be stored in the database. And when I display the content, it will be converted into this :

<div>Hello!<?php echo 'this is evil'?></div>

Isn't this a potential security risk? As the php code can be very malicious?

Does this mean I have to use strip_tags on every user input?

Answer 1

No It's not risky since php does not interpret the code and actually you don't use eval for this values so it will be shown as a plain text.

Now the thing is you should validate user's inputs. for example if this is an input for firstname, no one's name contains < or ?. so you can use Regexp to validate values.

Or you should print htmlentities of the value instead of raw value.

Answer 2

That PHP code won't run but you have to validate userr form data before submitting it in database

replace all "<" and ">" to &lt and &gt respectivly

$data = str_replace("<","&lt",$data);
$data = str_replace(">","&gt",$data);

this also help if user try to insert some javascript into your code

Answer 3

you have to add anti injection function, such as mysqli_real_escape_string() or htmlspecialchars() or addslashes() to your data that have submited by users