php XSS countermeasures

[cpearson]

If you write php code you are (or should be) aware of cross site scripting attacks and how vulnerable form processing can be. What countermeasures do you use. Post your functions (or links to) in this thread. I will kick it off with a a function I use regularly.



http://quickwired.com/smallprojects/...r_function.php

.

[cpearson]

Here is a quick way to remove non alphanumeric chars. from a string.

$var = preg_replace('/[^0-9a-zA-Z]/', '', $var);

[0-9a-zA-Z] means any character that is alphanumeric
[^0-9a-zA-Z] means any character that is NOT alphanumeric