URL injection issue with php site

Question

I have HTML site and we are using PHP code to manage contact page. Currently, we are facing issue with URL injection alert from security scan. Found the issue is with following two lines PHP codes, but unable to validate date input.

<div class="field calendar"><input name="contact-arrival" type="date" placeholder="Arrival Date" id="contact-arrival" value="<?php if (isset($_POST['arrival']) && !empty($_POST['arrival'])) { echo $_POST['arrival']; } else { echo '';} ?>" readonly /><i class="fa fa-calendar-o"></i></div>

<div class="field calendar"><input name="contact-departure" type="date" placeholder="Departure Date" id="contact-departure" value="<?php if (isset($_POST['departure']) && !empty($_POST['departure'])) { echo $_POST['departure']; } else { echo '';} ?>" readonly /><i class="fa fa-calendar-o"></i></div>

AMc · Accepted Answer · 2016-12-02 10:09:15Z

1

You should escape the posted data using htmlentities:

echo htmlentities($_POST['arrival'], ENT_QUOTES, 'utf-8');

Note: you should also validate the form data once the form is posted to your PHP script.

answered Dec 2, 2016 at 10:09

AMc

1,7631 gold badge13 silver badges15 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Chathuranga Abeyrathna Over a year ago

After got the post request the form will be validating the input using HTML validation. If you have any other better idea please let me know. Thanks.

AMc Over a year ago

Validate on both sides - in the browser AND on the server. Validation in the browser saves sending a request to the server with invalid data. Validation on the server will prevent SQL injection attempts and 'dirty' data from going into your database. You can find out more about data filtering here: phptherightway.com/#data_filtering

Collectives™ on Stack Overflow

URL injection issue with php site

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related