A good measure everyone should adopt is that of security, never explicitly trust your users to be nice and input precisely what you expect them. Always, always check POST and GET variables are safe before using them. Functions such as "strip_tags", "mysql_real_escape" (if you go and place these into a database), should be explored.
views:
33answers:
3
A:
Jim Grant
2010-09-06 20:05:40
A:
I just grabbed your code and tested it out in my computer. Did some small changes but everything if working fine. I just commented
xmlhttp.execCommand('mceRemoveControl',false,'content');
then everything worked fine on FireFox.
Below you can see the code that I ran:
HTML:
<html>
<head>
<!--link href="CSS.css" rel="stylesheet" type="text/css"-->
<script type="text/javascript">
function sendmessage()
{
if (window.XMLHttpRequest)
{
xmlhttp=new XMLHttpRequest();
}
else
{
xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
}
var name=encodeURIComponent(document.getElementById("name").value);
var message=encodeURIComponent(document.getElementById("message").value);
xmlhttp.open("POST","insert.php",true);
xmlhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
//xmlhttp.execCommand('mceRemoveControl',false,'content');
xmlhttp.send("name="+name+"&message="+message);
}
</script>
</head>
<body>
<center>
<table width="600">
<tr>
<td height="400">
<center>
<iframe src ="output.php" width="580px" height="386px">
<p>Your browser does not support iframes.</p>
</iframe>
</center>
</td>
</tr>
<tr>
<td>
<form method="POST"></br>
  Name:      
<input type="text" id="name" autocomplete="off" size="15"/><br/><br/>
  Message:  
<input type="text" id="message" autocomplete="off" size="70"/>  
<input type="submit" value="Send" onclick="sendmessage()"/>
</form>
</td>
</tr>
</table>
</center>
</body>
</html>
PHP:
<?php
try{
$name='<table><tr><td width="100%">'.$_POST['name']." Says:</td>";
$message="<table><tr><td>".$_POST['message']."</td></tr></table></br>\n";
$time="<td>".date("d/m/y-G:i")."</td></tr></table>";
$file = "output.php";
$write = fopen($file, 'a') or die("Can't open file");
fwrite($write, $name);
fwrite($write, $time);
fwrite($write, $message);
fclose($write);
}catch(Exception $err){
echo $err;
}
?>
I just tried in FireFox 3.6 Safari 5 and Chrome 6. I'm using a Mac so I didn't tried in IE. In those 3 browsers everything worked fine after the line that I told you at the beginning. Could you proved more details about your problem?
João Gala Louros
2010-09-06 20:31:58
I knew about that segment of code. It was a previous attempt at fixing the problem I was suffering, but I forgot to remove it when posting this question. The form requires the user to submit the data fields multiple times before it appears to be recognised by the PHP code that should add it to a log file. It doesn't seem to suffer this problem if I don't enter any information into the forms. Sorry about this as it is my first time using the site.
2010-09-06 20:55:29